Every guide, grouped by topic. Practical security for founders and owners of 5-200 person companies — no security team required.
Who can log in to what, on which device, and what happens the day they leave. The unglamorous controls that stop one stolen password from becoming a company-wide incident.
Access outlives employment at almost every small company. Here is the checklist that closes the gap — hour one, day one, week one — and the two hard cases nobody plans for.
7 min read
MFA is the highest-value hour you will ever spend on security — if you do it in the right order. Here is the order, the accounts everyone forgets, and how attackers get around weak MFA.
7 min read
The checklist, then one email a week on what changed and what a company your size should do about it.
Weekly. Unsubscribe in one click. See the checklist first.
Security questionnaires, cyber insurance applications, and enterprise procurement reviews — the moments where your security posture becomes a revenue question.
The application form is the most specific, best-prioritised security checklist you will ever be handed — written by people who pay when it goes wrong. Read it that way.
6 min read
The security questionnaire is a sales document that happens to be about security. Here is how a company with no security team answers one credibly — and turns it into an advantage.
7 min read
What you would need to be operating again by Friday if everything were encrypted on Monday — and how to know your backups work before you have to find out.
Everything about surviving ransomware comes down to one question you can answer today: if it all got encrypted tonight, how long until you are working again — measured, not guessed?
8 min read
Almost every loss at a small company arrives by email: a fake invoice, a spoofed supplier, a login page that isn't. How the scams work and how to make them fail.
The advice you were given — check for typos, look for urgency — stopped working years ago. Here is a check that still holds up, short enough that people will actually use it.
6 min read
No malware, no hacking, no alarm. Someone reads your email for three weeks, then sends one message at exactly the right moment. Here is the rule that makes it fail.
7 min read
The short list of things that actually prevent incidents at a company of 5 to 200 people — in the order a founder should do them, with no security team required.
You do not need a security team. You need five controls, done properly, in the right order — and the discipline to ignore everything else until those five are finished.
8 min read
A practical, no-hype introduction to the zero trust security model — what it is, why it matters, and how security teams get started.
1 min read