Cyber security for Hull and East Yorkshire businesses
Most attacks on businesses your size are not targeted. They are automated, they look for the easy way in, and the easy way in is usually a password, an unpatched laptop or someone having a busy morning.
Security advice aimed at small businesses tends to arrive in one of two forms. Either it is a scare story with nothing you can act on, or it is a list of controls written for a company with a security team.
Neither helps if you have thirty staff, one server and a lot to get on with.
It is not that businesses are not worried. In a 2025 survey of small businesses by Beetroot Consulting, cyber security came out as the most urgent technology priority, with 40% rating it extremely urgent. Knowing it matters and knowing what to do about it are different problems.
What actually matters
The controls that stop most attacks are not complicated or expensive. Multi-factor authentication on everything. Software kept up to date. Old accounts closed the day someone leaves. Backups that have been tested by restoring something. Staff who know what a phishing email looks like because they saw one last month in a test.
That is most of Cyber Essentials, and it is most of the risk.
We hold it ourselves, and you can check our certificate rather than take our word for it. It would be a strange thing to hold you to a standard we had not met.
We start there, we tell you what it costs, and we do not sell you a product that solves a problem you do not have.
Not sure where you stand on AI?
AI tools are the one thing that has arrived faster than most policies. If staff are already pasting client information into them, that is a data question before it is a technology question. Small business use of AI rose from 20% in 2023 to 55%, and 92% now worry about the risks (Federation of Small Businesses, 2026). The free AI risk check takes a few minutes and tells you where you actually are.
What is included
What you get
Cyber Essentials certification
The government backed scheme that covers the five controls stopping the majority of common attacks. We get you through it.
Staff training and phishing tests
Short monthly training and realistic simulations, so people learn to spot a scam in the moment rather than in an annual slideshow.
Endpoint protection
Modern protection on every laptop, desktop and server, monitored rather than installed and forgotten.
Email security
SPF, DKIM and DMARC, plus filtering and rules to catch impersonation and invoice fraud.
Multi-factor authentication
Rolled out across Microsoft 365 and your other systems, with the sign-in methods attackers target switched off.
Patching
Operating systems and third party software updated on a schedule. Unpatched software is how most automated attacks get in.
Backup and recovery
Tested restores, and copies an attacker with your admin password cannot delete.
Policies
Acceptable use, password and remote working policies written in plain English, so people can actually follow them. Including our free AI acceptable use policy.
Who we work with
The baseline
What you need. No less, no more.
Every business we support has the same set of basics in place. It is not a premium tier and it is not an add-on. It is the line we think every business should be above, so it is part of what you already pay. Being small is not cover: 42% of micro businesses and 46% of small businesses had a breach or attack in the past twelve months (Cyber Security Breaches Survey, 2026).
No less
If you are below the line when you come to us, we fix it. Being under-protected is not the cheaper option. It is a bill you have not had yet.
No more
We will not sell you a product for a problem you do not have. If you are already covered, we will say so, even when there is money in saying otherwise.
We did not invent this list. It follows the five controls in Cyber Essentials, the government backed scheme, plus the few things experience says you should never skip. We hold the certification ourselves, so it is a standard we live with and not one we only sell.
1. Firewalls
- Boundary and device firewalls configured and reviewed, not left on whatever the box shipped with
2. Secure configuration
- Default passwords changed, unused accounts and services removed
- Encryption on laptops and phones, so a lost device is not a reportable breach
3. User access control
- Multi-factor authentication on every account, with the legacy sign-in methods attackers target switched off
- Admin accounts kept separate from the account someone reads email on
- Leavers disabled the day they leave, not at the next audit
- People given access to the data their job needs and not the rest
4. Malware protection
- Endpoint protection on every device, monitored rather than installed and forgotten
5. Security update management
- Operating systems and third party software patched on a schedule, not when somebody remembers
And the three it does not cover
- Backups tested by restoring something, with copies an attacker holding your admin password cannot delete
- Phishing training that runs all year, not an annual slideshow
- A written plan for what happens on a bad day, including who reports what and when
Where GDPR fits
UK GDPR asks you to protect personal data with appropriate technical measures, and to be able to restore it when something goes wrong. The controls above are most of that in practice, and the breach plan is what lets you meet the 72 hour reporting deadline instead of working it out on the day.
We will be straight about the limit. This covers the security side of UK GDPR. It does not write your privacy notice, decide your lawful basis or answer a subject access request for you. Anyone telling you a product makes you GDPR compliant is selling something.
Go deeper
More on Cyber Security
Cyber Essentials
The five Cyber Essentials controls explained in plain English, what the assessment actually asks for, and where smaller businesses usually fail it.
Read moreStaff training and phishing tests
Human risk management for smaller businesses. Short monthly training, realistic phishing simulations and simple reporting on who needs a hand.
Read moreEndpoint protection
Managed endpoint protection for laptops, desktops and servers. Installed, monitored and acted on, not left running in a tray unnoticed.
Read more
How we work
What working with us looks like
- 1
Find out where you stand
A readiness check against the five Cyber Essentials controls tells you what is actually exposed, not what might be.
- 2
Fix the cheap things first
MFA, leavers, patching and backups. They cost little and they stop most of what is coming at you.
- 3
Bring the team with you
Training that is short, regular and does not blame people for clicking. Blame makes staff hide mistakes.
- 4
Keep checking
Security is not a project with an end date. We review it with you and renew your certification each year.
Free download
Free AI acceptable use policy
A ready to use policy covering what staff can and cannot put into AI tools. Written for smaller businesses, no jargon.
Common questions
We are a small business. Are we really a target?
You are not being singled out, which is exactly the problem. Most attacks are automated and look for weak passwords, old software and exposed services across thousands of businesses at once. Size does not protect you.
What is Cyber Essentials and do we need it?
It is a UK government backed certification covering five basic controls. Some public sector contracts require it, many insurers ask about it, and it is a sensible baseline even when nobody is asking. See our Cyber Essentials page.
Do you do penetration testing?
Yes, in house. We do not subcontract it, so the people who test your setup are the people you can ask about the findings afterwards.
We are a small business. Are we really a target?
Yes, and the government's own figures say so: 42% of micro businesses and 46% of small businesses had a breach or attack in the past twelve months, and phishing was the most common type, affecting 38% of UK businesses (Cyber Security Breaches Survey 2025/26). Most attacks are not aimed at anybody in particular. They are automated, and they find whoever has left the door open.
Are you certified yourselves?
Yes. We hold Cyber Essentials ourselves. It would be a strange thing to hold you to a standard we had not met, and it means the five controls in our baseline are ones we live with rather than ones we only sell.
In their words
What clients say about working with us
Select Group helped us understand the difference between having cybersecurity controls in place and knowing how those controls actually work for our business. With a fully remote team, sensitive client information and different levels of technical confidence, that distinction matters enormously. They've helped us make informed, practical security decisions that protect our organisation whilst allowing our people to work effectively. As CEO, that gives me the confidence to make braver decisions about what we do next.
Kanika Selvan, CEO, Beetroot Consulting
Get in touch
Tell us what is not working
Send us a line about your setup and we will come back with what we would actually do about it. No sales pitch, no obligation.
Or call 01482 586 550 or email [email protected].
This form is provided by Growably. See our privacy policy.
Want a straight answer about your IT?
Tell us what is not working. We will tell you what we would do about it, with no sales pitch and no obligation.