Cyber Security for Cardiff Businesses

Cyber security in Cardiff

What small-business security really involves

For a small business, good cyber security comes down to a short list of things done properly every day: multi-factor authentication on every account, updates installed quickly, backups that can actually be restored, email filtered for phishing, protected devices and staff who know what a scam looks like. We build all of it into our managed IT support for businesses in Cardiff and across South Wales, and we keep every system we manage to the Cyber Essentials standard, certified or not.

We’re an IT management company rather than a seller of security products. Security is part of looking after your IT properly, so it isn’t another subscription to buy or another supplier to manage.

The risk is real for small firms. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses had a cyber breach or attack in the previous 12 months, and that phishing was by far the most common kind.

What’s in, what’s extra

Security that’s part of the service

When we manage your IT, the everyday security work is part of the monthly fee. You won’t get an extra bill because we switched on multi-factor authentication for a new starter or chased a laptop that missed an update.

The price depends on how many people you have, whether you run servers and how your systems are set up, so we look first and give you a fixed quote. See our pricing.

Charged separately

• Cyber Essentials certification from £295 + VAT, plus the IASME assessment fee
• Cyber Essentials Plus preparation and audit support, quoted for your business
• Microsoft 365 licences, including Business Premium if you want its extra security tools (we can supply them)
• New hardware and software, such as replacing devices that no longer get security updates
• Projects such as migrations and office moves, which we quote separately

Cyber Essentials

Certified, and Plus when you need it

Cyber Essentials is the UK government-backed scheme that checks five sets of controls: firewalls, secure configuration, user access control, malware protection and security updates. Many public sector contracts require it, and more insurers and larger customers now ask for it.

Our Cyber Essentials service starts from £295 + VAT, plus the IASME assessment fee. We check your systems, fix anything that would fail and help you complete the assessment, and every business we’ve prepared has passed. Our guide to what Cyber Essentials costs explains the fees.

If a contract asks for Cyber Essentials Plus, we help with that too. Plus adds a hands-on technical audit by the certification body, so we prepare your systems, fix what the auditor would find and support you through the audit. We hold Cyber Essentials ourselves, and we’re not a certification body: certificates are issued by IASME-licensed certification bodies.

Passkeys

The next step beyond passwords

In April 2026 the National Cyber Security Centre said passkeys should be people’s first choice of login. A passkey is tied to the genuine website it was created for, so a fake Microsoft login page can’t capture it, and there’s no code for a criminal to intercept.

Passkeys work with Microsoft 365 on every business plan, and Cyber Essentials now recognises them. A sensible order is admin accounts first, then the people who approve payments or handle client money, then everyone else. Read our guide to passkeys for business.

Law firms

Security for solicitors

Ross Owen worked in IT at large Cardiff law firms before founding Alphabyte IT in 2009, so we understand why firms are such a target. They hold client money and confidential files, and conveyancing creates predictable moments when large sums move.

The classic attack is email interception before a completion: a criminal gets into a mailbox, or spoofs one, and sends “updated” bank details at exactly the right moment. The defences are multi-factor authentication on every account, DMARC on the firm’s domain, regular checks for suspicious mailbox rules and a firm-wide rule that bank details are only ever confirmed by phone, on a number you already hold.

Solicitors should also check their reporting duties to the Solicitors Regulation Authority when client money or information is affected, on top of the ICO and the police. More on IT for law firms.

Accountants

Security for accountancy practices

Practices hold exactly what criminals want: bank details, tax records and logins to HMRC and to clients’ accounting systems. One compromised mailbox can expose many clients at once, and the run-up to the 31 January self assessment deadline is when people are busiest and least likely to stop and check.

We make sure a password alone never gets anyone into your practice software, Microsoft 365 or online services, that client files are backed up and restorable, and that staff only have the access their role needs. Cyber Essentials is often the simplest way to answer the security questions clients and insurers now ask. More on IT for accountants.