Cyber security for SMEs, with the resources you have
Small and medium-sized businesses are attacked with the same techniques as large ones, but rarely have someone in charge of security. Here are the real risks, the priorities to start from and how to keep them under control without a dedicated department.
Why cyber security matters for SMEs too
"We are too small to interest anyone" is the sentence we hear most often. The problem is that most attacks do not choose their victim: they sweep the internet looking for exposed services, already stolen passwords, mailboxes without two-step verification. Whoever finds them first gets in.
For a small business the consequences weigh more heavily: a week of downtime, an invoice paid to the wrong bank account, customer data published. And indirect obligations arrive too: the GDPR applies to everyone, and customers subject to NIS2 ask their suppliers to demonstrate their own security.
Information security in small businesses does not require a bank's tools. It requires knowing what you have and what is exposed, and fixing first the things attackers actually exploit.
The four threats that hit small businesses
Ransomware
Ransomware encrypts files and stops work; more and more often the data is also stolen and the attackers threaten to publish it. It gets in through an unpatched vulnerability or a remote access point with a weak password.
Phishing
Phishing is a convincing email that leads to a fake page or an attachment. One click is enough to hand over email credentials, which are then used for payment fraud.
Stolen credentials
Your staff's passwords are already circulating, because services they had signed up to have been breached. If the same password works for company email, the attacker does not even have to force anything.
Exposure on the internet
Remote access, NAS drives, cameras, old forgotten websites: services anyone can reach, often with known vulnerabilities. This is your attack surface.
Start from the CIS Controls IG1
With a limited budget and few staff you cannot do everything, so you need an order. The CIS Controls IG1 from the Center for Internet Security are designed for exactly this: a set of safeguards, 56 in version 8.1, defined as essential cyber hygiene, that is, the minimum every company should have to defend itself against the most common attacks.
They are in order of priority and can largely be verified with real data, not self-declarations. That is why they are the starting point we suggest to anyone who does not yet have a reference framework.
- Knowing which devices and which software you have
- Fixing vulnerabilities, starting with the exposed ones
- Secure configurations and separate administrator accounts
- Multi-factor authentication on email and remote access
- Backups that are tested, not just configured
- Malware protection on endpoints
- Staff training on phishing
- Knowing who to call and what to do in case of an incident
What Dottor Box does for an SME
Each priority has a module that measures it. You do not need to enable them all: the offer is built around what you are missing.
| Priority | How Dottor Box covers it |
|---|---|
| Inventory of devices and software | Asset Management and Authorised software, populated by the Cyber Agent |
| Internal and exposed vulnerabilities | Vulnerability Assessment of the internal network, external network and web applications, with more than 130,000 network tests and manual checks to remove false positives |
| Stolen credentials | Dark Web Monitoring on the company domain, with the source of each exposure |
| Email and MFA | Microsoft Entra ID and Google Workspace posture checks, read-only |
| Phishing and training | Cyber Awareness, with simulated phishing campaigns run by Dottor Marc, and Training |
| Backup and recovery | Business continuity: impact, continuity plan and backup checks |
If there is no one to read the alerts
An SME's limit is usually not the tool, it is the time of the person who should be using it. That is why there are three service levels: with Security Monitor you have the platform, reports and alerts, and you or your IT supplier act on them; with MDR + SOC alerts are handled by Dottor Marc's SOC, with ticket support during working hours; with MDR + SOC 24/7 there is a dedicated number at any hour. The details are on the SOC and MDR page.
You pay for what you monitor
The price does not depend on the number of employees or on a company size band. There is a one-off initial fee to define and validate the attack surface, then a monthly fee per monitored asset, calculated on the average over the last 30 days. If the company grows or shrinks, the fee follows it with no renegotiation.
Cyber Screening: what someone looking at you from the internet sees
The Cyber Screening starts from your company's public address and domain and shows open ports, possible vulnerabilities, subdomains and compromised credentials, with an overall risk score. It is a quick analysis, not a full vulnerability assessment: it helps you understand where to start and becomes the benchmark for the months that follow.
The Cyber Screening requires registration: it is the second step after creating your Dottor Box. Registering does not activate a subscription; the service starts only if you accept a proposal. Read how it works.
Before deciding what to protect, you need to know what is exposed. The rest comes afterwards, in order.
Questions about cyber security for SMEs
Is a small business really a target?
Yes, because most attacks are automated and look for weaknesses, not names: exposed services with known vulnerabilities, already stolen passwords, accounts without two-step verification. An SME with fewer defences becomes an easier target, not a less interesting one.
Where do I start if I have no one in charge of security?
With knowing what is exposed and what you have on your network. Then with the CIS Controls IG1 priorities: exposed vulnerabilities, multi-factor authentication on email, tested backups, training against phishing. If no one in the company can follow up the alerts, consider a level where the SOC handles them for you.
Isn't antivirus enough?
Antivirus protects a single computer from known malicious code, and it is one of the basic measures. But it does not tell you whether a remote access point is exposed with a vulnerability, whether a member of staff's password is circulating or whether email accepts logins without MFA. You need checks that look at the whole picture.
How much does cyber security for an SME cost with Dottor Box?
It depends on how many technology assets you want to monitor, not on the number of employees. There is an initial fee to define the attack surface and then a monthly fee per asset. The quote comes with a written proposal, after registration or after you contact us.
Can I run the Cyber Screening without registering?
No. The Cyber Screening is tied to your Dottor Box: you get it by creating one, so the analysis really concerns your company and stays in the portal as a basis for comparison.
Where SMEs usually start
Cyber Screening
What anyone looking at your company from the internet can see, with a risk score to start from.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more SeeCyber Awareness
Simulated phishing campaigns prepared and run by Dottor Marc, with the results in the platform.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more ComplianceCIS Controls · IG1
Basic cyber hygiene: the starting point for every SME.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.