Security is measured in hours of downtime, not attacks avoided.

Three questions, and you already know the answers without calling anyone. Has your backup ever been restored, or does only the nightly job exist? Is there a list of what is reachable from outside, and of who can get in? When a supplier writes that their bank details have changed, does someone confirm it by phone on a number you already had?

If you hesitated on one of the three, you have found your priority. In the order problems actually turn up, the first vector is not a sophisticated attack: it is a compromised mailbox, often a supplier's rather than yours. The second is remote access or a VPN reachable from the internet with valid credentials. Ransomware comes later, once both have been left open.

One warning worth more than a checklist: two-factor authentication cuts the risk a long way, but it does not close it. Session theft works with the second factor enabled, and anyone telling you that MFA settles the matter is telling you half the truth.

This is the one security exercise whose result is a fact rather than an opinion. I take the system your day depends on, restore it in a separate environment, measure how long it takes and what is missing, and hand you that number. Not "the backups are fine": nine hours, and the CRM attachments are gone.

Almost nobody does it, and the reason is uncomfortable: it takes time and it risks proving that the service you bought does not work. I have seen all three ways a backup saves nobody. It sits on the same NAS that gets encrypted with everything else. It is reachable with the same domain credentials the attacker used, which makes it a copy rather than a protected copy. Or it works, and it takes eight days to pull the data back down when the business can survive three.

Out of that comes the only question that matters, and the one your provider has probably never asked you: how many hours of downtime the business can take, and how much data you can afford to lose. Two numbers, yours to decide, and the rest of the security work is sized on them.

This is the most common reason a smaller company calls, far more than fear of an attack: a client sends a two-hundred-question questionnaire, and the contract is at risk if it goes unanswered. The work is not filling it in quickly. It is turning it into fifteen prioritized actions, answering defensibly about what exists, and being clear about what does not, because an inflated answer is a contractual problem that surfaces at the audit.

NIS2 is why that questionnaire exists, and here a point needs making that almost nobody makes. Directive (EU) 2022/2555, implemented in Italy by D.Lgs. 138/2024, applies by sector and size: broadly from 50 employees or 10 million in turnover upwards, in the sectors listed in its annexes. Most small companies are not in scope directly. But if you supply someone who is, the requirement reaches you anyway, by contract, and it arrives before any statutory deadline.

Anyone telling you "you are subject to NIS2" without having checked your sector and your size is selling. Checking it is the first thing I do, and if it does not apply to you I say so: formal adequacy to a directive that does not cover you is a cost you do not need. Your client's questionnaire has to be dealt with either way.

The seven-in-the-morning phone call always sounds the same: the ERP won't start, the files have odd names, the warehouse doesn't know what to ship. The first hours decide more than the rest. Isolate without shutting down, because shutting down destroys what tells you how they got in. Leave the backups alone until it is clear whether they are compromised. And start the notification clock, because when data has also been copied it is a personal data breach, and the 72 hours under GDPR art. 33 run from the moment you know, not from the moment you finish restoring.

Now the part other pages leave out. I do not provide 24/7 monitoring: I am one person, and anyone promising continuous cover on their own is lying to you. I have no SOC, meaning a team that watches the alerts in shifts around the clock, and my capacity is limited: when I am full I say so, instead of taking the work and having someone else do it. That is the same fact seen from the other side, which is why the person who answers is the one who saw your systems, not a junior who arrived after the contract, and a year later the memory of what was decided is still the same one. During an incident my role is to coordinate and decide, not to be the hands. And since there is no on-call rotation, who moves first at seven in the morning is something I settle with you in writing beforehand: usually your systems provider, with me reachable the same day.

What I do is the work that makes that morning less severe: choosing and putting in place the right tools (endpoint protection, immutable backup, mail filtering) and then verifying they do what the contract says, deciding in advance who calls whom, and rehearsing the sequence once with the people who will have to run it. You buy the product from the vendor, not from me: I don't resell licenses, so when I tell you something is unnecessary you can believe me.

The first call is free and exists to work out whether your problem is one I solve. The assessment starts at €750, is bought on its own, and ends with a document that is yours: what is exposed, how long it takes to restart measured on a real restore, and the actions ordered by risk removed against cost.

What it is not, said upfront rather than afterwards: it is not an ISO 27001 certification, which an accredited body issues and a consultant cannot; it is not a formal penetration test; it is not a monitoring service. If you need one of those three I will tell you and point you to it, even when that means somebody else does the work.

The three things worth more than any budget, if you can only do three: strong authentication on mailboxes, a backup that has actually been restored, and a mandatory phone check on every change of bank details. They cost almost nothing and cover most of the damage I see. If you have already done all three, you probably don't need me right now.