A renewal email arrives from the cyber-insurance broker. The questionnaire that used to be a page of tick-boxes is now several pages long. It asks whether MFA is enabled on every mailbox, whether backups are immutable, whether there's a documented patch management policy, and when the last restore test was run.

Answer honestly, and the broker comes back with one of three outcomes: a large premium increase, a ransomware coverage exclusion, or a flat refusal to renew.

That's not a fringe scenario any more. Cyber insurers have spent several years paying out heavily on ransomware claims, and they've responded the way any insurer responds to a bad loss ratio: by tightening what they'll cover and checking harder before they pay. The carriers' own numbers explain it: Coalition's annual claims report puts email compromise and ransomware at the head of small-business claims, and Marsh's cyber market analysis describes the same control expectations hardening across the market rather than at one insurer. In the renewals we've helped small businesses through, the businesses that pass are not the bigger or better-funded ones. They're the ones that treated the questionnaire as a checklist and prepared for it in advance, not the week it landed.

What insurers actually check now

The exact wording varies by carrier, but the pattern across the market is consistent. Six controls come up on almost every serious questionnaire:

They are not carrier inventions either - the same set is close to CISA's Cyber Essentials baseline for small organisations, which is why preparing for one tends to satisfy the other.

1. MFA on every mailbox, every admin account, and every remote access path - not most accounts, all of them. Microsoft's own research on Entra ID accounts found MFA cuts the risk of compromise by 99.22% across the general population, and by 98.56% even on accounts whose password had already leaked. That's the reason insurers treat it as close to non-negotiable rather than a nice-to-have. Verizon's breach data makes the same case from the attacker's side, where credential abuse remains the most pervasive technique across breach chains.

2. Endpoint detection and response (EDR), not just antivirus. Antivirus blocks known threats by signature. EDR watches behaviour and catches threats nobody has seen before, automatically detecting, investigating and remediating incidents rather than just flagging a file.

3. Immutable, offsite backups with a recent, tested restore. A backup an administrator, or an attacker holding admin credentials, can delete is not the backup an insurer is underwriting against. Sophos' annual ransomware research is the reason the restore test matters more than the backup job: recovery, not payment, is what a working backup buys you.

4. A documented patch management policy, not "we update when we remember to."

5. Annual security training with phishing-simulation results on file, not a single video shown on someone's first day.

6. A written, reviewed incident response plan that says who gets called, what gets shut down, and how the business communicates.

What this costs to fix, for a 10-person business

The gap between what insurers want and what most small businesses have is rarely expensive to close. It's a matter of knowing what to configure and doing it before the renewal, not after.

If the business already runs Microsoft 365 Business Premium, most of the technical controls are already paid for and sitting unconfigured:

• MFA everywhere - included in Business Premium through Entra ID's identity and access management. No extra cost.
• EDR - Microsoft Defender for Business is bundled into Business Premium. No extra cost, but it has to be switched on and configured, not just licensed.
• Patch management and device policy - Microsoft Intune handles update rings, compliance policies and encryption enforcement across the fleet, and is part of the same Premium licence. No extra cost.
• Immutable, tested backup - this sits outside the M365 licence. Budget roughly €100-200 a month for a 10-person business, plus the time for a quarterly restore test, based on what we see running this for clients.
• Security training with phishing simulation - roughly €50-150 a month for a small team.
• Incident response plan - a one-off cost to write and review it properly, typically a few hundred euros up to around €1,500 depending on how much of the business's process it has to capture.

Add it up and a 10-person business already on Business Premium is usually looking at somewhere in the €150-350 a month range on top of the licence, mostly for backup and training, not for anything new to buy.

The five reasons businesses actually fail

MFA on most accounts, not all of them. This is the single most common failure we see. Insurers check every admin account and every remote access path specifically because that's where it's most often skipped. One unsecured admin account is enough to fail the assessment even if everyone else has MFA switched on.

Backups that exist but have never been tested. Insurers ask for the date of the last restore test, not whether backups run. "We have backups" doesn't answer that question, and a backup nobody has restored from is, for underwriting purposes, treated as a backup that doesn't work.

No documented policies. Plenty of small businesses have genuinely good practices with nothing written down. The assessment is as much a paperwork exercise as a technical one - a policy that exists only as a habit in someone's head does not exist for the purposes of the form.

Antivirus mistaken for EDR. Free or basic antivirus is not what insurers mean by endpoint protection any more. Microsoft Defender for Business, included in Business Premium, does qualify - but only once it's actually enabled and configured, which is the step that gets skipped when a licence is bought and left alone.

Shadow IT the owner doesn't know about. Personal cloud storage, unapproved apps, or personal email used for business communication. A carrier's scan finds these regardless of what the business owner believes is true, and if the owner didn't know about them, the assessment fails on accuracy before it fails on security.

The timeline: when to actually start

Most businesses start preparing 30 days before renewal. That's too late - insurers want to see controls that have been in place and documented for a while, not switched on the week before the questionnaire goes in.

For a business renewing in January, a realistic run looks like this:

1. Three months out - audit current controls against the insurer's questionnaire and list every gap.
2. Two months out - close the gaps: MFA everywhere, EDR configured, immutable backups live, policies written.
3. One month out - test a backup restore, run a phishing simulation, and build the evidence pack: a screenshot, a policy document or a test log behind every "yes" on the form.
4. Renewal month - submit with the evidence ready rather than promised.

For a 10-person business with the right licence already in place, this is genuinely 2-3 weeks of focused work plus ongoing maintenance, not a large project. The alternative is a policy that looks fine on paper and doesn't pay out when it's actually needed.

Outside the biggest markets, the paperwork looks a little different

The six controls above are consistent everywhere, but the surrounding compliance layer varies. In Israel, some international carriers are less familiar with local regulatory requirements, which can slow underwriting even when the technical controls are solid. In the EU, a business already doing NIS2-driven documentation work usually finds it satisfies most of what an insurer's questionnaire is asking for in writing, since both are pointing at the same written policies. In Spain specifically, businesses handling EU citizen data at meaningful scale tend to see extra questionnaire sections on data classification and breach notification, reflecting AEPD's separate enforcement layer on top of the insurer's own checks.

None of this changes the six controls above. It changes how much extra documentation sits alongside them.

What this actually means for your business

A cyber-insurance policy you can't successfully claim against is worse than no policy at all - it's the belief that you're covered, right up until the moment you find out you're not. The fix isn't complicated or expensive if you're already on the right Microsoft 365 licence. It's making sure the controls you're already paying for are actually switched on, documented, and tested before the renewal, not after a claim.

Year-end is when business owners review everything: financials, team performance, sales pipeline, vendor contracts, strategic goals. One thing almost never gets the same treatment: the IT running underneath all of it.

That's not because IT is unimportant. It's because the questions feel like they need a technical person to answer them. They don't. The right questions are business questions, about cost, risk and readiness, and a non-technical owner can ask and understand every one of them.

A meaningful share of what small businesses spend on IT each year goes on tools nobody uses, security nobody configured, and backups nobody has tested. A 30-minute review once a year catches most of it.

These 10 questions are that review. Ask them of yourself, or ask them of whoever manages your IT. The answers tell you whether your setup is healthy, or quietly heading toward a problem. They are also the questions behind the baselines national authorities publish for small organisations - CISA's Cyber Essentials, the UK NCSC's small business guide, and for businesses operating in Israel, the INCD's organisational cyber defence methodology.

1. Is multi-factor authentication actually on every single account, or just the ones you remember?

This is the single most important question on the list. Microsoft's own research found MFA cuts the risk of account compromise by 99.22%, and by 98.56% even on accounts whose password had already leaked.

The question isn't "do we have MFA." It's "is it on every mailbox, every admin account, and every remote access path." One unsecured account is the gap an attacker walks through. Check the admin accounts specifically - they're the ones most commonly missed.

2. When did you last actually test a backup restore?

A backup you've never tested is not a backup. It's a hope. The only way to know a restore will work when you need it is to have already done it once when you didn't have to. Sophos' annual ransomware research is blunt about the consequence: recovery is what a tested backup buys, and paying is what an untested one costs.

Ask for the date of the last restore test. If the answer is "we haven't done one" or "we're not sure," that's the finding. A tested restore should happen at least quarterly. Anything less is a gap your insurer may care about too.

3. Do you actually know what every recurring IT charge on your card is for?

Most small businesses carry a handful of tools that are redundant, overlapping, or still billing for someone who left months ago. It is not a local problem: across more than 40 million licences under management, organisations leave an average of 36% of their SaaS licences unused.

Print the last three months of IT-related card and bank charges. Question every line. If nobody can explain what a tool does or who uses it, cancel it. In the audits we've run for clients, this typically saves €400-800 a month for a small business - money that goes straight to the bottom line.

4. If your most technically capable person left tomorrow, who actually has the passwords?

This is the bus-factor question. If one person holds the admin credentials for your domain, your email, your cloud accounts and your backup system, and those credentials live in their head or their personal password manager, that's a business risk, not an IT risk.

Every business should keep its admin credentials in a shared, company-owned password vault. Access is controlled, audited and transferable. No single person is the only one who can get you back in.

5. Are you actually paying for Microsoft 365 licences you're not using?

Microsoft's list prices for Business plans move periodically - Business Basic currently lists at $7 a user a month - and licence drift, users sitting on a higher plan than they need, or former employees still licensed, is one of the most common wasted costs in small businesses.

Review the admin centre. Check: is every licensed user still at the company, is each person on the plan that matches what they actually do, and are unused add-ons still billing. A 10-person business can often save €50-150 a month just by cleaning this up.

6. When did someone last actually review who has access to what?

In many small businesses, everyone has access to everything: the HR folder, the finance folder, the client contracts folder, all open to all employees by default. That's convenient until it isn't.

Ask for a list of who has access to sensitive folders. If the answer is "everyone," that's a finding. Permissions should be role-based: finance sees finance, leadership sees strategy, new hires see what they need for their job. It's a couple of hours' work for a 10-person business, and it matters more than ever if you're considering AI tools like Copilot, which surface information based on whatever permissions already exist rather than a separate check of their own.

7. Do you actually have a written incident response plan, or do you improvise when something goes wrong?

When an incident happens, a phishing click, a lost laptop, a suspicious login, the time to figure out what to do is not during the incident. A written plan means anyone on the team can take the first step without waiting for the owner to decide.

It doesn't need to be elaborate. It needs to answer three questions: who do we call, what do we shut down, and how do we communicate. If that doesn't exist, it's a gap, and insurers now ask about it too.

8. Is every company device actually encrypted, updated, and remotely wipeable?

If a laptop is lost or stolen, can you wipe it remotely? "I think so" or "I'm not sure" is a finding. Microsoft Intune, included in Business Premium, is built to handle device compliance, encryption and update management across a fleet - but only for devices that are actually enrolled.

Ask for a device inventory. If the list is incomplete, or devices aren't enrolled in management, that's the finding. A lost laptop with company email on it and no way to wipe it remotely is a data breach.

9. Are your employees actually trained, or was it a one-time video at onboarding?

Security awareness training that happens once, during onboarding, and never again doesn't hold up. Attackers change their methods; your team needs to encounter realistic phishing attempts often enough that spotting a fake becomes reflex rather than a guess.

Ask: when was the last phishing simulation, and what were the results. If the answer is "we don't do that," the team is your weakest control, and your strongest one if you train them. Regular training with simulation results is also something insurers increasingly want to see.

10. If you switched IT providers tomorrow, could you actually do it?

This is the question most owners don't want to ask. The answer tells you whether you're in control of your own IT or trapped by whoever currently runs it.

You should own your domain, your Microsoft 365 or Google Workspace tenant, and every business account, in your company's name, with admin credentials you can access. A provider administers these; they shouldn't own them. If your domain is registered in your provider's name, or your tenant is on their billing, that's a structural problem worth fixing before you ever need to switch. We've written about exactly how to make that move without losing anything.

How to actually use this review

These questions aren't a pass/fail test. They're a map. Every "no" or "I'm not sure" is a finding, something to address before it becomes an incident, a denied insurance claim, or an unexpected cost.

The review takes 30 minutes if the answers are available. If they're not, that itself is the finding: your IT isn't documented well enough for you to know where you stand. That's fixable.

For a 10-person business, closing the gaps this review surfaces typically costs €150-350 a month on top of existing Microsoft 365 licensing, mostly backup and security training. The cost of not closing them is the incident you can't recover from.

A consulting firm's most valuable asset spends most of its life outside the office. Client financials, draft contracts, board decks and personal data all live on one laptop that gets opened in a hotel business centre, an airport lounge, a client's own meeting room and a train seat, often all in the same week. None of those networks belong to you, and most of them were not built with your client's confidentiality obligations in mind.

This is not a theoretical risk. Across the EU, 92.76% of enterprises now use at least one ICT security measure, but the gap sits in exactly the controls that matter for a travelling laptop . Strong password authentication is widespread. Virtual private networks and multi-factor authentication are not.

What actually goes wrong on the road

The failures we see with consulting clients are rarely dramatic hacking. They are small, ordinary mistakes that a network you do not control turns into a real incident.

1. Joining the wrong network on purpose. A hotel's guest Wi-Fi and a look-alike network named almost identically both show up in the list. On a captive-portal network there is no way for a laptop to tell which one is genuine, and an attacker on the same segment can see unencrypted traffic and inject fake login pages.
2. A locked laptop that never actually locks. Screen lock timeouts get pushed out over the years because they are mildly annoying, so a laptop left on a lounge table for two minutes while its owner queues for coffee sits there fully signed in.
3. One password used everywhere logging in from everywhere. A password reused across the practice management tool, email and a client portal turns one leaked credential from an unrelated breach into access to all three, and it is far easier to attempt from any network when there is no second factor to stop it.
4. A laptop that goes missing, not stolen. Left in a taxi or under an airport seat, most lost devices are never hacked in any technical sense. Whoever finds it just opens the lid, and if the disk is not encrypted and the account has no lock screen, every client file is available to read.
5. Client-site Wi-Fi treated as trusted because the client trusts it. A consultant on a client's own network is still on a network the consultant does not manage, and confidential material for a different client sitting in the same inbox is exposed to whatever that client's network can see.

NIST's guidance for enterprise telework and remote access treats every network outside the organisation's own perimeter, including a client's network, as untrusted by default and recommends that devices authenticate and encrypt regardless of which network they join .

Why this is a client-confidentiality problem, not just an IT one

A consultant who loses a laptop with a client's financial model on it has not just lost a device. If that laptop holds personal data on employees, customers or patients, the obligations that follow depend on where the client sits, but under the GDPR, a controller must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach . A firm operating across Israel, Greece and Spain, with clients on both sides of that rule, does not get to decide which incidents count as minor.

Fraud tied to stolen credentials and account access remains one of the largest categories of loss reported to the FBI's Internet Crime Complaint Center, which recorded $16.6 billion in total losses in 2024, a 33% increase on the prior year, with cyber-enabled fraud responsible for about 83% of that figure . None of that requires a sophisticated attacker. It mostly requires one weak login, reached from a network nobody was watching.

The lean setup that closes the gap

None of this needs a dedicated IT department or a six-figure security budget. A small consulting firm on Microsoft 365 Business Premium already owns the tools; the work is turning them on and pointing them at the right risk.

1. Conditional Access instead of trust-by-network

Microsoft Entra Conditional Access evaluates signals like device compliance, location and sign-in risk at every login and blocks or challenges access accordingly, rather than assuming a login is safe just because the password was correct . For a firm with travelling consultants, the practical policy set is short:

• Require multi-factor authentication for every sign-in, from every network, with no exceptions for "trusted" locations that are really just the office Wi-Fi.
• Block sign-in from unmanaged or non-compliant devices, so a client's shared kiosk PC cannot pull mail or files even with a valid password.
• Flag and challenge sign-ins that Microsoft's risk detection scores as unusual, such as an impossible travel pattern between two logins minutes apart.

2. Intune-managed devices, not just company-owned ones

Every laptop that touches client data should be enrolled so it reports back its encryption status, patch level and lock screen policy, and can be wiped remotely if lost . In practice that means:

• Full-disk encryption (BitLocker on Windows, FileVault on Mac) turned on and verified, not just assumed.
• A one-minute or shorter screen lock, enforced by policy rather than left to habit.
• Automatic security updates, since an unpatched laptop on a public network is exposed to attacks that a patched one is not.

3. Treat every non-office network as public

Rather than trying to vet every hotel and lounge network, the lean setup assumes all of them are hostile. A always-on VPN or Microsoft's built-in Cloud App Security tunnelling covers this without asking the consultant to remember to turn anything on before opening the laptop in a lobby.

4. Separate the client data, not just the device

SharePoint and OneDrive with per-client permission groups mean a lost or compromised laptop only exposes what that laptop's account could see in the first place, rather than every client file the firm holds.

What it costs and how long it takes

For a firm of five to twenty consultants already on Microsoft 365 Business Premium, turning on Conditional Access, enrolling existing laptops in Intune and setting compliance policies is a one to two week project, not a re-platform. There is no new licence to buy if Business Premium is already in place, since Entra Conditional Access and Intune are included; the cost is the setup time, either in-house or through a managed provider.

The habit that matters more than any setting

Even the best Conditional Access policy assumes the consultant reports a lost laptop the same day. A remote wipe only works before the device is powered off and disconnected for good, so the fastest fix here is cultural, not technical: a one-line policy that says report it immediately, no exceptions, no embarrassment. Firms that build that habit lose files. Firms that do not sometimes lose a client.

A residential or commercial property closing has everything a wire fraud crew wants in one place: a large sum of money, a hard deadline, several parties who have never met in person, and instructions that arrive almost entirely by email. The buyer, the agency, the lawyer or notary and the bank each expect a message from one of the others at some point in the process, and none of them can easily verify a signature on a screen. Business Email Compromise, or BEC, is built for exactly this gap.

The FBI's Internet Crime Complaint Center calls BEC "the 55 billion dollar scam" in its most recent public update, tracking over 305,000 domestic and international incidents and more than 55 billion dollars in exposed losses between October 2013 and December 2023. In 2024 alone, IC3 recorded 21,442 BEC complaints with 2.77 billion dollars in reported losses, and a further 9,359 complaints specifically coded as real estate fraud with 173.6 million dollars lost.

Real estate fraud losses have swung sharply year to year - 396.9 million dollars in 2022, down to 145.2 million in 2023, then back up to 173.6 million in 2024 - which IC3's own data suggests reflects changes in reporting and in how quickly banks intervene, not a shrinking problem. For a small agency handling a handful of closings a month, a single successful redirection can be an existential loss, both financially and to the agency's reputation with the client whose deposit disappeared.

How the fraud actually runs

The pattern is consistent across the cases IC3 and European authorities describe, and it rarely starts with a dramatic hack. It starts with patience.

1. Reconnaissance. The criminal monitors public listings, agency websites and sometimes a compromised mailbox to learn who is closing on what, and when. Real estate transactions are unusually public - the property, the rough timeline and often the agent's name are all findable with a search.
2. Access or spoofing. Either the criminal compromises a real mailbox through a phishing email or a reused password, or they register a lookalike domain that differs from the real one by a single character or a swapped letter, and set up matching signatures and email threads.
3. The pivot. At the point closest to the transfer - usually just before or during the closing window - the criminal sends new wiring instructions, styled to match prior correspondence, often citing a "change of bank" or an "urgent update from the title company."
4. The transfer. The buyer, the agency's bookkeeper or the party responsible for moving funds wires the deposit or the full purchase amount to the criminal's account, frequently at a bank that acts only as a short-lived intermediary before the money is moved on or converted to cryptocurrency.
5. The window closes fast. Funds are typically moved out of the receiving account within hours, which is why IC3 stresses that a victim's best chance of recovery depends on contacting their bank and filing a complaint within the first 24 to 72 hours.

ENISA's 2025 Threat Landscape report, drawn from an analysis of 4,875 recorded incidents across the EU, continues to place social engineering and email-based intrusion among the most consistently reported entry points into small and mid-sized organisations, which is precisely the profile of a local real estate agency.

The warning signs a closing team can actually catch

None of these require technical expertise. They require a habit of pausing before a transfer goes out.

• A last-minute change to bank details. Legitimate title companies, notaries and law firms almost never change their banking information mid-transaction. Any message that does should be treated as fraudulent until proven otherwise.
• Urgency and pressure language. "This must be sent today," "the seller is threatening to walk," or "please don't call, just confirm by email" are all classic pressure tactics designed to short-circuit verification.
• A domain that looks right at a glance. Watch for a swapped letter, an extra hyphen, or a different top-level domain from the one your agency and its partners actually use.
• A reply-to address that does not match the sender. Many BEC messages display a familiar name and address in the header but route replies to a different mailbox entirely.
• Requests to skip the usual process. Any instruction to bypass a callback, avoid a second signer, or wire funds outside normal banking hours is a signal to stop.

The controls that actually stop it

Email authentication. SPF, DKIM and DMARC, set up correctly and enforced (not just monitored), stop a large share of domain spoofing before it reaches an inbox. NIST's guidance on trustworthy email lays out exactly this stack as the baseline defence against forged sender addresses, and it is a configuration change, not new software, for agencies already on Microsoft 365 or Google Workspace.

Out-of-band verification for every payment instruction. Any change to wiring details must be confirmed by phone, using a number pulled from a previous, trusted document rather than one supplied in the suspicious email itself. This single habit defeats the overwhelming majority of BEC attempts, because the criminal cannot fake a phone call to a number they do not control.

A documented two-person rule for transfers. No wire above a set threshold should leave the agency's own systems, or be approved on behalf of a client, without a second person independently confirming the instruction against the original contract.

Multi-factor authentication on every mailbox. Most BEC cases that involve real account compromise, rather than pure spoofing, start with a stolen password on an account without MFA. Enforcing phishing-resistant MFA on every email account closes that door.

A written closing-day protocol shared with clients in advance. Tell buyers, in writing, before the transaction begins, that your agency will never change bank details by email and will never ask for funds to be sent to a new account without a verified phone call. That single sentence, sent early, gives a buyer the confidence to hang up on a fraudster and call your office instead.

What to do in the first hour if it happens anyway

Speed decides whether the money is recoverable. Contact the sending bank immediately and request a wire recall, and ask what documentation they need - policies vary by institution. File a report with the relevant authority - IC3 in the United States, and the equivalent national police cybercrime unit or CERT in Israel, Greece or Spain - as soon as possible, because early reporting is what allows funds to be frozen before they are moved again. Notify every party in the transaction chain in parallel, since the same criminal is very likely targeting the buyer, the seller and the notary with variations of the same message.

Frequently asked questions

A foreman starts a WhatsApp group for a site. It works, so the next site gets one too. Within a year the business is running quotes, safety photos, supplier invoices and change orders through a dozen chat threads on personal phones. Nobody decided this. It just accumulated, one convenient message at a time.

The problem shows up the day it cannot be ignored: a phone is lost with the only copy of a signed contract, an employee leaves and takes the group chat history with them, or a client asks for photo evidence from six months ago and nobody can find the thread. None of this is a technology failure in the usual sense. It is a business running its records on a consumer messaging app that was never built to be a filing system.

The scale of this gap is measurable. Only 52.7% of EU enterprises bought any cloud computing service in 2025, and in Spain the figure was 41.7% and in Greece 24.3%, both still below the EU average . Construction is a heavily on-site, cash-flow-sensitive trade, so it tends to sit even further behind that average than the headline number suggests. A 90 day plan does not require a full digital transformation. It requires four specific pieces of infrastructure, added in the order that keeps the business running instead of stopping it.

What actually breaks first

Three failure modes account for most of the pain we see in the first onboarding call with a contractor:

1. A phone is lost, stolen or the owner leaves. Contracts, timesheets, photos and client numbers walk out the door because nothing was ever backed up anywhere else.
2. A dispute needs a paper trail. A client claims a change was never agreed. The evidence exists, but it is buried in a chat thread nobody can search by date or export cleanly.
3. Personal and business get tangled. An owner's personal phone number is the business's main line. When that phone breaks or the owner is unreachable for a day, the business is unreachable too.

None of these need enterprise IT to fix. They need a business email address, one shared place for files, a few device basics and a backup that runs on its own.

The 90 day plan

The order matters more than the speed. Each phase is chosen so that work on site never stops for it - most of the setup happens in evenings or during a slow week, not as a project that pulls people off jobs.

Phase 1: Days 1 to 30 - business email and one shared drive

Start with a proper business email domain (yourcompany.com, not a personal Gmail address used for invoicing) and one shared cloud drive for contracts, permits, insurance certificates and site photos. This alone removes the single biggest risk: a document that only exists on one phone. Keep WhatsApp for day-to-day site chat if the crew is used to it - the goal in phase 1 is not to ban a tool people already know, it is to make sure nothing important lives only inside it.

Phase 2: Days 31 to 60 - shared calendars, folders per job, and basic device rules

Once email and files are live, organise the shared drive by job site rather than by document type, because that is how a foreman actually looks for something on site. Add a shared calendar so two crews are not booked against the same equipment or the same client visit. Set two device basics on every phone that touches business data: a screen lock, and the ability to remotely wipe a lost or stolen device. This is not about controlling personal phones - it is about making sure a lost phone is an inconvenience, not a data loss event.

Phase 3: Days 61 to 90 - automatic backup and an access checklist for leavers

Turn on automatic backup for the shared drive and business email so a deleted file or a ransomware incident is a restore, not a crisis. Write a one-page checklist for what happens when someone leaves the business - which accounts get their access removed and when - because under GDPR, personal data an employer holds must be kept accurate and only as long as it is needed for the purpose it was collected for, and an ex-employee with live access to client files or shared folders is exactly the kind of exposure that principle is meant to prevent .

Backups are not optional, they are the whole point

Cybercrime reported to the FBI's Internet Crime Complaint Center caused $16.6 billion in losses across 859,532 complaints in 2024, and personal data breach alone accounted for 64,882 of those complaints . A small contractor is not the target Wall Street worries about, but the same forces apply at a smaller scale: a lost device, a phishing message that steals a password, or a ransomware note are all events where the only thing standing between "inconvenience" and "the business stops" is whether a backup exists somewhere other than the device itself.

Passwords: fewer rules, not more

Most small firms either enforce no password policy at all or an overly strict one that gets ignored. NIST's authentication guidance recommends against forcing frequent password changes and against complex composition rules, and instead favours longer passwords that are simply left alone unless there is evidence of compromise . For a five to twenty person contractor, this translates into one practical rule: a long passphrase on the business email account, protected with two-factor authentication, and nothing more complicated than that.

Cost and where the €300 to €500 a month figure actually goes

From our own onboarding work with construction and trade businesses, a basic cloud stack (business email, shared files, backup and a handful of managed phones) for a 10 to 15 person crew typically runs in the €300 to €500 a month range, most of it licensing rather than labour. That is not a one-off migration bill - it is the ongoing cost of not losing a contract to a lost phone.

What to skip in the first 90 days

Do not attempt full mobile device management, a formal IT policy document or a helpdesk ticketing system in the first quarter. Those solve problems a five to twenty person contractor does not have yet. The 90 day plan is deliberately narrow: business email, one shared drive organised by job, two device basics, and a backup that runs without anyone remembering to trigger it. Everything else can wait until the business has outgrown this stack, which is a good problem to have.

Small nonprofits run on people who come and go. A board term ends, a student volunteer graduates, a grant-funded coordinator's contract finishes, and nobody circles back to switch off what that person could see. Phishing and account takeover attempts affected 94% of nonprofit organisations surveyed for a 2025 humanitarian and development sector cybersecurity report, up from 74% the year before, and nonprofit technology researchers point to the same root cause repeatedly - accounts and access that nobody owns once the person who set them up has moved on .

The pattern is familiar to anyone who has run a small organisation in Israel, Greece or Spain. A shared login gets handed from one treasurer to the next because creating a new account feels like paperwork. A departing volunteer's laptop had the donor spreadsheet synced to a personal OneDrive folder, and it is still there. An old committee member's email still forwards financial reports because turning it off might break something nobody wants to test. None of this is malicious. It is just what happens when access follows habit instead of a process.

Why shared logins and orphaned accounts are the real risk

A shared login has no accountability - if donor data is exported or a payment is approved, there is no way to know which of the six people who know the password actually did it. An orphaned account is worse, because it is a working set of credentials nobody is watching, sitting on a network long after the person behind it stopped checking their email. Researchers at UC Berkeley's Center for Long-Term Cybersecurity found that 46% of nonprofits cite funding as the primary obstacle to improving their security posture, which is real, but the fix here is not a bigger budget - it is a smaller number of standing exceptions .

Donor data sitting on a departed volunteer's personal drive is also a data protection problem, not only a security one. Under the GDPR, an organisation processing personal data must apply data minimisation and integrity and confidentiality safeguards to that data for as long as it holds it, which does not stop being true because the person who downloaded a spreadsheet is no longer volunteering . A nonprofit in Greece or Spain processing EU donor and beneficiary data carries that obligation regardless of how informally the access was granted in the first place.

The joiner-mover-leaver routine, sized for a five-person office

Enterprises call this JML - joiner, mover, leaver - and it does not need enterprise headcount to work. It needs three lists that someone actually checks.

1. Joiner - a new volunteer or staff member gets their own named account, added to a group, never a shared password. The group, not the person, carries the permissions, so removing someone later is one click instead of a hunt through every system they might have touched.
2. Mover - someone changes role, say from fundraising to programmes. Their group membership changes with them. Nobody manually revokes and re-grants a dozen individual permissions, because there were never individual permissions to begin with.
3. Leaver - the account is disabled the day the person leaves, not whenever someone remembers. Disable first, delete later, so mailboxes and files can be reassigned to whoever inherits the role.

CISA's guidance on securing accounts recommends multi-factor authentication as a baseline control precisely because a single stolen or shared password is often the only thing standing between an attacker and an account . Group-based access does not replace MFA, but it does mean that when MFA catches a suspicious login, you know exactly which account and which group to lock down, instead of guessing who else knows the shared password.

Group-based access beats shared logins even for a two-person IT team

The instinct in a small nonprofit is to keep things simple by keeping fewer accounts - one shared inbox for donations, one login for the accounting software, one password everyone on the board knows. That simplicity is exactly what makes recovery from a mistake or a breach almost impossible, because there is no single account to disable and no log that points to one person.

Group-based access flips this without adding complexity for the volunteer. Someone joining the "Fundraising" group gets the donor CRM, the mailing list tool and the shared drive folder in one step. Someone leaving loses all three in one step, because removing them from the group removes the access, rather than someone trying to remember which of five systems they were ever added to. The overhead moves from "remember every system a person touched" to "remember which group a person was in" - a much shorter list, and one a volunteer coordinator can maintain without any IT background.

Licensing that makes this affordable for a five-person nonprofit

The routine above assumes a directory that supports groups and MFA, and small nonprofits often assume that means an enterprise budget. It does not. Microsoft's nonprofit programme grants eligible registered nonprofits access to Microsoft 365 licensing at nonprofit pricing, provided the organisation can show it is a nonprofit in the country where it operates and that the person registering is a genuine employee or strategic volunteer rather than a third-party IT provider acting on the nonprofit's behalf . Google runs an equivalent programme, and its own eligibility page states that an applying organisation must be a nonprofit charitable organisation in good standing and meet the programme's full published criteria before it can claim Google Workspace for Nonprofits access .

Both routes get a small nonprofit in Israel, Greece or Spain to the same place - a real directory where accounts belong to named people, groups carry permissions, and switching someone off is one action instead of a memory test. The eligibility check itself takes an afternoon of paperwork, not a procurement process, and it is the single highest-leverage thing a five-person nonprofit can do before writing a security policy nobody will read.

What to do this month, not this year

None of this requires hiring anyone. It requires deciding, once, that individual accounts and groups replace shared logins and personal drives, and then holding that line every time someone joins, changes role or leaves. Start with whoever handles donor data and financial approvals, because that is where an orphaned account or a leaked shared password costs the most, and work outward from there as capacity allows.

Those three records are SPF, DKIM and DMARC. They are the reason business email compromise works against some companies and fails against others, and they cost nothing but attention.

Why this matters more than it used to

Business email compromise remains one of the highest-loss categories reported to the FBI, and the mechanism is impersonation rather than malware. The human element features in the majority of breaches, and a message that authenticates as your domain gets far more trust than one that does not.

The mailbox providers have also stopped treating this as optional. Google requires authentication for anyone sending to Gmail at volume, including a published DMARC policy for bulk senders. Unauthenticated mail increasingly does not arrive at all, which turns a security control into a deliverability one.

The three records, in plain terms

SPF lists which servers are allowed to send mail for your domain. The receiving server checks the sending IP against that published list. It is a guest list.

DKIM adds a cryptographic signature to each message, and publishes the public key in DNS so a receiver can verify the message was not altered and really came from your mail platform. It is a wax seal.

DMARC ties the two together. It tells receivers what to do when a message fails - nothing, quarantine, or reject - and where to send reports about who is sending as you. It is the instruction to the doorman.

SPF and DKIM without DMARC is the common half-finished state: the checks run, the result is discarded, and nobody sees the reports.

The rollout, in order

The order is not negotiable. Publishing p=reject before you know which legitimate systems send as you is how a company stops receiving its own invoices, its CRM notifications and its booking confirmations on the same afternoon. NCSC's guidance sets out the same staged progression, and the monitoring period is the part people skip.

What usually breaks

1. Forgotten senders. Your accounting platform, your newsletter tool, your booking system and your e-signature provider all send as you. Each needs to be authorised, and the SPF record has a hard limit of 10 DNS lookups, which multi-vendor setups blow through easily.
2. Alignment. A message can pass SPF and still fail DMARC if the domain that passed is not the domain the reader sees. Alignment is what DMARC actually checks, and it is why "SPF is green" is not an answer.
3. Forwarding. Mailing lists and auto-forwarding rules break SPF by design. DKIM survives forwarding, which is why both records need to be in place rather than one.
4. Nobody reads the reports. DMARC aggregate reports arrive as XML. Without a parser or a service to read them, the monitoring phase produces nothing and the rollout stalls at p=none for years.

Doing it on Microsoft 365

Microsoft signs outbound mail with a default DKIM configuration, but the published guidance is to enable DKIM for your own custom domain so the signature aligns with the domain your recipients see. That is a two-record CNAME change plus a switch in the security portal.

SPF is a single TXT record naming Microsoft's sending infrastructure plus any third-party senders. DMARC is one more TXT record at _dmarc.yourdomain.com, starting at p=none with a reporting address.

None of this requires a project. It requires a complete list of who sends mail as you, which is the part that takes the time.

What it does not do

Email authentication stops impersonation of your domain. It does nothing about a lookalike domain, a compromised mailbox sending genuinely authenticated fraud, or a supplier whose account was taken over. Those need MFA, conditional access and a payment-change verification process - separate controls that fail separately.

Country notes

Israel. Most small businesses here run Microsoft 365 or Google Workspace with a domain registered through a local reseller, and the DNS is often held at the registrar rather than at the mail provider. Confirm who can edit the zone before planning any change.

Europe. NIS2 Article 21 lists risk management measures including basic cyber hygiene; a published DMARC policy is among the cheapest pieces of evidence you can produce for that.

Spain. ENS control families cover protection of electronic mail explicitly, and authentication records are the concrete implementation of that control rather than a nice-to-have.

What to do with this

1. Check what you publish today. A single DNS lookup for your domain's TXT records tells you whether SPF and DMARC exist and what policy is set.
2. List every system that sends mail as you, including the ones marketing set up without telling IT.
3. Publish DMARC at p=none with a reporting address, and actually read the reports for a few weeks.
4. Move to p=quarantine, then p=reject, once the reports show only sources you recognise.

That is not how most incidents start now. The attacker signs in with a valid password, uses tools already on the machine, and never drops a file worth scanning. Signature matching is still in the product - it is just no longer the part doing the work.

What actually changed

Three shifts, none of them subtle.

Credentials replaced malware as the entry point. Credential abuse is the most pervasive technique across breach chains, and a stolen password looks identical to a real one at the file layer. There is nothing for a scanner to find.

The delivery moved to email and unpatched software. Sophos puts malicious email, phishing and exploited vulnerabilities at the top of ransomware root causes. Two of those three never involve an executable landing on disk.

Attackers use what is already installed. PowerShell, scripting hosts, remote management tools. MITRE ATT&CK catalogues these as techniques rather than files precisely because there is no signature to write.

So detection had to move from "is this file on the list" to "is this behaviour normal for this machine".

What replaced it

Behavioural detection watches sequences: a document spawning a script interpreter, a process reading credential storage, an unusual outbound connection immediately after a sign-in from a new location. It does not need to have seen the malware before, and it can act on its own - isolating a device or rolling back a change without waiting for a human.

Two pieces of that are worth naming, because they are the ones most often left switched off:

• Attack surface reduction rules block whole classes of behaviour - Office applications launching child processes, credential theft from LSASS, executables running from mail clients. They ship with the licence and several are off by default.
• EDR in block mode lets endpoint detection remediate malicious artefacts behind a third-party antivirus that only ran in passive mode. If you kept an old AV product alongside Defender, this is the setting that decides whether the second layer does anything.

Is the old antivirus test still useful?

Yes, with a caveat. Independent labs still test business endpoint products against real-world samples, and those results are the only comparison worth quoting because they are not written by a vendor. What they measure is one layer of a stack that now includes identity, email and configuration. A perfect protection score does not stop a valid login.

What you probably already own

If you are on Microsoft 365 Business Premium, Defender for Business is included: behavioural endpoint detection, attack surface reduction, automated investigation and remediation across Windows, macOS, iOS and Android. Business Premium lists at USD 22 per user per month on annual commitment.

The common failure is not a missing product. It is a licensed product in a default state: devices never enrolled, ASR rules never turned on, alerts arriving in a console nobody has logged into since the onboarding call.

The five-minute check

1. Enrolment. Every company laptop and phone shows as managed and compliant, not just "registered".
2. Real-time and cloud protection on. Tamper protection too, so a user or a script cannot switch it off.
3. Attack surface reduction rules in block mode, not audit mode. Audit records what would have happened and stops nothing.
4. No second antivirus running actively. Two products fighting each other is worse than one working. If a legacy AV must stay, put Defender in EDR block mode.
5. A named person who reads alerts. NIST's small-business guide and CISA's performance goals both treat detection and response as one obligation, and both expect a named owner rather than an installed agent.

What this does not cover

Endpoint protection is one layer. It does not stop an invoice fraud email that contains no attachment, it does not stop a valid sign-in with a stolen password, and it does not restore data after a successful encryption event. MFA, conditional access, email authentication and tested backups are separate controls, and each of them fails independently.

Country notes

Israel. The Business Premium licence and Defender for Business are sold the same way locally, so the practical question is whether an integrator enrolled the devices in Intune or only handed over licences.

Europe. NIS2 Article 21 asks for risk management measures and incident handling rather than an antivirus product; a licence in default state is hard to evidence as either.

Spain. ENS control families name endpoint protection and event monitoring separately - which is the same distinction between having the tool and watching what it says.

What to do with this

1. Open your endpoint console and check enrolment and compliance counts against your actual headcount.
2. Turn the standard attack surface reduction rules from audit to block, in a small pilot group first.
3. Remove or passively configure any legacy antivirus, and enable EDR block mode if it stays.
4. Decide who reads the alerts, and write it down. That is the control, not the software.

The differences do matter. For a small business, the answer to which one you need is simpler than the marketing suggests - and if you are on Microsoft 365 Business Premium, you have already bought most of it.

What each one actually does

EDR (Endpoint Detection and Response) is technology. It sits on your laptops, desktops and servers and watches process behaviour rather than matching files against a signature list. When something looks wrong, it alerts, and it can isolate the device on its own. The catch is that somebody has to read those alerts.

XDR (Extended Detection and Response) is also technology. It does what EDR does and correlates it with email, identity and cloud app signals, so the picture becomes "this mailbox received a phishing message, then this identity signed in from a new country, then this laptop tried to disable protection" instead of three unrelated alerts.

MDR (Managed Detection and Response) is a service, not a product. Someone else watches the alerts, investigates them and responds. MDR runs on EDR or XDR underneath; what you are buying is the human layer on top.

The distinction that matters: EDR and XDR are tools. MDR is someone using those tools for you.

The honest baseline for a 10-person business

Most small businesses do not need to buy all three. Microsoft Defender for Business is included in Microsoft 365 Business Premium and provides endpoint detection, attack surface reduction and automated remediation across Windows, macOS, iOS and Android. Business Premium is listed at USD 22 per user per month on annual commitment.

That is your EDR layer, and Defender XDR correlation across mail and identity comes with it. It is already running if your devices are enrolled through Intune - and "already running" is the part worth checking, because a licence that was never deployed protects nothing.

On detection quality, use the independent labs rather than any vendor's own claim. AV-TEST publishes recurring business endpoint results, and Microsoft's business endpoint product has sat at the top of that table for protection alongside the specialist vendors.

Ranges are from our own quoting work across small businesses in Israel and Europe, not a published price list. The licence lines are published; the service lines move with headcount and provider.

When to add MDR

MDR makes sense when nobody in the business is a security person. Most 10-person companies are exactly that. The question is not "do I need MDR" - it is "who reads the alert at 02:00 on a Sunday".

If the answer is "nobody", that is the gap. Detection without response is a smoke alarm in an empty house. NIST's small-business guidance puts detection and response together for this reason: the Respond and Recover functions are not optional extras on top of Detect. CISA's performance goals are blunter still - they expect an organisation to have a named owner for security alerting and a documented response, not just a tool.

If your IT provider says MDR is included, verify it. Plenty of providers install an EDR agent and never look at the console again.

What about SIEM?

A SIEM collects logs from everything and correlates them. It is powerful, and it is built for organisations with analysts. Microsoft Sentinel bills on data ingested and retained, so cost tracks log volume rather than headcount.

For a 10-person business a SIEM usually produces dashboards nobody opens. Unless an auditor specifically demands centralised log retention, that budget belongs on the response layer instead.

Scaling up: 25 people

At 25 people the maths shifts. More endpoints, more cloud apps, more identities - and threats that cross those boundaries, which is where correlation earns its keep. Credential abuse remains the most pervasive technique in breach chains, and it never shows up as a single suspicious file on a single laptop.

At this size the monitoring layer stops being optional. Twenty-five endpoints generate more alerts than a non-security person will triage, and the ones that matter arrive at inconvenient hours.

What is not in these numbers

1. Incident response. Some managed providers include it; some bill it separately at an hourly rate when you are least able to negotiate. Ask before you sign.
2. Compliance evidence. Defender and Intune logs cover most of what a NIS2 or ISO 27001 auditor asks for. A SIEM is only needed when centralised retention is explicitly required.
3. Configuration. A badly configured EDR is not much better than none. Attack surface reduction rules and automated investigation have to be turned on, not just licensed.
4. Identity. Conditional access and MFA sit underneath all of this. Endpoint tooling does not stop a valid login with a stolen password.

Country notes

Israel. Defender for Business ships with the same Business Premium licence sold locally, and most Israeli providers use it as the base layer with a monitoring service on top. Portal and support coverage in Hebrew varies by MDR vendor - worth asking before you commit.

Europe. NIS2 does not name products. Article 21 requires incident handling and monitoring as risk management measures, which a managed detection service satisfies more cleanly than a detection tool nobody watches.

Spain. The national transposition tracks ENS control families, which are specific about endpoint protection and event monitoring - again, detection plus response, not detection alone.

What to do with this

1. Confirm whether you have Microsoft 365 Business Premium. If you do, you own the EDR and XDR layers already.
2. Open Intune and check devices actually report as compliant with Defender policies active. Licensed is not the same as deployed.
3. Ask your provider, in writing: who reads our security alerts outside business hours, and what do they do next?
4. Buy a SIEM only when a framework requires it. Otherwise spend that money on the response layer.

Microsoft 365 Copilot is a paid AI assistant layered on top of the Microsoft 365 apps you already use. Inside Word, Excel, PowerPoint, Outlook, Teams and SharePoint, it drafts and rewrites documents, summarises long threads and files, spots trends in a spreadsheet, and transcribes, translates and summarises Teams meetings. It also handles some of the repetitive admin work nobody enjoys - generating a first-draft report, drafting a follow-up email, pulling together a summary of what was decided in a meeting you missed.

What it is not: a separate database, a search engine with its own index of your company, or something that "knows" more than the people using it. It works inside the apps you already have, on the files and messages those apps already show a given user.

Real examples from Microsoft's own case studies give a clearer sense of scale than the feature list does. One marketing team went from three hours to as little as 30 minutes drafting a campaign brief. A customer-feedback review that used to take three or four hours now takes under one. A content team cut production time from weeks to days. None of those numbers will match your business exactly, but they're the shape of what changes: less time on the first draft, more time on the judgement call that comes after it. The reason that lands is where the week already goes: McKinsey's work on knowledge work put roughly a fifth of the working week into searching for internal information and chasing the colleagues who have it.

What it costs, for a real team

Copilot is not sold on its own any more. It sits on top of a Microsoft 365 Business plan, and for new customers it now only comes bundled with one:

• Business Standard + Copilot: about $23.50 per user, per month, billed annually.
• Business Premium + Copilot: about $32 per user, per month, billed annually.
• Standalone Copilot Business add-on, for businesses that already hold a qualifying licence: $18 per user, per month, promotionally through 30 September 2026, reverting to $21 after.

For a 10-person team on Standard, that's roughly $235 a month, or about $2,820 a year, on top of whatever the base Microsoft 365 licence already costs. On Premium it's closer to $320 a month. Both bundles cap out at 300 users per tenant - past that you're into Enterprise licensing, a different conversation.

That's the whole cost. There's no separate infrastructure to run, no server to patch, no consultant needed to "install" it. The only real cost beyond the licence is the one nobody puts in a pricing table: the time it takes your team to actually change how they work.

Why the return varies so much

Forrester's commissioned study of small and medium businesses using Copilot modelled three scenarios over three years: a low-impact case at 132% ROI, a medium case at 243%, and a high case at 353%, based on a survey of over 200 companies with up to 300 employees. The same study reported new-hire onboarding accelerating by 25%.

Two things are worth being honest about before you take that range as gospel. First, it's commissioned by Microsoft and projected - built from financial modelling across risk scenarios, not measured against actual before-and-after deployments. Treat it as a framework for what's plausible, not a guarantee for your business. Independent tracking outside the vendor ecosystem points the same way with narrower numbers: Stanford's AI Index finds business adoption climbing fast, and the productivity gains measured in controlled studies real but smaller than vendor projections. Second, and more useful: the range is wide mostly because of adoption, not because of anything the licence does differently at different price points.

Microsoft's own 2026 Work Trend Index, based on a survey of 20,000 full-time knowledge workers across ten countries, found that when a manager actively uses AI themselves and is visibly seen doing it, employees report a 17-point lift in the value they get from it, a 22-point lift in critical thinking about how they use it, and a 30-point lift in trust in agentic AI tools. Workers whose manager creates space to experiment are 1.4 times more likely to become high-frequency users.

That lines up with what we see on the ground. The businesses that land at the high end of that ROI range are the ones where someone senior actually uses Copilot day to day and says so out loud. The businesses at the low end bought the licences, sent one email about it, and left the team to figure it out alone.

The risk that has nothing to do with Microsoft

The part of a Copilot rollout that goes wrong is almost never Microsoft mishandling your data. Copilot doesn't have its own view of your files - it shows a person exactly what they could already open by browsing to it themselves, using the same SharePoint and OneDrive permissions your business already has in place. If it can't already be opened, Copilot can't surface it either.

Which is exactly the problem. In a lot of small businesses, permissions are looser than anyone realises: the HR folder, the finance folder and the client contracts folder are all visible to "everyone" because nobody ever went back and tightened them after the business grew past a handful of people. Microsoft's own security guidance for Copilot names this directly as a governance problem, building oversharing-detection and policy recommendations into Purview specifically because Copilot makes existing over-permissioning far easier for someone to stumble into. Independent baselines say the same thing without a product to sell - the CIS Microsoft 365 Foundations Benchmark treats default-open sharing and unreviewed permissions as settings to tighten, not preferences to leave alone.

The fix is not complicated, and it is not Microsoft's job to do it for you. Before turning Copilot on for the team:

1. Audit existing file permissions in SharePoint and OneDrive - who can actually open the HR, finance, legal and client-data folders today, not who's supposed to be able to.
2. Restrict the folders that matter to the people who genuinely need them, before anyone gets a Copilot licence.
3. Turn it on for a pilot group of three to five people, not the whole company at once.
4. Review what the pilot group actually uses after 30 days, and decide whether to expand from real usage rather than a guess.

None of this is a long project. A permission audit for a 10-person business is a few hours' work, not a few weeks. Skipping it - not the price of the licence - is the mistake that actually costs businesses.

What this actually means for your business

If your team already lives in Microsoft 365, Copilot is very likely worth the cost. The licence isn't the risk. The risk is buying it and letting it sit unused, or switching it on for everyone before checking who can already see what.

A small business can have MFA everywhere, a properly hardened Microsoft 365 tenant, and tested immutable backups - and still lose control of its email and website in an afternoon, because nobody ever looked at who controls its DNS. DNS sits underneath everything else: it's not an app or an account most people think about, it's the layer that decides where every email and every website visit actually goes. That makes it one of the cheapest places for an attacker to cause maximum damage, and one of the least-checked.

What DNS actually is, in plain terms

DNS is the phone book that turns a domain name into the servers that actually run it. There are two different jobs bundled into that one idea, and the distinction matters:

• Recursive DNS is the lookup your laptop or phone does every time it visits a website - asking "where does this domain point?" and getting an answer back.
• Authoritative DNS is the source of that answer: the actual record of where your domain's email and website live, held by your domain registrar or a DNS hosting provider.

Most small businesses never separate these two ideas, because for years the same company - the registrar - quietly did both. That's usually fine. What matters is that authoritative DNS is the record that's actually worth protecting, because it's the one an attacker can change.

How a domain actually gets hijacked

Domain hijacking is rarely a cryptographic attack. It's almost always an account takeover: whoever controls the login to your registrar or DNS host controls where your domain points, full stop. If that account has a reused password and no MFA - which describes a lot of registrar accounts, because businesses lock down their email and their M365 tenant and never think about the account that controls DNS - it's one of the easiest accounts in the business to compromise, and one of the most damaging once it is.

Credential theft at scale is exactly the kind of attack that gets a registrar account into the wrong hands in the first place: Microsoft's 2025 threat research describes infostealer malware harvesting credentials and authentication tokens at scale as a primary way attackers gain footholds, and Mandiant's 2026 incident-response data still counts some form of prior compromise or credential-based access among the leading ways attackers get in, rising to 30% of engagements for ransomware operations specifically. A registrar account with a reused password sitting in nobody's password manager is exactly the kind of target that pattern describes.

What it's worth once someone has it

Once an attacker controls your DNS, they control your MX records - which means every email your domain is supposed to receive, including password resets, invoices, and anything a client sends you, can be silently redirected. Microsoft's own guidance on email security is blunt about the underlying risk: email spoofing and domain impersonation involve forging the sender address or mimicking a trusted domain to make an email appear legitimate - and a hijacked DNS record doesn't even need to forge anything. It's not impersonating your domain. It is your domain.

This is a different, and cheaper, attack than the more familiar lookalike-domain phishing - registering a near-miss domain, like micros0ft.com instead of microsoft.com, to trick one person into clicking. A lookalike domain has to fool a human. A hijacked DNS record fools the infrastructure itself, and every system and person that trusts it.

Cache poisoning: the quieter version

There's a second, subtler way DNS gets attacked that doesn't require compromising anyone's account at all: cache poisoning. A recursive resolver - the one doing lookups on behalf of users - can be tricked into caching a false answer for a domain, redirecting traffic without ever touching the real authoritative records. The domain's actual DNS is untouched; the forged answer just sits cached somewhere in the resolution path until it expires.

DNSSEC exists specifically to close this gap. It cryptographically signs DNS responses, so a resolver can verify that an answer genuinely came from the domain's authoritative source rather than being forged along the way. It's a real, useful defence - and it's also a different defence to the one that matters for account takeover. DNSSEC does nothing to stop someone who has legitimately logged into your registrar account, because a valid login can just sign the zone correctly with the fraudulent records. The two problems need two different answers, and most small businesses that have heard of DNSSEC assume it covers both.

What a hardened authoritative DNS platform does differently

The DNS most small businesses run is whatever came free with their registrar - general-purpose infrastructure, shared with millions of other domains, with no particular hardening against DDoS or the volume of query traffic a real attack generates. The authoritative DNS platform we run client domains on, Secure64 LineGuard, is built specifically to be attack-resistant rather than merely functional: it runs on a hardened operating system built for DNS rather than a general-purpose one, and it's distributed across an anycast network, so a flood of traffic aimed at taking one location offline doesn't take the domain's DNS down with it. None of that replaces good account hygiene - it's the layer underneath it, so that even a well-resourced attack against the DNS infrastructure itself doesn't succeed where account-level defences would have.

The minimum viable DNS hygiene checklist

Most of this is a half-day project, not a project plan:

1. Find out who actually controls the registrar account - not the M365 tenant, the actual domain registrar login. If nobody can answer this without checking, that's the first finding.
2. Put it in the password manager and turn on MFA, the same as any other account with this much reach. Registrar accounts are routinely the one login in a business that skipped this step.
3. Lock down transfer and contact changes - most registrars offer a transfer lock and a requirement that ownership or DNS changes get a confirmation email or additional verification. Turn it on.
4. Enable DNSSEC if the registrar or DNS host supports it - it closes the cache-poisoning path even though it doesn't touch account-takeover risk.
5. Monitor DNS records for unexpected changes. A monitored, alerted DNS zone means an unauthorised change gets caught in minutes, not discovered when clients start saying their emails are bouncing.

None of these require migrating platforms or rebuilding anything. They require someone to actually check who holds the keys to a system most businesses have never once logged into since the domain was registered.

Every managed IT pitch includes some version of "we monitor and manage your devices remotely." Almost nobody explains what that sentence actually involves. It's usually one specific thing: a small agent installed on every laptop, desktop and server, quietly reporting back to a remote monitoring and management (RMM) platform - NinjaOne, in our case - twenty-four hours a day.

This is what that agent actually does, what it can fix on its own, what still needs a human, and the honest risk that comes with giving one platform reach into every device you manage.

The agent: what it actually collects

The RMM agent isn't watching what someone types or reading their files. It reports on device health: disk space, CPU and memory load, whether the disk is encrypted, whether antivirus and the patch level are current, whether backup jobs completed, and whether the device is even switched on and reachable. None of it is personal - all of it is operational. That's the same principle Microsoft describes for endpoint security generally: tools that "continuously observe what's happening across your devices, looking for activity that deviates from established patterns," rather than checking in occasionally.

The reason this runs continuously rather than on a quarterly check-in matters more than it sounds. Mandiant's 2026 incident-response data puts the global median time an attacker sits undetected inside a network at 14 days, up from 11 the year before. A device that's only checked once a quarter gives a problem - a failing disk, a disabled antivirus, a stalled backup job - weeks to become a crisis before anyone notices. Continuous telemetry is what closes that gap: the point isn't more data, it's catching the same problem on day one instead of day ninety.

Patch orchestration: further than Windows Update

Most small businesses assume "we patch your machines" means Windows Update runs on schedule. That's the easy 20%. The harder, more important part is everything else installed on the machine: browsers, PDF readers, Zoom, Java, Adobe Reader, and the dozens of other third-party applications that are actually where most real-world exploitation happens, because they update less consistently and get less attention than the operating system.

An RMM platform patches both. It maintains a software inventory across every managed device, checks it against known vulnerable versions, and pushes updates on a schedule instead of waiting for someone to notice a machine is six versions behind. Microsoft's own guidance is direct about why the automation matters: automating patching can reduce the time vulnerabilities remain unaddressed.

Speed matters more than it used to. Mandiant's 2026 data puts the mean time to exploit a new vulnerability at an estimated -7 days - meaning exploitation is, on average, already happening before a patch is even released. That figure is worth sitting with: it means no patch cadence, however fast, "beats" every attacker on its own. Patching closes the gap for the vulnerabilities being patched; catching the ones that get exploited first is a detection-and-containment problem, not a patching one - which is exactly why the monitoring layer and the patching layer run on the same platform rather than as two separate tools that don't talk to each other.

Scripted remediation: the fixes nobody has to ask for

A meaningful share of what an RMM platform does never generates a support ticket, because it's fixed automatically the moment it's detected. Some concrete examples:

• Disk space running low - temporary files, old update caches and log files are cleared automatically before it becomes "why is my laptop frozen."
• A security service stops running - if Defender or the endpoint agent gets disabled or crashes, a policy re-enables it and alerts the technician, rather than leaving the device unprotected until someone happens to check.
• A scheduled task or backup agent fails silently - it's restarted automatically, and only escalates to a person if it fails again after the automated retry.

This is what "self-healing" actually means in practice: a defined, tested response to a specific, recognised condition, running the moment that condition is detected rather than whenever someone gets around to it.

Remote access and scripting: the same door, used two ways

The other half of an RMM platform is the ability to reach a device without anyone being in the room: opening a remote session to troubleshoot something a script can't fix, or pushing a script to every device in a fleet at once - a registry change, a software rollout, a configuration fix - instead of touching each machine by hand.

This is also, honestly, the part worth being careful about, because it's the same capability an attacker would want if they got hold of it.

The uncomfortable part: RMM access is itself a target

Giving one platform standing reach into every managed device is powerful, and that power cuts both ways. Microsoft's 2025 threat research found that a remote monitoring and management tool was present in 79% of the ransomware cases its incident-response team investigated that year, and that over 40% of ransomware attacks had a hybrid component spanning both on-premises and cloud infrastructure. That statistic is not a reason to avoid remote management - it's not optional for managing a modern fleet of devices - but it is a reason RMM access needs the same seriousness as anything else that touches every machine:

• Multi-factor authentication on every console login, no exceptions.
• Technician access scoped to the clients and devices a given person actually needs, not blanket access to everything.
• Logging and alerting on the RMM platform's own activity, not just on what it reports about client devices - because unusual behaviour from the management layer itself is exactly the pattern that 79% figure describes.

An audited, access-controlled RMM platform run by a provider who takes its own console as seriously as your endpoints is a different risk profile to an unmanaged remote-access tool nobody has reviewed in years. The distinction isn't whether remote management exists - it's whether it's treated as the high-value target it actually is.

What this looks like day to day

For a client, most of this is invisible by design. Devices get patched overnight. A near-full disk clears itself before anyone notices. A disabled security service gets flagged and re-enabled within minutes rather than at the next scheduled visit. The tickets that do land are the ones that actually need a person: something that failed twice, something outside a known pattern, or something a script genuinely can't fix on its own.

That's the actual shape of "we monitor your devices" - not a promise, a specific platform doing specific, auditable things, continuously, with a defined line between what it fixes on its own and what it hands to a human.

Somewhere in a lot of small businesses is a server. A physical box, probably in a comms cupboard or under a desk, that has been running since before anyone currently on the team joined. It still works. Nobody wants to touch it. And every year it goes untouched, the question of whether you still need it gets more expensive to answer.

This isn't an argument that every business must be 100% cloud. It's a framework for a decision most small businesses are putting off: what that box is actually doing today, what replaces each of those jobs, and the specific cases where keeping some local infrastructure is still the right call.

What the server in the closet is actually doing

Before deciding whether to keep it, it helps to separate the roles bundled into one physical machine. A typical small-business server on-premise is usually doing some mix of:

• File storage - a shared drive everyone maps a letter to.
• Identity - a local Active Directory domain controller that checks passwords and hands out permissions.
• Backup target - the destination other machines write their backups to.
• A line-of-business app - older accounting, practice-management, or industry-specific software that was installed directly on the server years ago.
• Print management - a shared queue for the office printer.

Most small businesses never wrote this list down. They bought "a server" once and it grew into doing whatever needed doing at the time.

What replaces each job in the cloud

Once the roles are separated, most of them have a direct cloud equivalent that a small team can run without anyone on-site managing hardware.

Identity is the one worth being precise about. Microsoft Entra ID is a genuine cloud identity and access management service, and for most small businesses it can take over what a domain controller did - checking who someone is and what they're allowed to touch. But Microsoft's own positioning for Entra ID describes centralised management "whether they're in the cloud or on-premises" rather than a flat claim that it replaces a domain controller outright. In practice: a small business with nothing unusual running (no legacy app that authenticates against local AD) can usually go cloud-only. A business with one piece of software that still needs a domain-joined machine keeps a much smaller, scoped setup instead of retiring nothing.

Backup is the one where "replace" undersells it. A local backup box sitting on the same network as the server it protects is reachable by anything that reaches the server - the same ransomware, the same electrical fault, the same theft. Moving the backup destination off-site by default doesn't just modernise it. It removes the single point of failure that a local backup device is, by definition, sitting right next to.

The clock already running on old hardware

If that server is running Windows Server 2012 or 2012 R2, extended support ended on 10 October 2023. Microsoft's own guidance is blunt about what that means: no further security updates unless you buy Extended Security Updates, which are free for three years only if you migrate the workload to Azure, and a paid, time-limited option if it stays on-premises.

Windows Server 2016 has a later but equally real deadline: extended support ends 12 January 2027, and Microsoft is already pointing customers toward upgrading, Extended Security Updates via Azure Arc, or migrating to Azure. If your server is running either of these, "it still works" and "it's still supported" are two different sentences, and only one of them is getting less true by the day.

Why "someone local to plug into" isn't the safety net it used to be

A common reason small businesses keep a server around is a version of "if something breaks, someone can just walk over to it." That instinct is worth examining rather than dismissing, because the way small businesses are actually managed today has already moved past it.

Remote monitoring and management (RMM) tooling is how a managed IT provider watches and fixes devices without being in the building - it's the platform running in the background of every device we manage, including the ones that never touch a local server at all. That's not a reason to be cavalier about it: Microsoft's 2025 threat research found that an RMM tool was present in 79% of the ransomware cases its incident-response team investigated that year, and that over 40% of ransomware attacks had a hybrid component spanning both on-premises and cloud infrastructure. The lesson isn't "avoid remote management" - it's that RMM access itself needs the same controls as anything else with reach into every device: multi-factor authentication on the console, scoped technician access, and alerting on anything unusual. A locally-run RMM platform, tightly access-controlled, is not the same risk as a legacy remote-access tool nobody has audited in years - and it's already how most small-business IT gets managed, server or no server.

What keeping the box actually costs, versus retiring it

The honest comparison isn't hardware price versus subscription price - it's total cost including the parts that don't show up on an invoice. From our own work retiring on-premise servers for small teams, the recurring costs of keeping one running tend to be:

• A hardware refresh every 4-6 years, plus the Windows Server and Client Access Licences that come with it.
• A UPS and, in some offices, dedicated cooling, so the box survives a power blip.
• Someone's time when it needs a reboot, a driver update, or a disk swap - usually at the worst moment.
• The downtime risk of a single machine that, if it fails outright, takes file access, sign-in, or both down with it until it's fixed or replaced.

Against that, Microsoft 365 Business plans are priced per user, per month, with no hardware to refresh:

For a ten-person team, Business Premium at current pricing works out to a predictable monthly line rather than a lump sum every few years. That's not automatically cheaper for every business - a server that's fully paid off, still supported, and doing one narrow job can be the cheaper option for another year or two. It stops being cheaper the moment it also needs a hardware refresh or has crossed its support end date.

When keeping some local infrastructure is still the right call

This isn't a case for retiring every server on principle. There are genuine reasons to keep some local infrastructure:

• Line-of-business software that only runs locally. Older accounting, legal case-management, or industry-specific tools sometimes have no cloud-hosted version. If the vendor doesn't offer one, the honest move is to shrink the server to just that one job rather than retire it - not to keep the file share and the domain controller and the backup target running alongside it out of habit.
• Genuinely unreliable internet. If a connection drops for hours at a time, moving every function to the cloud trades one single point of failure for another. This is uncommon in most of the markets we work in, but it's a real reason where it applies.
• Very large local file libraries. Video, CAD, or imaging files in the multiple-terabyte range are still awkward and expensive to keep fully synced to the cloud for a small team. A local store with cloud backup can be the pragmatic middle ground.

None of these are arguments for keeping the file share, the domain controller, and the backup target all running on one general-purpose box "just in case." They're arguments for keeping exactly the piece that still needs to be local, and moving everything else off it.

How the move actually happens

1. Inventory every role the server performs - file storage, identity, backup, any installed line-of-business app, printing. Nothing gets decommissioned until every role has a named replacement or a documented reason to stay.
2. Stand up the cloud equivalent in parallel. SharePoint libraries, Entra ID, cloud backup, and the RMM/Intune management layer all get configured and tested before anything moves.
3. Cut over role by role, with a rollback window. Files first, then sign-in, then backup. The old server stays reachable but read-only for a defined period in case something was missed.
4. Decommission and wipe. Once nothing depends on it, the server is securely wiped and retired rather than left running "just in case" - which is usually how a second forgotten server ends up in the same closet five years later.

Ask a business owner whether their Microsoft 365 email and files are backed up, and most will say yes, because it all lives in the cloud. It is an easy thing to believe and a costly thing to get wrong. Microsoft keeps the service running. Keeping a copy of your data that you can actually restore is left to you, and most people find that out in the week they suddenly need it.

What Microsoft protects, and what falls to you

Microsoft works on a shared responsibility model. The line runs roughly here:

• Microsoft looks after the infrastructure: the datacentres, the uptime, the security of the platform.
• You look after the data inside it: who can reach it, how long it is kept, and whether you can bring it back.

This is not our reading of it. Microsoft sets the division out in its shared responsibility documentation, and states it plainly in section 6(b) of the Microsoft Services Agreement: "We recommend that you regularly backup Your Content and Data that you store on the Services or store using Third-Party Apps and Services." Independent analyst work on SaaS data protection reaches the same conclusion from the other direction - the platform's retention windows are an availability feature, not a recovery point objective, and organisations that treat them as backup discover the gap during an incident. That is a fair signal to take seriously when it is the vendor itself doing the recommending.

How long Microsoft keeps deleted items

Microsoft does hold on to deleted items for a while, in recycle bins. The catch is that "a while" is short, and a recycle bin is not a backup:

Once that window passes, the item is gone. Delete a mailbox, a folder or a SharePoint site and go a month without noticing, and no recycle bin is going to bring it back.

The four ways businesses actually lose Microsoft 365 data

An outage at Microsoft is rarely the culprit. In practice, data disappears through:

1. Accidental deletion. Someone empties a folder or overwrites a file, and it is past the recycle-bin window before anyone spots it.
2. Ransomware and malware. Modern attacks reach synced cloud files and encrypt them along with everything else.
3. A departing or malicious employee. Mailboxes and OneDrive files tied to that person's account can vanish when the account is removed.
4. A retention or configuration slip. A policy gets changed, and months of data quietly ages out.

Native backup versus a real backup

Microsoft now sells its own backup add-on. It is better than nothing, with two limits worth knowing. It covers only Exchange, SharePoint and OneDrive, and it keeps the copy inside Microsoft's own environment. A separate third-party backup adds what that cannot: an independent copy held outside Microsoft, so a platform-wide problem does not take your recovery down with it, and fast item-level restores, so pulling back one lost mailbox is a matter of minutes.

What a working backup looks like for a small business

None of this needs to be elaborate. For a team of 5 to 50 people, a solid setup comes down to four things:

• A daily, automatic backup of Exchange, SharePoint, OneDrive and Teams.
• An immutable copy that cannot be altered or deleted, so ransomware has nothing to reach.
• A restore you have run for real, rather than one you assume works.
• A recovery time you actually know, so if the worst happens you can give your team and your clients a straight answer on when things will be back.

With those four in place, a bad day stays an inconvenience rather than a threat to the business.

It is easy to assume a fresh Microsoft 365 tenant arrives locked down. It does not. Security defaults give a new tenant basic MFA, but they stop well short of a hardened configuration - several of the settings that stop real attacks are switched off by default, and switching them on is left to you. Most of the highest-impact ones are free and quick, so the order below starts there.

This checklist is not our house opinion. It tracks two published, independently maintained standards: the CIS Microsoft 365 Foundations Benchmark, which specifies each setting and its recommended value, and CISA's Microsoft 365 Secure Configuration Baselines (the SCuBA project), which is the configuration US federal agencies are required to meet. Where we deviate from either - usually to keep a small team workable - we say so.

Start with the critical three

If you get to nothing else this month, get to these. A week is enough, and they shut the doors attackers lean on first.

1. Turn on MFA for everyone. Microsoft's own measurement study of Entra accounts put the effect at a 99.22% reduction in compromise risk, and 98.56% even for accounts whose password had already leaked; Microsoft now states the figure as blocking more than 99.2% of account-compromise attacks and has made MFA mandatory for Azure sign-ins on that basis. On Business Premium it costs nothing extra. There is no case for leaving it off, admins included.

2. Block legacy authentication. Old sign-in methods such as basic POP, IMAP and SMTP cannot use MFA, which is exactly why attackers reach for them. Blocking them is free and shuts the gap.

3. Set up email authentication. Configure SPF, DKIM and DMARC, with DMARC set to reject, so nobody can send mail that appears to come from your domain to your own staff and customers.

Identity and access

Most breaches start with a login, so identity is where the bulk of the work sits. Beyond the critical three:

• Add Conditional Access, so a risky sign-in from an unfamiliar place or device gets challenged or blocked on its own.
• Move admins onto phishing-resistant MFA, whether that is the Authenticator app or a FIDO2 security key.
• Give the admin accounts extra protection, and keep one break-glass account aside for the day you are locked out.

Email protection beyond authentication

Email is the most common way in, so it is worth hardening past SPF and DKIM:

• Turn on Safe Links and Safe Attachments, which check links and files the moment someone clicks or opens them.
• Switch on anti-phishing and impersonation protection, which has to be configured explicitly for your own domain and named executives.
• Raise an alert on any new mailbox forwarding rule. Mail quietly forwarding to an outside address is a familiar sign of an account that has been taken over.

Protecting the data itself

With identity and email in hand, turn to the files:

• Data Loss Prevention policies stop sensitive details, such as ID numbers or card data, leaving by email or link.
• Sensitivity labels attach encryption and access rules to the file itself, so it stays protected even after it is forwarded on.

Devices and monitoring

Last, the machines and the ongoing view:

• Enrol devices in Intune, enforce encryption, and keep company data off devices that are out of compliance.
• Turn on Defender for Business, so threats are caught by how they behave rather than only by known signatures.
• Set a Secure Score baseline and review it monthly, so the protection you set up does not slip over time.

The licence you need for this

Most of these tools sit in Microsoft 365 Business Premium, or E3 for larger teams. Basic and Standard leave them out. When security is the point, Premium is the floor, and that is usually where we start.

A realistic timeline

The critical three take about a week. Fuller hardening, with Conditional Access, data protection and device policies, tends to run four to eight weeks for a small business, plus some tuning after that. It does not all have to happen at once, as long as the three that matter most come first.

The supported path for mail, calendars and contacts is documented by Microsoft, and Google's own admin-level export documents what is and is not included on their side.

A move from Google Workspace to Microsoft 365 covers three things: your email, your calendars and contacts, and the files in Google Drive. Email, calendars and contacts travel together. Drive is a job on its own, and it helps to know that before you start so nothing catches you out halfway through.

Here is what comes across, and what needs handling separately:

What does not survive the move perfectly

Every migration vendor's own fidelity documentation says the same thing, and it is better to hear it now than in week three. BitTitan and SkyKick both publish per-object fidelity matrices for Google-to-Microsoft moves showing which attributes convert, which approximate and which are dropped. The ones that matter for a small team:

• Gmail labels become Outlook folders. This is the big one. A Gmail message can carry five labels at once; an Outlook message lives in exactly one folder. The migration picks one and copies the message into each labelled folder, so you either lose the multi-label view or gain duplicate copies. Neither is wrong - it is a structural difference between the two systems, and no tool fixes it.
• Gmail filters and rules do not migrate. They have to be rebuilt as Outlook rules. Budget 20 minutes per heavy user.
• Google Docs, Sheets and Slides are converted, not moved. Conversion to Word/Excel/PowerPoint is good but not perfect: complex formulas, apps-script automations, add-ons and pixel-level formatting need checking. Anything running Apps Script needs rebuilding in Power Automate.
• Shared drive permissions approximate. Google's sharing model and SharePoint's do not map one-to-one. We rebuild the permission structure deliberately rather than pretending it transfers.
• Google Sites, Forms, Keep and Chat history have no destination. Export what matters before you close the account.

The reassuring part is that your mail is copied, not moved. Nothing is deleted from Google while the move is happening.

The two ways small businesses migrate

For a team of 5 to 50 people, two paths are worth weighing up.

The built-in path (Simplified Gmail Migration). Microsoft built this tool for small businesses, and it moves mail, contacts and calendars together. It handles up to 1,000 mailboxes, far more headroom than a small business will ever use. For most companies, this is the one to pick.

Email-only (IMAP migration). This copies the inbox and folders, but leaves contacts and calendars behind unless you export them yourself. It fits very small, simple setups under about 150 users where email is the only thing that matters.

Once you add a lot of shared mailboxes, aliases, or a large Drive, the move is better run as a managed project than clicked through live.

The order that keeps mail from going missing

The sequence matters more than the tool. Follow it and nothing falls through the cracks:

1. Set up the Microsoft 365 tenant and verify your domain.
2. Create every user and give each one a licence, so a mailbox is waiting before anything is copied into it.
3. Run the mailbox migration in the background. Mail still arrives in Google as normal while this happens, and the team carries on unaware.
4. Switch the MX record after hours. That is the moment new mail starts arriving in Microsoft 365, and it takes minutes.
5. Leave the Google account running for 30 days, so everyone can confirm their mail, contacts and calendars made it across.

Where email actually gets lost

Almost every horror story traces back to one of these:

• The Google account was deleted too early, before the final sync had finished.
• The MX record was switched before the mailboxes had copied across.
• An email-only method was used, and contacts and calendars were forgotten.
• A shared mailbox or alias was missed, and a customer kept writing to it.
• Two-step verification on the Google side blocked the migration because no app password had been set.

None of these are hard to sidestep. They come down to a checklist and someone paying attention on the day.

What about your Google Drive files?

Drive sits outside the mail move. Your files go to OneDrive and SharePoint in a second migration, with its own plan for structure and permissions. Getting that plan right is what stops the files scattering all over again once they land. Our guide on where files should live in Microsoft 365 covers the destination in detail.

How long it takes, and what downtime to expect

For a team of ten, expect two to three weeks of background work and one after-hours switch at the end. Email never stops. People work in Google right up to the switch and in Outlook straight after, and on the day itself there is very little for anyone to notice.

Microsoft 365 Business comes in three tiers. Strip away the feature lists and they line up like this:

• Business Basic (about €6-7 per user per month): business email, Teams, and the web versions of Word, Excel and Outlook, with 1 TB of storage. No installed desktop apps.
• Business Standard (about €12.50-14 per user per month): everything in Basic, plus the Office apps you install on the computer.
• Business Premium (€22 per user per month): everything in Standard, plus the security and device management, including Defender for Business, Intune and Entra ID P1.

Those numbers moved on 1 July 2026: Microsoft raised Business Basic from USD 6 to USD 7 and Business Standard from USD 12.50 to USD 14 per user per month, while leaving Premium at USD 22.

Which quietly makes Premium the better-value tier than it was, because the gap you are paying to close is now smaller.

What changes as you move up

Basic to Standard is really about the desktop apps. The step that changes your security posture is Standard to Premium.

The hidden requirements, and the actual arithmetic

Two capabilities are licence-gated in a way the marketing pages do not make obvious, and both are the ones you need:

• Conditional Access requires Entra ID P1. Not Basic, not Standard. Without P1 you can turn MFA on, but you cannot write a policy that says "challenge this sign-in because it came from an unmanaged device in another country". Security defaults are all you get.
• Intune requires Premium (or a standalone Intune Plan 1 add-on). Basic and Standard have no device management at all - no enforced encryption, no compliance policies, no remote wipe.

So the real comparison is not Standard vs Premium. It is Standard plus the pieces you have to buy anyway, vs Premium. Per user per month, at list:

For a 10-person team that is roughly $1,320-$1,920 a year of difference, in Premium's favour, before counting the second vendor relationship and the second console. There is no configuration in which assembling the equivalent of Premium from Standard is cheaper. If you need the security tier, buy the security tier.

The small print that catches people out

Something most comparison pages gloss over: Basic and Standard leave out the security tools cyber insurers now treat as a baseline, meaning endpoint detection and response, device management, and enforced MFA through Conditional Access. Premium is where all three arrive.

That reframes the choice for a lot of small businesses. Premium starts to look less like the premium option and more like the sensible floor, since going without it can fail a cyber-insurance assessment or leave open the gaps a breach walks through.

Why the cheapest plan can end up the expensive one

Take Standard to save money, then add the security piece by piece, and the bill usually lands above what Premium would have cost, on a setup that is harder to keep straight. That is before the real exposure: a failed insurance renewal, or a single breach, makes the few euros a month between the plans look like nothing.

The 300-user ceiling

Worth knowing early: the whole Business family stops at 300 users. Past that, you move up to an Enterprise plan such as E3, at a higher price per seat. A business growing quickly towards that line is usually better off planning around E3 from the start than being pushed into a migration at an awkward moment.

Choosing, in three questions

Three questions usually settle it:

1. Do people need the installed desktop apps, or will the web versions do? If the web is enough, Basic can work. If not, you are into Standard or above.
2. Do you handle client or regulated data, or want cyber insurance? If so, Premium is the one, for the security it carries.
3. Are you heading past 300 people? If that is on the horizon, look at E3 now rather than later.

For most of the businesses we work with, the answer lands on Business Premium, simply because the security inside it has stopped being optional.

Microsoft 365 hands you three homes for files and almost no guidance on which is which. In everyday terms:

• OneDrive is your personal drawer. Roughly 1 TB of space, and what you keep there is yours.
• SharePoint is the company's shared filing cabinet. The business owns what goes in it, rather than any one person.
• Teams is the workspace that sits on top of SharePoint. Share a file in a channel and it is really being stored in SharePoint underneath.

Once that lands, most "where does this go" decisions make themselves.

The principle underneath the product names

The three-way split is not a Microsoft invention, and it is easier to remember if you know where it comes from. Records and information management practice - the discipline AIIM has been codifying for decades - separates content by ownership and lifecycle rather than by tool:

1. Personal working content. Drafts, notes, half-finished analysis. Owned by an individual, short-lived, no obligation to keep it. In Microsoft's world: OneDrive.
2. Departmental or project collaboration. Content that a group works on together and that outlives any one member. Owned by the team, retained for the life of the project. In Microsoft's world: a SharePoint site, usually surfaced through a Teams channel.
3. Corporate records and published content. Contracts, policies, signed documents, the master client list. Owned by the organisation, governed by a retention schedule, often with a legal minimum. In Microsoft's world: a SharePoint site with a retention policy applied.

If you decide where a file goes by asking "who owns this and how long must it survive?" instead of "which app is open?", you get the same answer every time - and the answer stays right when Microsoft renames the products again.

Where each kind of file belongs

Before the split, it helps to know what sits underneath: a Teams channel's Files tab is a connected SharePoint site, and chat files live in the sender's OneDrive.

A simple test: if losing a file the day someone leaves would hurt the business, it belongs in SharePoint, not a personal OneDrive.

Why this matters more than it sounds

A file in someone's OneDrive is tied to their account. For a rough draft, that is fine. For a signed contract or the master client list, it is a genuine risk, because the file leaves with the person the moment they do.

The leaver trap

This is the one we see catch people out. Someone resigns, the account gets removed or unlicensed to save the fee, and a few weeks later a client asks for a document that only ever sat in that person's OneDrive. From the point the account is gone, those files are recoverable for about 30 days, and then not at all.

Files in SharePoint dodge this entirely. The business owns them, so a resignation never walks out with company documents. It is also the reason a proper Microsoft 365 backup earns its keep, which we cover on its own.

How files behave inside Teams

Teams trips people up because it does not really store files. It leans on other places to do that:

• Files shared in a channel land in that team's SharePoint library.
• Files shared in a private chat land in the sender's OneDrive.
• Meeting recordings land in the channel, in SharePoint.

So the habit worth building is a simple one: share work in a channel rather than a chat, and it ends up in the company cabinet instead of a personal drawer.

A setup that works for a team of ten

You do not need an elaborate structure. For most small teams, four moves cover it:

1. One SharePoint site per department or main function.
2. OneDrive kept for personal drafts only.
3. The team sharing in channels rather than as email attachments.
4. Access set to least privilege, and looked over once a quarter.

Set up in an afternoon, it puts an end to the weekly hunt for a file nobody can find.

The scale is documented rather than anecdotal. The FBI's Internet Crime Complaint Center recorded USD 20.877 billion in reported losses across 1,008,597 complaints in 2025, up 26% year on year, with business email compromise alone accounting for USD 3.04 billion at an average of over USD 122,000 per reported incident.

Ransomware gets the headlines. Payment fraud quietly takes more money out of small businesses every quarter - usually without anyone noticing for weeks.

The reason is simple: payment fraud doesn't need to break anything. No malware, no encrypted files, no ransom note. Someone just convinces your finance person to send money to the wrong bank account. By the time the real supplier asks where their payment is, the funds have already been moved through 3-4 mule accounts and are gone.

For a 5-50 person business, a single successful incident is typically €8,000-€120,000. In the cases we have been called into, recovery through cyber insurance on social-engineering wire fraud lands well below half the loss - these are policy-dependent and not a published rate, so treat them as our experience rather than a benchmark.

The 5 patterns we actually see

1. Supplier email takeover (the most common)

An attacker compromises your supplier's mailbox - not yours. They sit quietly, read months of email, and learn the relationship: how invoices look, what amounts are normal, who approves what.

Then they wait for a real invoice to go out, intercept it, and resend the same PDF with one change: the IBAN. The email comes from the real supplier address. The signature, formatting, and PDF template are identical. Only the bank account is different.

Red flag: A long-standing supplier sends you "updated bank details" by email - especially close to an existing invoice due date. The FBI's own guidance on this pattern is to verify through a channel and a number you already had, never one supplied in the request.

What this looks like in practice (anonymised, from a case we handled)

A 14-person design studio in central Europe had worked with the same print supplier for six years. In March the supplier's mailbox was compromised through a phished webmail password. The attacker read the thread quietly for five weeks.

When the studio's producer emailed to approve a €18,400 print run, the attacker replied from the supplier's real address, on the real thread, with the real invoice PDF - re-issued with a new IBAN and a one-line note: "we've moved banks this quarter, please use the details on the attached." No spoofed domain, no typos, no urgency. The studio paid the same day.

The fraud surfaced 19 days later when the supplier chased the invoice. €18,400 had already been split across three accounts. €2,900 was recovered. A single 40-second phone call to the supplier's known number would have stopped it - which is exactly why the UK's NCSC puts out-of-band verification of any bank-detail change at the centre of its business payment fraud guidance.

2. CEO / founder impersonation

A finance employee gets a message - email, WhatsApp, sometimes SMS - that looks like it's from the founder: "I'm in a meeting, need you to push through an urgent transfer to this account today, will explain later."

The domain is usually a lookalike (techsuit.io → techsuit-io.com, or techsuıt.io with a Turkish dotless ı). On WhatsApp, the profile photo is the real founder pulled from LinkedIn.

Red flag: Urgency + secrecy + a payment request that bypasses normal approval flow. Always.

3. Invoice manipulation inside your own mailbox

The attacker compromises your mailbox first - usually through a phished Microsoft 365 password with no MFA. Once inside, they set up a mailbox rule that auto-forwards or deletes any email containing words like "invoice", "payment", "bank", or "IBAN".

Then they impersonate your finance team to your customers, and your customers to your finance team. Money flows out before anyone realises both sides are talking to a stranger.

4. Payroll redirect

Around payroll dates, HR receives an email from "an employee" requesting that their salary be paid to a new account. It's plausible - people switch banks. The change goes through, and one employee's monthly salary lands in a fraudulent account.

Small loss per incident, but trivially easy to execute and often repeated month after month before being discovered.

5. Fake invoice / fake supplier

A finance inbox receives an invoice from a supplier that looks plausible - domain-matched email, professional PDF, reasonable amount. It might reference a real project or a generic line item like "consulting services" or "domain renewal".

If no one strictly checks supplier onboarding, the invoice gets paid. We've seen €400-€2,000 invoices clear without anyone noticing the supplier didn't exist.

Why small businesses are the preferred target

Three reasons:

1. Fewer controls. No dual-approval on wires. No callback verification. Often one person handling both the email and the bank.
2. Faster money movement. SMBs need to pay quickly to keep operations running. Fraud relies on that speed.
3. Lower scrutiny per transaction. A €15,000 wire at a 25-person company is normal. The same wire at a Fortune 500 triggers automated review.

The controls that actually stop it

You don't need an enterprise security stack. You need 6 specific controls.

Control 1 - MFA on every mailbox (no exceptions)

The single highest-ROI security control for an SMB. Microsoft measured MFA cutting the risk of account compromise by 99.22%, and by 98.56% even where the password had already leaked - and a compromised mailbox is how the invoice-manipulation pattern above starts. Microsoft 365 Conditional Access can enforce this for every user in one policy.

Control 2 - Mailbox rule auditing

Most BEC attacks set up forwarding or deletion rules. Microsoft Defender for Office 365 alerts on any new external forwarding rule. Without this, you can be compromised for weeks and never know.

Control 3 - Out-of-band callback verification

A non-negotiable rule for finance: any bank detail change, or any new wire over a threshold (€2,000-€5,000), is verified by phone - using the phone number you already have on file, not one from the email.

Print this on a card. Put it on the finance person's monitor. It will stop more fraud than any software.

Control 4 - Dual approval for wires

Two people must approve any outbound payment above a threshold. Most banks (across Israel and the EU) support this natively in the business portal. Enable it.

Control 5 - Supplier onboarding checklist

New suppliers don't get paid until: (a) someone has spoken to them on the phone using a number from their official website, (b) bank details are received via that verified channel, (c) a manager has approved the supplier record.

Control 6 - Domain protection (SPF, DKIM, DMARC)

Properly configured DMARC at p=reject prevents attackers from sending email as your domain to your customers. Without it, your customers are an attack surface you don't control.

What to do in the first 60 minutes after a fraudulent transfer

Speed matters more than anything else.

1. Call your bank's fraud line - not the branch. Request an immediate recall (in the EU, SEPA recall; in Israel, ask for "החזרת זיכוי דחופה"). Funds can sometimes be frozen if the receiving bank hasn't released them.
2. File a police report immediately. Your bank often won't act on a recall request without one.
3. Reset every password and revoke every active session on the compromised mailbox. Don't assume the attacker is gone.
4. Notify your insurer. Most cyber policies have a 24-72 hour notification window.
5. Check mailbox rules for forwarding and deletion - and audit the last 90 days of sent items.

The 30-minute mark is roughly when funds typically leave the first receiving account. Past that, recovery rates fall sharply.

What this costs to implement

For a 10-person business, the full stack - MFA, Defender for Office 365, mailbox rule alerting, DMARC, documented dual-approval and callback procedures - runs about €15-25/user/month on top of standard Microsoft 365 licensing.

A single prevented incident pays for the entire program for 5-10 years.

Start with the independent number rather than ours. McKinsey Global Institute's work on the social economy put the average knowledge worker at roughly 28% of the working week spent on email and a further 19% searching for internal information and tracking down colleagues who have it - close to a fifth of the week lost to finding things. Forrester's Total Economic Impact studies of Microsoft 365 for smaller organisations find the same categories of recovered time when collaboration and identity are consolidated onto one platform.

So the honest framing is this: according to McKinsey, a 40-hour worker loses something like 7-8 hours a week to searching and internal chasing. Cloud modernisation does not recover all of it. What our clients typically recover is around 20 hours per month across a 10-person team, and it comes from three specific eliminations - version-hunting across email attachments and local drives, manual file transfer and re-sending, and password and access friction. The rest of the loss is organisational, and no platform fixes it.

The "20 hours a month" figure gets thrown around a lot in managed IT pitches. It's a real number - but it's easy to be sceptical because no one explains where those hours actually go.

This is what we consistently see across small businesses - law firms, agencies, accountancy practices, small SaaS companies - before a proper cloud setup:

The total is easily 20+ hours for a 10-person team. For a 25-person team with more touchpoints, it's typically 40-60 hours.

What "cloud modernisation" actually means for a small business

For a 5-50 person business, migrating to the cloud means five concrete things:

1. Email and files in a managed cloud platform - Microsoft 365 or Google Workspace - not on a local server that dies when the power goes out.
2. Devices centrally managed - so you can update software or wipe a stolen laptop without being in the same room.
3. Passwords in a business password manager - not in spreadsheets, sticky notes, or your team's memory.
4. Backups running automatically and tested - not set-and-forgotten.
5. Software stack audited once a year - so you're not paying for tools your team stopped using 18 months ago.

That's the entire scope for most small businesses. It doesn't require a data centre, Azure expertise, or a full-time IT hire. It runs on three or four vendor relationships - Microsoft, Acronis, 1Password, and whoever manages it for you.

The SaaS audit: where the quick savings are

Most small businesses are paying for 20-40% more SaaS tools than they actually use. That tracks with the industry-wide picture: across more than 40 million licences under management, organisations leave an average of 36% of their SaaS licences unused. This isn't the team's fault - someone buys a tool for a specific project, forgets to cancel it, and two years later it's still billing €50/month to a card nobody checks.

A basic audit takes about two hours:

1. Pull every bank and card statement from the last 12 months. Filter for recurring charges.
2. For each tool: is this used by more than one person, more than once a week?
3. If no: cancel, or replace with something already in your core stack.

Most of the time the cancelled tools aren't even missed - they were already being avoided.

The password friction problem

Password-related issues are the IT problem small business owners are most likely to dismiss as minor. They're not. A poor password setup has three real costs:

• A 10-person team loses an average of 3-5 hours per month on password resets and "can you send me that login" requests.
• Credential abuse is the most pervasive technique across breach chains in Verizon's 2026 breach data, and it is the one a password manager plus MFA closes. Microsoft's own measurement study found MFA cut the risk of account compromise by 99.22%, and by 98.56% even where the password had already leaked. For a small business, a single breach typically costs €10,000-€50,000 in recovery, downtime, and potential fines - the global average across all organisations is far higher.
• Not having a business password manager is a hiring liability - technical candidates notice it.

The fix is straightforward: 1Password Business, Bitwarden Business, or equivalent. Cost: €5-8 per user per month. Implementation for a 10-person team: about 3 hours. The ROI is immediate.

The before and after for a typical 10-person business

Before a proper cloud setup:

• Mix of cloud storage tools, some data on local drives
• Passwords in spreadsheets or personal managers not shared properly
• Software updates patchy and manual
• New device setup takes half a working day
• No tested backup restore process

After M365 Business Premium + Intune + 1Password + Acronis:

• All files in SharePoint/OneDrive, accessible from anywhere, with version history
• Every password in a shared vault, accessible to the right people, not the wrong ones
• Software updates pushed silently overnight through Intune update rings
• New device setup: user logs in, everything installs automatically in 30-45 minutes via Windows Autopilot
• Tested quarterly backup restore with a documented recovery time

The visible change for the team: fewer small annoying problems. The visible change for the owner: fewer calls to the IT provider for things that should just work.

Before the playbook, a five-minute honest comparison. M365 is not automatically the right answer for every small business.

Choose Microsoft 365 if:

• Your team is primarily on Windows devices
• You work in a regulated industry - finance, legal, healthcare - where Outlook and Excel are standard
• You need device management across multiple locations (Intune is genuinely better than Google's MDM for this)
• You have existing Microsoft infrastructure to migrate from

Consider Google Workspace instead if:

• Your team is fully remote, mostly on Macs, and already lives in Google Docs
• You have under 10 people and want the simplest possible setup
• Real-time collaborative editing matters more than Outlook features

The hybrid reality: some businesses use M365 for security and device management alongside Google Docs for specific workflows. This works but adds cost and complexity. Standardise on one platform if you can.

Before you start: the checklist nobody gives you

The most common reason migrations go wrong isn't technical complexity - it's skipping the pre-migration audit. Before any migration work begins, confirm all of the following:

Domain and DNS:

• Your domain is registered in your business's name, not your IT provider's
• You know who controls your DNS records (usually your domain registrar)
• You have access to the domain registrar account with 2FA enabled

Email inventory:

• List every mailbox: individual users, shared mailboxes (billing@, info@, hello@), and service addresses
• List every alias - multiple email addresses routing to the same inbox
• Confirm whether mailboxes have calendar or contact data that needs migrating

Existing data:

• Where are your files currently? Local drives, a NAS, Dropbox, Google Drive?
• Do these files need migrating, or can your team start fresh in SharePoint?
• Is there a verified backup of everything before the migration starts?

Licences:

• Decide on the M365 tier. For most small businesses: Business Standard (email + Office apps) or Business Premium (everything + Intune + Defender). Business Premium is worth the extra €8/user/month if you want device management.
• Count exact users. You can add licences as you grow - don't over-provision.

Timing:

• Avoid migrations at month-end, during your busy season, or the week before a major deadline.
• Allow 3-4 weeks minimum.
• Plan the DNS cutover for a Friday afternoon - that gives you the weekend for any surprises.

The week-by-week plan

Week 1: Tenant setup and security baseline

Your new M365 tenant is configured before a single email is moved:

• Create the tenant and add your domain
• Create all user accounts (without licences yet)
• Enable MFA for all users
• Apply Conditional Access policies
• Set up shared mailboxes and aliases

By end of Week 1: every user can log into M365 and access OneDrive and Teams. Email is not yet pointing here.

Week 2: Data migration

Files first, email second:

• Migrate shared file storage from current location to SharePoint
• Set up Teams channels - start simple, a few channels, not 40
• Run a 30-minute team walkthrough: where files live and how to access them

Email migration runs in the background via Microsoft's native tools or BitTitan. The old email system stays live throughout this week.

By end of Week 2: files are in SharePoint, email is syncing quietly, old system still active.

Week 3: Device setup (Business Premium / Intune only)

• Enrol Windows devices into Intune
• Push configuration profiles: encryption, password policies, automatic updates
• Configure Windows Autopilot for any new or replacement devices
• Enrol Macs via Apple Business Manager if needed
• Test remote wipe and lock on a spare device

Week 4: DNS cutover

The only irreversible step:

• Update the MX record to point to Microsoft
• Update SPF, DKIM, and DMARC records
• Test send and receive from Outlook, iPhone Mail, and all shared mailboxes
• Monitor for 24 hours before declaring success

If anything goes wrong: the DNS change is reversible in minutes. Migrated email stays in M365 regardless.

After a clean 24 hours: decommission the old email platform.

Industry-average downtime vs how this plan is run

It is worth knowing what "normal" looks like before you accept it. CompTIA's cloud and IT operations research consistently finds that unplanned downtime and underestimated migration complexity are among the top reported causes of cloud project overruns for small and mid-sized firms - the typical small-business email migration handled without a plan loses somewhere between half a day and two full days of mail flow, usually at DNS cutover.

The plan above is built to make that zero. Mailboxes are pre-synced and kept syncing while the old system still receives mail, so at cutover the only thing that changes is where new mail is delivered. Nothing is deleted from the source until the target has been verified. If the cutover goes wrong, the MX record points back and you are where you started. Users keep working throughout; the perceptible change for them is signing into Outlook once.

The three mistakes that cause downtime

All three are sequencing failures rather than technical limits, and Microsoft documents the order that avoids them: mailboxes ready and synced first, DNS changed second, delta sync last.

Mistake 1: Cutting DNS before enabling MFA If email points to M365 before MFA is active, every account is exposed with just a password. Security baseline first, DNS cutover second - always.

Mistake 2: Forgetting shared mailboxes The billing address, the info@ account, the support inbox - these get missed in almost every migration. Document every shared mailbox before you start.

Mistake 3: No backup before cutover Before touching DNS: confirm (a) you have a recent export of existing email, and (b) your backup solution is running on the new tenant. Migration mistakes are recoverable with good backups. Without them, they're not.

What to expect from your IT provider

If a managed IT provider is running this migration for you, here is the minimum standard:

• A written pre-migration checklist, shared with you, before anything starts
• You hold all admin credentials - the provider administers them, not owns them
• You're notified before any DNS change is made, not after
• A tested backup restore before cutover
• Post-migration monitoring for at least 48 hours
• Written handover documentation showing how everything is configured

If your provider won't give you these, that's worth knowing before the migration starts - not after.

Most small business owners frame this as "outsourcing is cheaper at small sizes; hiring is cheaper at scale." That's roughly true but misses the actual decision criteria. The real question isn't cost - it's about what kind of IT work your business needs and how predictable that work is.

Get that right and the cost picture follows.

What outsourced managed IT is actually good at

Outsourced managed IT (a provider like ours, or any of the dozen others in your country) is genuinely better at:

• Breadth of expertise. One provider has hands-on experience with M365, Google Workspace, Acronis, 1Password, Intune, multiple firewalls, multiple compliance frameworks. No one IT hire has all of that on day one.
• Tooling and process. Established providers already have monitoring tools, backup infrastructure, ticketing systems, and documented playbooks. A first IT hire needs to build all of that.
• Coverage during absence. Holidays, illness, parental leave - covered. A solo IT person creates a single point of failure.
• Buying power. A provider managing 50 small businesses negotiates better Microsoft pricing, gets faster Microsoft support escalation, and gets early access to product roadmaps.

What an in-house IT person is actually good at

In-house IT (whether a dedicated hire or a hybrid role) is genuinely better at:

• Deep business context. They sit with your team, attend your meetings, and understand your industry. A provider knows your systems; an in-house person knows your business.
• Speed for small things. "My screen is flickering" is solved in 5 minutes by someone in the office, vs a ticket for a provider.
• Cross-functional integration. Connecting your IT to your specific operations workflows, accounting systems, or industry-specific software is much easier with someone who lives the business.
• Ownership of internal processes. Onboarding playbooks, internal documentation, training materials - these benefit from a permanent person who maintains them.

The honest cost comparison

One correction to make before any comparison: salary is not the cost of a hire. Employer social contributions and other non-wage costs add a substantial share on top of gross pay across Europe, and Israeli wage benchmarks need the same treatment. Fully loaded, an in-house hire is typically 1.3-1.5 times the headline salary before you account for cover during absence.

For a 25-person business in Israel and across Europe:

Outsourced managed IT is one line: EUR 2,000-3,000 a month, all-in, covering licences, security, backup, support, monitoring, vendor management and projects under a certain size. An in-house hire is four lines, and only the first one gets quoted.

That's roughly 2-3x the cost of outsourcing for a 25-person business. The breakeven point - where in-house starts to make financial sense as your only IT - is generally around 60-80 people, depending on your industry's complexity.

The hybrid model (often the right answer)

For most growing small businesses, the cleanest path isn't either/or - it's outsourced + a non-IT person who owns the IT relationship internally. This typically means:

• Your office manager, head of operations, or COO owns the IT relationship from your side
• An external managed IT provider handles all technical work
• The internal owner spends maybe 4-6 hours a week on IT-related coordination
• This works cleanly until you're around 50-80 people

When you do hire your first dedicated IT person - typically around 50-80 people - keep the managed IT relationship for the first 6-12 months while they get up to speed. Don't replace your provider on day one of the new hire's job.

When in-house clearly wins

Some specific situations where hiring beats outsourcing earlier than the cost numbers suggest:

• You build software products with regulatory requirements. Fintech, medtech, or government-adjacent SaaS often need someone embedded who understands both the product and the compliance regime.
• You're a target for sophisticated attacks. Some industries (defence, finance, certain professional services) need a security person on staff, not one on call.
• You have unusual operational technology. Manufacturing floors, broadcast systems, scientific instruments - these need specialist hands that managed IT generalists don't have.

When outsourcing clearly wins

And the inverse - situations where outsourcing is the obvious right answer regardless of size:

• You're under 25 people. The math just doesn't support a full-time IT hire.
• You operate across multiple countries with the same team. A provider with multi-country regulatory experience beats hiring one person who has to learn three regimes.
• You need predictable monthly costs. A managed contract is a fixed line item; a dedicated hire's salary and unpredictable hardware/license costs are variable.
• You can't afford to lose IT continuity for a single person's holiday. A solo hire creates risk; a provider has team coverage.

How to decide

Walk through these questions, in order:

1. Are you under 25 people? → Stay outsourced.
2. Are you in a regulated or technical industry where specialist context matters? → Consider hiring earlier.
3. Are you between 25-60 people with predictable IT needs? → Hybrid model: outsource + internal owner.
4. Are you 60+ people? → Hire your first IT person, keep the provider for 6-12 months overlap.
5. Are you 100+ people? → Build a small in-house team, retain a provider for specialist projects.

There's no universal right answer. There is a right answer for your business, and it usually emerges clearly from these questions.

Switching managed IT providers is genuinely scary because the outgoing provider holds the keys to everything: your domain, your email, your backups, your cloud accounts. Stories of providers refusing handover, holding data hostage, or "accidentally" wiping configurations are common - and they keep small businesses stuck with bad providers far longer than they should be.

The good news: the law (in the EU, Israel, and most jurisdictions) is on your side, and a clean handover is entirely doable in 4-6 weeks if you plan it properly. This article walks through that plan.

What you actually own (and what you don't)

The first question to settle is whether your Microsoft 365 tenant is yours. It should be: a provider normally holds delegated administrative access to your tenant, which can be granted and revoked, and you should be able to see and control the Global Administrator accounts yourself. If instead your licences sit inside the provider's own tenant, your data lives somewhere you do not control and moving it is a tenant-to-tenant migration rather than a handover.

Before you start a switch, get clear on ownership. In most setups for a small business, you own:

• Your domain name (registered in your business's name)
• Your Microsoft 365 or Google Workspace tenant (paid for in your business's name)
• Your data inside those tenants (email, files, calendars)
• Any business accounts paid by your business (Acronis, 1Password, etc.)

Your provider should be administering these - not owning them. If your domain is registered in their company name, or your M365 tenant is on their billing, that is a structural problem you need to fix immediately, regardless of whether you switch.

This is a service transition, and there is a standard for it

Changing provider is not an IT chore; it is a service transition, and the ITIL 4 framework has a defined practice for exactly this - service transition covers moving a service between providers or environments with continuity of knowledge, assets and support. Two of its principles are worth borrowing even if you never read the rest:

• Knowledge transfer is a deliverable, not a courtesy. Documentation, credentials, network diagrams, vendor contacts and the list of known quirks are artefacts your outgoing provider owes you. Put them in the plan with dates.
• Run a period of overlap. ITIL calls it early life support. In practice: the new provider is live and the old contract has not been terminated, for two to four weeks, so anything undiscovered surfaces while someone who knows the history is still reachable.

The four-week plan below is that practice, sized for a business of 10 to 50 people.

The 4-week switch plan

Week 1: Audit and document

Before notifying your current provider, document everything you can on your own:

• Every business account and where the credentials live
• Every domain you own and where it's registered
• Every device that's managed (laptops, phones, servers)
• Every backup that's running and where backups are stored
• Every recurring invoice you pay for IT-related services

Your new provider will work from this list.

Week 2: Notify and request handover

Notify your current provider in writing. Reference your contract's termination clause (most managed IT contracts require 30-60 days notice; if yours doesn't say, 30 days is the legal default in most EU jurisdictions). In the same notice, formally request:

• All admin credentials for every system they manage
• All API keys, certificates, and recovery codes
• All documentation and runbooks
• Confirmation of where backups are stored and how to access them
• A list of any third-party services they manage on your behalf

Under GDPR (and Israeli privacy law equivalents), you have a legal right to your data. A provider refusing to hand it over isn't being awkward. It's breaking the law.

Week 3: Parallel run

This is the safest pattern: have both providers active for one week. Your new provider takes over administration of email, devices, and backups. Your old provider remains active in case anything was missed. Don't skip this week.

Week 4: Cutover and decommission

Once the new provider has confirmed everything is migrated and tested, formally decommission the old provider:

• Remove their admin access from every system
• Rotate any shared credentials
• Confirm in writing that they no longer hold any of your data
• Final invoice and contract closure

Red flags during a switch

Some behaviour from an outgoing provider goes past frustrating. Treat it as a warning:

• Refusing to provide credentials in writing ("we'll just transfer them when needed")
• Charging an "exit fee" that wasn't in your contract
• Claiming they own your domain or M365 tenant
• Disabling services or "accidentally" deleting accounts during handover
• Slow-walking responses past your notice period

If any of these happen, document everything in writing and escalate. In the EU, your data protection authority will take complaints seriously when a provider obstructs lawful data access. Your incoming provider should also know how to handle these - that's part of why you hire them.

What a good handover looks like

A clean switch ends with:

• You hold every admin credential, in your password manager, in your name
• You have written documentation of how everything works
• Your new provider has tested every critical system (email send/receive, backup restore, login from a new device)
• The old provider has confirmed in writing they no longer have access
• You haven't lost a single email, file, or working hour

That's the bar. It's achievable. Don't accept less.

Two things to note before the numbers. Vendor list prices moved in 2026 - Microsoft raised Business Basic and Standard on 1 July, and Google's Workspace tiers were repriced as AI features were folded in - so budget for annual increases rather than a flat line. And a slice of most IT budgets is waste rather than cost: across organisations measured by Zylo, 36% of SaaS licences sit unused.

Most managed IT providers - including ours - refuse to publish prices. Their reasoning is fair: every business is different, and a single number would either rip off the simple ones or undersell the complex ones. The problem is that small business owners are then stuck Googling "managed IT cost" and finding either generic ranges or sales pages.

This article fixes that. Below are real spending bands by business size, broken down by line item, based on what we see across small businesses in Israel and across Europe in 2026.

Where our numbers come from

So you can weigh them: the ranges below come from three places, and we say which is which. First, our own quoted and delivered engagements in Israel and Europe over 2024-2026 - that is a sample of dozens, not thousands, and it is skewed toward businesses that wanted managed IT enough to ask. Second, published industry benchmarking: Kaseya's annual MSP benchmark survey and Datto's SMB-focused research both report per-seat pricing distributions across thousands of providers, and our numbers sit inside their middle bands rather than at either extreme. Third, the licence components are list prices published by the vendors, which anyone can check.

Where our figures differ from the global surveys, it is usually because those surveys are US-weighted and per-seat pricing there runs higher. Treat every number as a planning range, not a quote.

The honest baseline: managed IT for a 10-person business

For a typical 10-person small business - a law firm, an accountancy, a SaaS startup, an agency - here is what a complete managed IT setup actually costs in 2026, before any negotiation:

That is the realistic range for "everything in" - licenses, security, backups, support, and someone managing it all. If a quote comes in dramatically lower than this for the same scope, ask what's missing (usually backup or active monitoring). If it comes in dramatically higher, ask why.

Scaling up: 25-person business

For a 25-person business, costs do not scale linearly because some things (the management overhead, the backup infrastructure, the security baseline) are largely fixed. Typical 2026 ranges:

That works out to €80-€125 per user per month, all-in. Anything below €60 per user per month for a setup of this size is almost certainly missing something material.

What's not in these numbers

These ranges cover ongoing operations. They do not include:

• One-time setup or migration costs. A Microsoft 365 migration for a 10-person firm typically runs €1,500-€5,000 as a fixed-price project.
• Hardware. Laptops, firewalls, network gear procured separately. Most providers should pass these through at distributor pricing without mark-up.
• Out-of-scope project work. A new ISO 27001 audit, a major office network rebuild, an acquisition integration - quoted separately.

A common mistake small business owners make is comparing a provider's monthly fee in isolation. The right comparison is total annual spend including all licenses, projects, and surprise invoices - and that's where opaque providers tend to get expensive.

Country-specific notes

• Greece: Costs are very close to the EU baseline. The main premium comes from the small pool of GDPR-experienced providers, not the licensing.
• Israel: Microsoft and Google both bill in USD or EUR; with shekel exchange volatility, locking in annual pricing is worth doing. Local cybersecurity insurance increasingly requires EDR (Microsoft Defender or equivalent) which is included above.
• Spain: AEPD's enforcement of LOPD-GDD adds a small premium for compliance documentation work but doesn't change ongoing license costs. NIS2-impacted businesses see €100-€300/month uplift for the formal documentation and reporting requirements.

What you can do with this information

1. Audit your current spend. Add up everything: licenses, security tools, backup, your IT person/provider, hardware leases. Compare it to the bands above. If you're significantly higher with no clear reason, you're being overcharged or paying for things you don't use.
2. Check what's bundled vs separate. A "low" managed IT fee that doesn't include backup or security tools isn't actually low - you'll pay for them anyway.
3. Ask for itemised invoices. Any reputable provider will give you a per-user, per-tool breakdown. If yours won't, that's information.

Traditional antivirus works by comparing files against a database of known threats. It scans files as they arrive and blocks the ones it recognises.

The problem: modern attacks don't use files your antivirus has seen before. The attacks actually being used against small businesses in Israel and across Europe in 2026:

• Phishing links that redirect to fake login pages - no malicious file involved
• Hijacked legitimate Windows processes - Windows' own tools run malicious commands
• Valid stolen credentials - an attacker logs in normally; antivirus sees nothing suspicious
• Time-delayed links - a URL in an email appears safe when delivered, redirects to malware 12 hours later

None of these involve a recognisable malicious file. None of them trigger traditional antivirus. All of them are routine in 2026.

Signature-based antivirus vs EDR, in neutral terms

This distinction matters regardless of which vendor you end up buying from:

• Signature-based antivirus (the old model) compares each file against a list of known-bad fingerprints. If the file is not on the list, it is allowed. It is a file-centric, list-driven control.
• EDR - Endpoint Detection and Response (the modern model) records what processes actually do on the device - what they launch, what they read, where they connect - and flags or reverses behaviour that matches known attacker techniques, whether or not a file is involved. It also keeps a timeline so you can answer "what else did this touch?" after the fact.

The techniques EDR is built to catch are catalogued publicly in the MITRE ATT&CK framework - credential dumping, living-off-the-land use of built-in Windows tools, lateral movement. Almost none of them require the attacker to drop a file that a signature engine would recognise.

And this is not a "trust Microsoft" argument. Independent labs test endpoint products against live malware every month and publish the raw results: AV-TEST's certification rounds and AV-Comparatives' Real-World Protection tests both consistently place Microsoft Defender in the top tier for protection rate. Check the current round yourself before you buy anything - including this.

It is worth being specific about how incidents actually begin, because it decides where the money goes. In Sophos's 2026 ransomware survey, malicious email and phishing together accounted for half of all incidents.

That is the case for treating endpoint protection and email protection as one decision rather than two purchases.

What Microsoft Defender for Business actually does

Defender for Business - included in Microsoft 365 Business Premium for up to 300 users - is a different category of tool. It does not scan files against a database. It monitors the behaviour of every process on every managed device, correlates signals across your entire environment, and responds automatically when something looks wrong.

The practical difference for a small business

Without EDR: You find out about a breach when something stops working - files are encrypted, an invoice was redirected, or a client calls to say they received a suspicious email from you. By then, the attacker has had hours or days inside your systems.

With Defender active: You see the attack at the reconnaissance stage - an unusual login from an unexpected location, a process accessing more files than it should, a device attempting to connect to a known malicious IP. The difference between catching a threat at stage 1 vs stage 5 is typically €10,000-€50,000 in recovery costs.

When Defender detects a compromised device, it automatically:

• Isolates the device from the network while keeping it manageable via Intune
• Kills the malicious process and quarantines affected files
• Investigates which other devices the threat may have reached
• Generates a full incident report for insurance and regulatory purposes

For a 10-person business with no dedicated security staff, this is the equivalent of having a security analyst watching your systems continuously.

What "included in M365 Business Premium" means in practice

Defender for Business is included in Microsoft 365 Business Premium at approximately €22/user/month. For a 10-person team, that is €220/month for email, Teams, Office apps, Intune device management, and enterprise-grade EDR.

Standalone EDR tools from dedicated security vendors typically cost €15-30 per device per month on top of your productivity suite. Getting the same capability bundled into M365 Business Premium is one of the clearest cost advantages of that tier.

The configuration gap most businesses miss

Defender at default settings blocks known malware, but several of the controls that stop real attacks ship switched off - most attack surface reduction rules are opt-in until you enable them, and automated remediation needs configuring. A business that "has Defender" but has not configured it gets materially less than it is paying for. The configuration that matters:

• Attack surface reduction rules enabled - blocks Windows features most commonly exploited in SMB attacks
• Cloud-delivered protection set to maximum - enables real-time sharing with Microsoft's global threat intelligence network
• Automated investigation and remediation set to Full - allows Defender to respond without waiting for human approval
• Tamper protection enabled - prevents malware from disabling Defender itself
• Microsoft Secure Score baseline applied - brings all settings to Microsoft's recommended minimums for business use

Small business owners asking "Google or Microsoft?" are usually really asking one of three things:

1. "We're starting fresh - which platform should we build on?"
2. "We're on one platform and it's not working - should we switch?"
3. "Our team uses a mix of both - should we consolidate?"

This article answers all three. The honest summary: for most small businesses in Israel and across Europe, Microsoft 365 Business Premium is the better fit - but Google Workspace is a genuinely good choice in specific situations, and a hybrid approach sometimes makes sense.

The feature comparison

Note what that table is and is not comparing: Google Workspace Business Standard against Microsoft 365 Business Premium, because that is the pairing most small businesses actually weigh up. Tier for tier, the two vendors have converged on identical list prices.

Which means price is not the deciding factor. What each tier includes is.

Comparing them on independent ground

Two things are worth stating before the recommendations, because we are a Microsoft and Google partner and you should discount our opinion accordingly. First, both vendors sit in the Leaders quadrant of Gartner's Magic Quadrant for unified communications as a service and appear as leaders across the collaboration categories - neither is a weak product, and analyst positioning does not separate them meaningfully at small-business scale. Second, the differences that do matter are technical and checkable:

If your fleet is ChromeOS and Android, Google's management story is the stronger one and the table above inverts. If it is Windows, Intune has no real counterpart. That is the substance of the decision - not which word processor you prefer.

When Google Workspace is the right answer

• Your team is primarily on Macs and already uses Google Drive/Docs for everything
• You're under 10 people and want the simplest possible setup
• Real-time collaborative document editing is your primary workflow
• You don't need device management - everyone uses personal or company-managed devices through a different system

When Microsoft 365 is the right answer

• Your team is primarily on Windows
• You need device management (Intune is substantially more capable than Google's MDM at this)
• You're in a regulated industry - finance, legal, healthcare, accounting - where Outlook and Excel are expected
• You want a single platform for email, security, device management, and backup (with Acronis added)
• You need advanced email security (Defender for Office 365 is a level above Google's filtering)

The device management difference

This is the most important practical difference for small businesses: Microsoft Intune is significantly more capable than Google's MDM for managing Windows devices.

If your team is on Windows and you need to enforce encryption, push software, manage updates, or configure security policies remotely, M365 Business Premium with Intune is the clear choice. Google's own endpoint management covers Windows, macOS, ChromeOS and mobile, and is genuinely sufficient for a Chrome or Mac-first team. Google's MDM works well for Android and has reasonable Mac support, but Windows management via Google is limited.

The hybrid approach

Some businesses use M365 for security and device management while keeping Google Workspace for specific workflows (e.g., a design team that lives in Google Slides). This works, but it adds cost (you're paying for both platforms) and complexity (two admin consoles, two identity systems to manage). Standardise on one platform unless you have a specific reason not to.

Migrating from one to the other

Switching platforms is disruptive but manageable. A 10-person migration typically takes 3-4 weeks and costs €1,500-€5,000 in provider fees, depending on how much historical data needs migrating. The time to switch is before you grow, not after.

Start with the measured picture rather than the anecdote. Credential abuse is the most pervasive technique across breach chains in Verizon's 2026 data, and infostealer data in the previous edition found that, in the median case, only 49% of a user's passwords were distinct from each other. Over 97% of the identity attacks Microsoft sees are password attacks.

The majority of security incidents at small businesses don't involve sophisticated hacking. They start with one of three things:

1. A reused password - someone uses the same password across personal and business accounts. One unrelated breach exposes it.
2. A shared login sent over email or Slack - the credentials exist in an unencrypted channel that could be compromised.
3. A weak password on an admin account - a system that's supposed to have complex passwords uses something guessable.

None of these require an attacker to be clever. Automated tools scan known breach databases and attempt logins continuously. If your credentials are in any of those databases, your accounts are being tested.

What a business password manager actually does

A business password manager like 1Password Business is different from a personal password manager in three important ways:

1. Shared vaults with access control You can give a team member access to a set of credentials without them ever seeing the actual password. If they leave the company, you revoke their vault access and rotate the credentials - they can't take the passwords with them.

2. Visibility into your security posture 1Password's Watchtower feature tells you which employees are using weak passwords, which passwords have appeared in known breach databases, and which accounts don't have two-factor authentication enabled. This is information most small businesses have no way to see otherwise.

3. SSO integration Your team logs into 1Password once. 1Password handles authentication for Slack, Jira, your accounting software, your CRM, and dozens of other business tools. One strong master password replaces the mental load of managing dozens of accounts.

Why forcing a password change every 90 days makes things worse

This is the single most common piece of outdated advice still baked into small-business IT policy. NIST's Digital Identity Guidelines are explicit: verifiers should not require memorised secrets to be changed arbitrarily or periodically, and should only force a change when there is evidence of compromise. The UK's NCSC reached the same conclusion and tells organisations to drop regular expiry outright.

The reason is behavioural, and it is well measured. When people are forced to rotate, they do not invent a new strong secret twelve times a year - they iterate a weak one (Summer2025!, Summer2026!), write it down, or reuse it elsewhere. Rotation policy converts one strong password into a predictable series of weak ones, and it trains staff to treat security controls as bureaucracy.

What to do instead, per the same guidance: long unique passphrases, screened against known-breached password lists, never expired on a schedule, always changed immediately on any sign of compromise - and MFA on top. A password manager is what makes that policy realistic, because nobody memorises 60 unique 20-character secrets.

The real cost of not having one

For a 10-person business, a single business email compromise incident typically costs:

• €3,000-€30,000 in direct financial loss (fraudulent transfers, customer notification, legal)
• 2-5 days of disruption
• Reputational damage that's harder to quantify

1Password Business costs approximately €6-8/user/month - about €720-960/year for a 10-person team.

The break-even on preventing a single incident is months, not years.

What implementation actually looks like

Rollout for a 10-person team takes approximately 3 hours:

1. Create the business account and configure vaults by team/role
2. Import existing passwords from browsers or CSV exports
3. Deploy the browser extension to all devices (via Intune or manual install)
4. 10-minute walkthrough per employee - most people are comfortable within a day

The most common obstacle isn't technical - it's getting people to stop using browser-saved passwords. Intune can block browser password saving, which creates the right default behaviour automatically.

When a small business grows past 5 people, device management becomes a real problem. You have laptops in different locations, phones accessing company email, and no way to know whether they're all encrypted and up to date.

The typical response is one of three things:

1. Nothing - hope for the best, deal with problems when they happen
2. Manual IT visits - expensive, slow, doesn't scale
3. A contracted IT person - costly, and they can only be in one place at a time

Microsoft Intune is the fourth option: a cloud-based device management platform that lets you control every company device from a single dashboard, regardless of where those devices are.

What Intune actually does

Intune sits between your devices and your company's cloud accounts. When a device tries to access Microsoft 365 email, Teams, or SharePoint, Intune checks whether that device meets your security requirements first.

Patch speed is the reason this stops being administrative housekeeping and becomes a control. Mandiant measured the average time from disclosure to exploitation in the wild falling from 63 days in 2018-19 to 5 days in 2023.

Its 2026 report puts the mean at negative seven days - exploitation routinely happening before a patch exists. A monthly manual patch round cannot meet that; an automated update ring can.

What you can enforce from the Intune console:

• BitLocker disk encryption - automatically enabled on all Windows devices
• Password policies - minimum length, complexity, lockout after failed attempts
• Windows Update rings - devices automatically install updates within a defined window, not whenever the employee gets around to it
• App deployment - push approved software to every device silently
• Conditional Access - block login from unmanaged or non-compliant devices

What you can do when something goes wrong:

• Remote lock - lock a device immediately if it's lost or stolen
• Remote wipe - delete all company data from the device; the employee's personal files remain untouched
• Retire - unenrol a device from management (used when someone leaves the company)

What it costs and what's included

Intune is included in Microsoft 365 Business Premium at approximately €22/user/month. For a 10-person business, that's around €220/month - which also includes Outlook, Teams, SharePoint, OneDrive, Word, Excel, PowerPoint, and Microsoft Defender endpoint protection.

If you need Intune without the full M365 suite (for managing Macs in a Google Workspace environment, for example), standalone Intune Plan 1 licences are available at approximately €8/user/month.

Macs and iPhones, managed the same way

Intune manages Windows, macOS, iOS, and Android. Mac management requires Apple Business Manager integration, which takes a few hours to configure. iPhone and Android management is simpler and covers the key requirements (email profile, remote wipe, VPN if needed).

Most small businesses think they have backups. What they actually have is a scheduled copy job that runs nightly to an external drive or a cloud folder - and hasn't been tested in 18 months.

Why that's a problem in 2026:

Modern ransomware attacks your backups first. Before encrypting your main files, ransomware typically deletes or encrypts your backup locations. If your backup tool is running as an admin process on the same network, the ransomware can reach it.

Your backups are a target, not a bystander. Sophos found backup repositories were targeted in 96% of ransomware attacks and successfully compromised in 76% of those attempts - and organisations whose backups were compromised faced recovery costs around eight times higher than those whose backups survived. A backup an administrator can delete is a backup an attacker can delete.

Untested backups fail when you need them. Corrupted files, changed paths and quiet misconfiguration are discovered at the moment of crisis, not before it. The only way to know your recovery time is to have measured it.

Backup is not recovery. A backup is the file. Recovery is being able to restore that file to a working state, on a working system, within an acceptable timeframe. These are different problems.

The cost of getting it wrong is measurable, and it is not mostly the ransom. Sophos puts the mean cost of recovering from a ransomware attack at USD 1.7 million excluding any ransom paid, driven by downtime, device replacement and lost revenue.

What immutable backups actually mean

An immutable backup is a copy of your data stored in a way that cannot be modified or deleted - not by ransomware, not by an admin who makes a mistake, and not by an attacker who has gained full access to your network.

Immutable and air-gapped are not the same thing

These two words get used interchangeably by providers, and they should not be:

• Immutable means the data cannot be changed or deleted for a defined retention window, even by an account with full administrative rights. The restriction is enforced by the storage layer itself (object lock / write-once-read-many). The copy is still online and reachable - it just cannot be altered.
• Air-gapped means the copy is not reachable from your production environment at all: separate credentials and separate infrastructure at minimum, physically disconnected media in the strictest form. The restriction is enforced by the absence of a path, not by a policy on the storage.

You want both, and for different failure modes. Immutability defeats an attacker who has your admin credentials but is still inside the same platform. An air gap defeats an attacker who has compromised the platform or the backup console itself. A vendor claiming "immutable, air-gapped backup" for a single online repository is describing one control and charging for two.

That distinction is not academic. Veeam's ransomware research consistently finds that attackers attempt to destroy backup repositories in the large majority of incidents, and that recovery success tracks closely with whether at least one copy was beyond the attacker's reach.

Acronis Cyber Protect achieves this through:

• Write-once storage: Once written, backup data cannot be overwritten for a defined retention period (typically 30-90 days). Offline, encrypted and immutable copies are exactly what CISA's ransomware guidance asks for
• Air-gapped replication: A copy exists in a physically separate cloud infrastructure that your main environment cannot directly access
• Behavioral detection: Monitors for file encryption patterns and pauses suspicious processes before they can reach the backup vault

The practical result: even if ransomware fully compromises your primary environment, yesterday's clean backup is untouched and restorable.

What "instant restore" actually means for a 10-person business

For a 10-person business with 2TB of data:

• Full system restore from Acronis: typically 2-4 hours
• Individual file recovery: minutes
• "Bare metal" restore to a replacement device: 4-8 hours

Without immutable backups, a ransomware incident typically costs 3-10 days of disruption plus the recovery fee (often €5,000-€20,000 for professional data recovery, if it's even possible). With tested immutable backups, it's a bad morning - not a business-ending event.

What this costs

For a 10-person business: €100-€200/month for Acronis Cyber Protect Cloud, including:

• Daily backups of all devices and Microsoft 365 data
• 90-day immutable retention
• Quarterly restore test support
• Replication to a secondary data centre

That's €1,200-€2,400/year to protect against an incident that typically costs €10,000-€50,000 when it happens.

A site foreman opens a PDF on a phone, checks the wall dimension, and starts marking out. The PDF looks right. It has the project name, the date in the corner, the architect's stamp. What it does not have is any reliable way to tell whether it is the drawing the architect issued this morning after the client asked for a doorway to move, or the one from three weeks ago that a subcontractor forwarded to a WhatsApp group because it was the file they happened to have.

This is not a technology story about hackers or ransomware. It is a plumbing story: too many copies of the same document, no single place that is unambiguously current, and a mobile-first crew that has every reason to open whatever file loads fastest. Small construction firms in Israel, Greece and Spain run on exactly this pattern - a project folder on someone's laptop, a shared drive nobody fully trusts, a chain of email attachments and phone messages that outpaces any of them.

Why the newest file is not always the one on site

Three things make construction drawings unusually prone to version confusion compared with an ordinary office document.

First, drawings change constantly and legitimately. A structural detail, an MEP clash, a client change order - each produces a new revision, and a live project can go through dozens of revisions on a single sheet before completion. Second, distribution happens over channels that were never built for document control. Email attachments and WhatsApp messages are point-to-point: the moment a file leaves the sender's device, there is no link back to the source, no way to push an update to everyone who received the earlier copy, and no record of who has which version. Third, the people who most need the current drawing - the crew physically on site - are the ones furthest from wherever the "real" file lives, connecting from a phone or tablet with patchy signal, often outside working hours when nobody is around to double-check.

Put together, these three conditions mean a firm can have a perfectly disciplined design office and still see rework on site, because the discipline stops at the point the file is emailed or forwarded. The problem is not that anyone is careless. It is that sharing a copy and controlling a version are two different things, and most small firms only have tooling for the first one.

What GDPR's storage and accountability rules already require of you

This matters beyond scheduling and cost. If any of the documents in that WhatsApp thread or email chain include personal data - a subcontractor's ID number, a homeowner's address and contact details, site photos that show individuals - the firm is a data controller under the GDPR the moment it processes that information, and Article 5 sets out principles that a scattered set of forwarded files makes hard to meet: data must be kept for no longer than necessary, and the controller must be able to demonstrate compliance with that and the other principles, not just assert it. A single source of truth with version history and a defined retention period is a more defensible answer to "where is this document and who has seen it" than a search through months of forwarded messages.

The cybersecurity context adds another reason to consolidate. ENISA's 2024 Threat Landscape report found ransomware and threats against data among the leading categories of incident across the EU, drawn from analysis of thousands of publicly reported events. A construction firm's exposure is not the drawings themselves so much as the sprawl of unmanaged copies sitting in personal inboxes and phone storage, each one a copy that can be lost, leaked, or held to ransom independently of any control applied to the "official" copy.

The single source of truth: SharePoint or a common data environment

The fix that matches the size of a 5-50 person firm is not enterprise BIM infrastructure. It is a properly configured document library - in Microsoft SharePoint, which most firms on Microsoft 365 already have, or a construction-specific common data environment (CDE) if the firm's project mix justifies the extra cost. Either way, the principle is the same: one location is the current drawing set, and every other copy - the one on a laptop desktop, the one in an email attachment - is understood by everyone to be a snapshot, not a source.

Construction is not a small corner of the economy this applies to loosely - some 12.1 million people work for SMEs in the construction sector across the EU, more people than in any other sector-size combination except distributive trades and manufacturing. A document control gap that costs a single site half a day of rework is not a rounding error at that scale; it is a pattern repeated across a very large part of the sector's workforce.

Naming and revision conventions

A library is only a single source of truth if a human looking at a filename can tell, without opening the file, what it is and how current it is. A minimal convention that works without training:

• Project code - discipline - sheet number - revision letter - date, for example PRJ04-STR-A101-RevC-2026-03-14.
• Revision letters (A, B, C...) for issued-for-construction changes; numeric suffixes reserved for internal drafts that have not gone out.
• One current folder per discipline, with superseded revisions moved to an archive subfolder rather than deleted, so the history stays intact.

The convention only has value if it is enforced at the point a file is uploaded, which is why the library itself, not personal discipline, has to do the enforcing.

Version history instead of "final_v3_reallyfinal"

SharePoint document libraries keep version history automatically once turned on, so a superseded drawing is never actually gone - it is one click away from the current one, with a timestamp and the name of who uploaded it. That single feature replaces the entire practice of appending "final," "final2" and "use this one" to filenames, which is a symptom of not trusting the system to remember what came before.

Controlled sharing links, not forwarded attachments

External sharing in SharePoint and OneDrive is turned on by default for the whole environment, which means the starting point for most small tenants is more permissive than most owners realise. The fix is not to turn sharing off - subcontractors and clients genuinely need access - but to replace ad hoc email attachments with a link to the live file, scoped to specific people, and where the platform supports it, set to expire once that phase of the project is done. A link always points at the current version; an attachment is frozen the moment it is sent.

Mobile access that still points at the source

The crew on site needs the drawing on a phone or tablet, which is exactly the use case a document library with a mobile app is built for - the same file, the same link, the same version history, viewed from a smaller screen rather than duplicated into a separate copy. The discipline to enforce is simple: nothing gets forwarded as an attachment once it is in the library; it gets shared as a link, even from a phone, even in a hurry.

Backup and retention that match how long a project actually matters

A construction project's document trail outlives the build. Warranty periods, defect liability windows and disputes over what was actually specified can all reach back years after handover, and GDPR's storage limitation principle requires a defined retention period rather than an indefinite one, in either direction. Two decisions belong on paper before the first drawing goes into the library: how long the project archive is retained after handover, and where the backup lives that is independent of any single laptop or phone.

What changes on site once this is in place

None of this requires a construction firm to become a software company. It requires a decision about where the current drawing lives, a naming convention that survives being read on a five-inch screen in bright sunlight, and a habit of sharing a link instead of a file. The firms that make this switch do not eliminate every source of rework - bad weather and late deliveries are still bad weather and late deliveries - but they remove the specific, entirely preventable version of rework where the crew built to spec, just the wrong spec.

Frequently asked questions

This is a technical implementation guide, not legal counsel. We configure the systems that support compliance - retention, access control, audit logs, data residency. We do not give legal advice, and nothing below should be treated as it. For a formal position on your obligations, use a qualified data protection lawyer or DPO in your jurisdiction.

Most small business owners in Israel and across Europe know they need to be "GDPR compliant" - but the actual requirements are buried in legal language, and most consultants either oversimplify or overwhelm. This article cuts through both.

The short version: if you hold personal data about clients, employees, or contacts anywhere in the EU, GDPR applies. If you're in Israel, the Privacy Protection Law applies. If your business connects to EU customers from Israel, GDPR also applies - Article 3 makes the regulation extraterritorial, so being registered outside the EU is not an exemption. None of these require expensive certification - they require documented processes and sensible IT hygiene.

What each country actually requires

For most 5-50 person businesses, GDPR compliance comes down to six concrete things:

1. Know what personal data you hold and where it lives
2. Have a privacy policy on your website
3. Get proper consent before adding people to mailing lists
4. Have a process to respond to "delete my data" requests within 30 days
5. Know what to do if you have a data breach (you have 72 hours to notify your DPA)
6. Have a data processing agreement with any vendor that handles your client data (Microsoft, Google, Acronis all provide these)

Enforcement is the part small business owners tend to discount, on the assumption that regulators only pursue large technology companies. The annual totals say otherwise: fines have settled into a steady rhythm rather than tailing off.

NIS2 is the other law worth checking rather than assuming. It generally applies to organisations with 50 or more staff or over €10M turnover operating in one of its listed sectors, and it splits them into essential and important entities with different supervision and different penalty ceilings. The term that trips people up is "significant incident". It is not a matter of interpretation - NIS2 Article 23 defines it, and an incident is significant when it has caused or is capable of causing severe operational disruption or financial loss to the entity, or has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. The same article sets the reporting clock: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month. ENISA publishes plain-language implementation material for smaller in-scope organisations, and for baseline GDPR work the Commission-funded gdpr.eu checklist is the most usable starting point we have found for a small team. In Israel, the Privacy Protection Authority publishes its own binding directives and guidance following Amendment 13.

Below those thresholds you are usually caught a different way - as a supplier to somebody who is in scope, because supply-chain security is an explicit obligation they have to pass down to you.

The technical setup that covers most of the requirements

The good news: if your IT stack is already properly configured, you're likely compliant on the technical side without additional effort. "Properly configured" means:

• Microsoft 365 or Google Workspace with data residency set to EU (for businesses in the EU) - this covers GDPR's data location requirements
• Encryption at rest and in transit - both platforms do this by default when configured correctly
• Access controls - only the right people can see sensitive data. Intune's Conditional Access and 1Password's vault separation make this manageable
• Backup retention policies - Acronis lets you set retention periods that align with GDPR's data minimisation principle
• Audit logging - Microsoft 365's audit log records who accessed what data and when

What most small businesses are missing isn't the tooling - it's the documentation. A regulator doesn't care that you use good software; they want to see that you know what data you hold, why you hold it, and what you'd do if something went wrong.

The 2026 checklist for small businesses

For EU-based businesses (GDPR):

1. Privacy policy published on your website - reviewed in the last 12 months
2. Cookie consent implemented correctly (a "close" button without accepting is not valid consent)
3. Data processing agreements in place with all vendors handling your client data
4. Breach response procedure documented - who you call, what you file, when
5. Data residency confirmed for your Microsoft 365 or Google Workspace tenant

For Israel (Privacy Protection Law):

1. Understand which of your databases require DPA registration (most small business databases do not)
2. Classified your databases by security level (Basic, Medium, or High)
3. Have a process for data access and deletion requests
4. If you serve EU clients, apply GDPR requirements to that data too

The threats facing small businesses have changed. Attackers don't need to be sophisticated - they use automated tools that scan thousands of businesses a day looking for the same predictable gaps: weak passwords, unpatched software, no MFA, no email authentication.

The attacks actually hitting businesses in Israel and across Europe in 2026:

None of these require a sophisticated attacker. They're automated. A 10-person accountancy firm in Berlin has the same exposure as a 10-person law firm in Tel Aviv.

If you take one number from this article, take this one: 96% of ransomware victims in Verizon's 2026 dataset were small and medium businesses. And ransomware is not receding - it has grown as a share of all breaches in each of the last three reporting years.

The delivery method has shifted, though, and that matters for where you spend. In Sophos's 2026 survey, malicious email and phishing together accounted for around half of all ransomware incidents - which is why the work below starts with identity and email rather than with anti-malware.

The three layers that do the work

The layering below is not our invention. It is the same baseline that CISA publishes for small businesses in Cyber Essentials and that the Israel National Cyber Directorate sets out in its defence methodology for organisations - identity first, then devices, then recoverable data.

Layer 1: Identity and access control

This is the most important layer, and it is where the evidence is strongest. Microsoft's measurement study of Entra accounts found MFA reduced the risk of compromise by 99.22% across the population, and by 98.56% even for accounts whose password had already leaked. Over 97% of identity attacks Microsoft observes are password attacks - which is precisely the category MFA removes.

• MFA on every account - Google Workspace and Microsoft 365 both include MFA at no extra cost. Enable it for everyone, unconditionally.
• A business password manager - 1Password Business or equivalent. Stops credential reuse and makes phishing attacks harder to exploit.
• Conditional Access - blocks login attempts from unrecognised devices or locations, even with valid credentials.

Layer 2: Endpoint protection

Every device that accesses your data is a potential entry point.

• Microsoft Defender for Business - included in M365 Business Premium. Monitors device behaviour, blocks malicious files, and alerts on suspicious activity.
• Intune device management - ensures every device is encrypted, updated, and compliant before it can access company data.
• Patch management - unpatched software is the second most common attack vector. Intune pushes updates automatically.

Layer 3: The backup safety net

If layers 1 and 2 fail (and occasionally they will), a tested backup is what separates a bad day from a business-ending event.

• Acronis Cyber Protect with immutable storage - ransomware cannot modify or delete these backups even with admin access.
• Tested restores - a backup you've never tested is not a backup. Quarterly restore tests confirm you can actually recover.
• Off-site replication - data stored in multiple physical locations means a single incident (fire, theft, ransomware) cannot destroy everything.

What this costs for a 10-person business

This is not a marketing estimate - these are the actual current pricing ranges for a 10-person business in 2026. The loss figures in the table above are not scare tactics either: IBM's Cost of a Data Breach study puts the global average breach cost in the millions, with the smallest organisations in the study still averaging six figures, and the FBI's IC3 reporting shows business email compromise losses concentrated in exactly the five- and six-figure band. A €5,000-€50,000 recovery bill for a 10-person firm is the optimistic end of that distribution.

Email authentication: the one technical fix most SMBs haven't done

SPF, DKIM, and DMARC are three DNS records that authenticate your email. Without them, anyone can send an email that appears to come from your domain - which is exactly how business email compromise works.

Setting these up takes about 2 hours. Your email provider's documentation covers the exact steps. This is one of the highest-ROI security improvements a small business can make, and it's free.

Most small businesses don't track this number, but it adds up fast. A typical manual device setup for a new hire looks like this:

At €75/hour for IT time, that's €300-€525 per new hire. For a 10-person team that hires 5 people a year, that's €1,500-€2,600 in IT setup time alone - before counting the productivity the new employee loses waiting.

How zero-touch onboarding works

Two vendor mechanisms do the work: Windows Autopilot registers a device to your tenant so it configures itself at the user's first sign-in, and Intune delivers the app set and policies to it without an engineer touching the machine.

With Microsoft Intune + Windows Autopilot, the process changes entirely:

1. You order a laptop from any Microsoft-registered supplier (in Israel and across Europe - they all support Autopilot).
2. The supplier ships it directly to the employee.
3. The employee opens the box, connects to Wi-Fi, and signs in with their company credentials.
4. Everything else happens automatically: Windows configures itself, Office installs, security policies apply, approved apps download.
5. The employee is working in 30-45 minutes - with no one else involved.

Your IT setup doesn't need to be in the same room, the same city, or the same country.

What gets deployed automatically

• Microsoft 365 apps (Outlook, Teams, Word, Excel)
• 1Password browser extension and company vault access
• Endpoint protection (Microsoft Defender, configured via Intune)
• BitLocker disk encryption (transparent to the user)
• Conditional Access policies (enforced at first login)
• Any role-specific software you've packaged in Intune

What happens if the laptop gets lost or stolen

Remote wipe via Intune takes about 30 seconds. The device is locked and all company data is wiped the next time it connects to the internet. The employee gets a new device, signs in, and is back to their full setup within an hour.

The same setup works for Macs

It runs through Apple Business Manager - the Apple equivalent of Windows Autopilot. Setup is similar: you enrol your Apple Business Manager account with Intune, and new Mac purchases from any Apple Authorised Reseller in your country go through the same zero-touch process.

The Mac setup process is slightly more involved than Windows Autopilot (Apple's MDM profile system works differently), but the end result is the same: a device ready to work within an hour, no hands-on setup needed.