IT support for small businesses

In short: Small businesses need the same six controls as large ones, multi-factor authentication, managed endpoint protection, disciplined patching, tested backup, Conditional Access and a plan for being offline, because the attacks that reach them are automated and do not check headcount first. What differs is scale, not requirement. Systech supports small businesses from £40 per user, per month, and is straightforward about the point below which a monthly contract is not yet worth it.

Being small is not protective

The most common reason a small business has no real IT security is a belief that nobody would bother. It is an understandable assumption and it misdescribes how most attacks work. The overwhelming majority of what reaches a business of ten or thirty people was never aimed at it: automated credential stuffing against accounts that appeared in a breach list, phishing sent to every address a scraper collected, and scanners looking for systems that have not been patched.

None of that involves anyone deciding your business is worth attacking, which is exactly why size offers no cover. The useful consequence is that the defences which stop most of it are neither exotic nor expensive. They are the same unglamorous controls that stop it at any size, and the reason they are missing in small businesses is usually that nobody owns them rather than that anyone decided against them.

The six things worth having before anything else

In rough order of how much risk they remove per pound:

• Multi-factor authentication on every account. No exceptions for directors, shared mailboxes or the account that runs the accounts system. The exceptions are where attacks land.
• Managed endpoint protection on every device, monitored by somebody, rather than a consumer antivirus nobody looks at.
• Patching on a schedule somebody owns. "Everyone updates their own laptop" is not a schedule.
• Backup of Microsoft 365 with tested restores. Microsoft replicates your data for availability; it is not a backup of your business against deletion, ransomware or a departing employee. The test restore is the part that gets skipped and the part that matters.
• Conditional Access, so a sign-in from an implausible location or an unmanaged device is challenged or blocked rather than merely logged.
• A written idea of what happens if systems are down for a day. Not a formal continuity plan. Just knowing, in advance, who does what.

Most small businesses have two or three of these and believe they have all six, usually because a licence was bought that includes features nobody has configured. Our Microsoft 365 security posture checklist walks through checking that honestly, and the Cyber Essentials checklist covers the certification a growing number of customers and insurers now ask for.

When a monthly contract starts being worth it

We would rather say this plainly than sell into it. A business of two or three people, working entirely in Microsoft 365 on modern laptops, with no server, no compliance obligation and no real cost to being offline for a morning, does not need a managed contract yet. Occasional paid help is better value, and anyone telling you otherwise at that size is selling.

What moves the answer is dependency rather than headcount. Three things usually do it. Being offline starts costing money, because orders, bookings or production stop. Somebody external, a customer, an insurer, a tender, starts asking how you secure their data, and the answer has to be evidenced rather than asserted. Or the person who has been absorbing IT alongside their actual job stops having time, which in a small business is the most common trigger of all.

Any one of those tends to arrive well below twenty people. If none has, it is legitimate to wait, and the honest test is whether the six controls above are genuinely in place, not whether anything has gone wrong yet.

What it costs

We publish our starting figure rather than quoting only after a discovery call, because a price you cannot see is a price you cannot compare.

For a small business the important part of that panel is not the number but the inclusion list, because the same phrase, "fully managed IT", is used for services that differ enormously in what sits inside the monthly rate. The full explanation of what moves the price, and how to normalise two quotes that are not pricing the same thing, is on the pricing page.

You probably already have an "IT person"

In most businesses of this size somebody has absorbed IT without ever being hired to do it: an office manager, a finance lead, a technically confident director. It works for a while and it has two costs that rarely get counted. The business is not getting the job that person was actually hired for, and the estate is being maintained by someone whose day job keeps interrupting it.

Bringing in a provider does not have to mean replacing them, and usually should not. Co-managed arrangements leave the internal person holding the things that genuinely benefit from being inside the business, day-to-day requests, priorities, supplier relationships, while the provider takes monitoring, patching, security tooling and out-of-hours cover. We have written the three arrangements up in MSP vs internal IT.

Choosing between providers

Small businesses get the worst of this market, because they are quoted by everyone from one-person operations to national providers and the proposals all use the same vocabulary. The questions that actually separate them are the same at any size: what is inside the per-user rate and what is billed on top, what the coverage hours are and whether the person answering at 2am is an engineer, where the service desk physically sits, whether the certifications on the footer have public registry entries behind them, and what the notice period and exit terms are.

The full set, including the answers that should give you pause, is in how to choose an IT support company. It is written to work as well against us as against anyone else.

Where we fit, and where we do not

We are a Microsoft-first provider. Where we are strong is Microsoft 365 and Azure, identity and security, device management, and well-run managed support with a 100% UK-based service desk. Our certifications are all verifiable through public registries rather than displayed as logos.

Where we are not the right answer: if what you want is somebody physically in your building most days handling requests at the desk as they arise, an internal hire or a provider with staff in your town will serve you better. We are based in Brough, near Hull, work on site across Yorkshire, and support businesses remotely across the UK.