Disciplines · 04 · Security
Most SMB security conversations start after something happened — a phishing click, a failed audit, an insurance renewal that pulled a thread. The posture that matters in those moments was built months earlier. Our job is to build it with you now, so the next call isn't the emergency one.
Security is a long list of things you could do. To keep the conversation honest, we reduce it to three layers and ask which one is the thinnest. That's the one worth going deep on — not the one easiest to sell, and not the one that happens to be in this quarter's vendor slide deck.
What's exposed to an attacker. Public ports, legacy authentication, published apps, conditional access exemptions, dormant admin accounts, external mail forwarding. Every one of these is an opportunity you can shrink before anyone tries to use it.
What you can see when something happens — or might have happened. Telemetry from identity, endpoint, email, and cloud, correlated into one picture, tuned so the signal rises above the noise. Without this layer, every suspicious moment turns into days of guessing.
What you actually do when it does. Playbooks for the common scenarios, air-gapped backups that survive a storage-fabric compromise, a clear chain of communication, and the muscle memory that comes from running the plan at least once before it's real.
The discipline line we hold ourselves to: find the widest gap and go deep on that one. Spreading a small security budget evenly across three layers usually produces three thin layers. Going deep on the gap that matters most produces posture.
Surface work is tedious but obvious — the list of things to harden is known, and most of it can be done in a handful of change windows. Response work scales to the size of the business — bigger company, thicker playbook, but a small shop can get by with a short, well-rehearsed one.
Visibility is the one that breaks on SMB budgets. A modern SIEM running without an FTE to monitor it is just expensive logs. Most small and mid-sized businesses can't justify dedicated headcount to watch the screen, and most can't justify the SIEM itself when they already can't afford to look at it. That's the gap — and it's the one we focus on honestly, with options that match the size of the business.
Before we recommend anything, we draw three bars — one per layer — and rank them honestly for the business in front of us. The shortest bar is where we go deep. The tall ones get maintained, not fussed with. Most engagements look something like this.
One story per layer. Details anonymized. All three show the same thing from different angles — the work is done before the event, and the event is where that work shows up.
A 200-seat firm called after a user admitted he'd clicked a link he shouldn't have. Because Defender was already tuned, we could confirm within hours that nothing had happened — no suspicious sign-ins, no session persistence, no rule changes. From there, a clean MFA-and-password reset and the incident ended where it started. Without the visibility already in place, the same call becomes three days of "did we just get breached?"
A client hosting dozens of custom apps across on-prem and cloud IIS had published them the way most shops still do — VPN for internal users, firewall NAT rules for public ones. We replaced that with Azure Front Door, Entra Application Proxy, and Global Secure Access: identity-aware gates on every app, MFA for guests and staff alike, no open ports to the outside, no VPN client to maintain. Whole classes of exposure disappeared at once.
The back-end storage fabric for a client's VM environment was compromised in a ransomware attack. Because the backups were properly air-gapped, no ransom was ever negotiated. We restored the assets and spent most of the engagement finding the gap that let the attacker in. It got patched. The business resumed. The quiet lesson: the thing that saved them was done months earlier, when nothing was on fire.
Every security engagement ends with a picture of where the business really is and a short list of what to do next — ordered, reasoned, and built around the foundations that make the rest of it possible.
"We don't sell licenses. We build posture. Security isn't a SKU upgrade — it's process, policy, infrastructure, and identity, done deliberately. Get those right, and most of the rest falls into place." The stance on security spend
Connected to
Identity is the first security signal. Every other layer reads from it.
Private networking is the first security control, not the last.
The incident response plan and the DR plan are the same document.
Security posture is the enforcement layer for governance policy.
Book a call
The common thread behind most of our security engagements isn't a breach — it's a forcing function. Whatever yours is, the first conversation is the same one: what does your real posture look like right now, and where is the widest gap.
Or reach us directly: info@fouronesixit.ca · (647) 371-0400