Security vendors will happily sell you a long list. For a company with 10 to 100 employees, a short list done well protects you more than a long list half deployed.
Here is the order we usually recommend, what each piece does and how to buy it without paying twice.
The first five controls
After those five, the next steps are usually device management and patching, tighter control of admin accounts and a written plan for what happens during an incident.
Multi factor authentication
On email, remote access, banking, payroll and every admin account. It stops a large share of account takeovers.
Endpoint detection and response
EDR software on every laptop and server, watched by someone who can act on what it finds.
Email filtering
Phishing and impersonation protection in front of your mailboxes, since email is where most attacks start.
Backups you can restore
Copies kept separate from your main systems and tested regularly. See our backup guide.
Staff training
Short, regular training and phishing tests so people recognize the requests that matter.
EDR, MDR and your IT provider
EDR is software that detects suspicious activity on a device. MDR, or managed detection and response, adds people who watch those alerts around the clock and respond, for example by isolating an infected laptop.
Many IT providers resell an MDR service or run one themselves. The question that matters is simple: who is watching at 2am, and what are they allowed to do without calling you first?
What cyber insurers ask about
Insurance applications now commonly ask about multi factor authentication, endpoint protection, backups, email filtering and training. Answer them accurately, because what you state on the application can affect how a claim is handled. If you cannot honestly answer yes, that gap is usually the next thing to fix.
Questions to ask a security vendor
- Who responds after hours, and what can they do without our approval?
- Which reports will we see, and how often?
- How do you work with our IT provider during an incident?
- What is included, and what would incident response cost?
- What is the contract term, and does it renew automatically?
How Level2 helps
We map what you already have, including tools inside your Microsoft 365 plan, find the gaps and duplicates, and compare providers for the pieces you are missing. See our services or book a free review.
Questions we hear about this
You need someone watching alerts and able to respond. For most small businesses that comes from an MDR service rather than an in house team.
Defender for Business, included in Microsoft 365 Business Premium, is a capable EDR tool. The bigger question is who monitors it and responds when it raises an alert.
Start with the five controls above. Most companies our size can cover them without an enterprise budget, often partly with tools they already pay for.
It is useful once the basics are in place, and some customers, insurers and compliance programs require one. Before that, the money usually does more good on the five controls.