--- title: 'Cyber Security Consultancy for UK SMEs' url: 'https://triplepoint.org.uk/consultancy/cyber-security' markdown: 'https://triplepoint.org.uk/consultancy/cyber-security.md' date: '2026-10-15' description: 'Independent cyber security consultancy for UK small businesses: security reviews, Microsoft 365 hardening, policies and help with customer security questionnaires, from a consultant with 20 years at Sophos.' --- # Cyber Security Consultancy for UK SMEs The problemMost small businesses know security matters, but not where to start or what "good enough" looks like for a business their size. Advice from vendors tends to end in a product, and a long list of findings is no help if nobody says which ones matter. At the same time, customers, insurers and tenders are asking harder questions, and "we have antivirus" no longer answers them. What we can do- A security review of your devices, accounts, email, network and cloud services, with findings ranked by real-world risk - Microsoft 365 security review and hardening: sign-in, multi-factor authentication, admin accounts, sharing and email settings - A practical, prioritised improvement plan that fits your budget, not a wish list - Security policies written for how your business actually works, including acceptable use, passwords, remote working and incident response - Help answering customer, insurer and tender security questionnaires - Independent advice on choosing security products and services, whoever supplies them - Ongoing advice as and when you need it, without a full-time hire Who it's forSmall and medium-sized businesses without an in-house security specialist, businesses whose IT provider wants a second opinion, and anyone facing a security questionnaire from a customer, insurer or tender. How it's chargedWork is charged at our standard day rate. We agree the scope and the number of days with you before anything starts, so there are no surprises, and it's invoiced separately from any monthly services. How it works1. **Initial conversation**What prompted the call, what you already have in place, and what you need at the end. 2. **Review**We look at your systems and settings, and talk to the people who run them. 3. **Report and plan**Findings in plain English, ranked by risk, with a step-by-step plan to fix them. 4. **Help putting it right**If you want, we make the changes with you or your IT provider, or check them afterwards. Who does the workAndy Martin spent 20 years at Sophos, supporting, selling and training others on its security products, and is a Certified Ethical Hacker (CEH). Advice is vendor-neutral: we recommend what fits your business, whoever makes it. Questions Will you just recommend Sophos?+No. We're a Sophos partner, so we'll tell you when a Sophos product fits, but the review covers what you already have and recommends the right fix for each gap, whoever supplies it. Often the best fixes are settings you already pay for. We have an IT provider. Do we still need this?+Maybe not. Plenty of IT providers do security well. A review gives you an independent view of where things stand, and we're happy to work through the findings with them. Can you help us get Cyber Essentials?+We don't carry out Cyber Essentials certification ourselves. Many of the gaps it looks for come up in a security review, though, so a review is a useful first step before you apply. [← Back to all consultancy services](https://triplepoint.org.uk/consultancy) ## Got a project in mind? Tell us what you're trying to do and we'll tell you honestly whether we can help, how long it's likely to take, and what it would cost. No obligation. [Talk to us →](https://triplepoint.org.uk/contact?about=Cyber%20security) or [See every consultancy service →](https://triplepoint.org.uk/consultancy) --- ## Navigation - Parent: [IT & Cyber Security Consultancy UK | AI, Power Platform, Pen Testing](https://triplepoint.org.uk/consultancy.md) - Next: [AI Adoption Consultancy for UK Businesses](https://triplepoint.org.uk/consultancy/ai-adoption.md)