Speaking at the FSB: Affordable Cyber Security for Small Businesses

Will opened by tracing how the job of looking after a small business’s technology has changed since Netserve was founded. Traditional IT support – fixing broken things and keeping the lights on – was the whole story for a long time. Then cyber security became impossible to ignore. Now, artificial intelligence is reshaping both how businesses operate and the nature of the threats they face.

Best practice has evolved slowly across those three eras. The eight areas Will covered aren’t new ideas – but they are the ones that consistently show up when something goes wrong, and the ones that, when done right, make the biggest difference for the smallest outlay.

The session was deliberately designed for a non-technical audience. No jargon, no scare tactics – just the honest picture of where most small businesses stand, and what they can realistically do about it.

The session was structured around a simple roadmap: eight things every small business should check, split into two groups of four – the foundations, and then the layers that protect the business you’ve built.

A common reaction from small business owners is to feel they can’t afford to do everything at once – and that’s completely understandable. Will’s message was that these eight areas aren’t about doing everything. They’re about doing the right things first.

Some cost nothing. Some cost a few pounds a month. Some are simply about buying the right product the first time, rather than the cheapest one. The compounding risk of getting these wrong early – particularly the foundations in points one to four – is that they become significantly harder and more expensive to correct as a business grows. The tenant and admin model you set up when you have three people becomes a serious project to unpick when you have thirty.

It’s also worth noting that many of the most damaging cyber incidents affecting small businesses weren’t caused by exotic, sophisticated attacks. They were caused by gaps in the basics – no MFA, credentials in a spreadsheet, an out-of-date router. The eight-point roadmap is designed to close those gaps systematically, without unnecessary spending.

The section of the session that generated the most reaction was a real-world case study illustrating exactly what happens when the fundamentals aren’t in place. The scenario was based on a genuine incident pattern Netserve has encountered – and it’s more common than most people realise.

It began with a trusted-looking phishing email. The kind that doesn’t look suspicious at first glance – correct branding, a plausible sender, a believable reason to click. The user did what most people would do.

From that single click, a Microsoft 365 account was compromised. The attacker then searched OneDrive – and found a file called Passwords.xlsx. With that file, they had keys to almost everything: other business accounts, financial tools, supplier portals.

To buy time and avoid detection, the attacker created a hidden inbox rule that silently redirected certain replies away from the victim’s view. The business owner kept working, completely unaware their account was being used against them. Meanwhile, the attacker moved laterally – contacts, connected accounts and colleagues became the next targets.

The chain of failure wasn’t caused by a lack of spending on technology. The business had antivirus. They had 365. The problem was the gaps: no MFA on the mailbox, credentials stored in a spreadsheet, no modern identity protection monitoring for unusual sign-in behaviour, no endpoint detection to flag the anomaly.

The damage wasn’t just technical. There was reputational exposure – contacts received emails from a compromised account, clients were potentially targeted. Recovery took time, cost money, and required difficult conversations. All of it stemmed from a handful of missing fundamentals.

“Affordable cyber security isn’t about buying everything. It’s about getting the fundamentals right.” That line landed with the room – because the case study made it real.

The session closed with a look at what a good managed IT provider should actually be doing for a small business – and it goes well beyond reactive support.

Will outlined the five pillars Netserve builds its managed service around:

The point Will made here was direct: whether it’s Netserve or another provider, your IT partner should be proactively keeping you aligned with current standards – not waiting for something to break. Too many small businesses are running with a reactive-only arrangement that leaves them exposed between incidents.

The managed approach isn’t about adding cost for the sake of it. It’s about converting unpredictable, expensive reactive incidents into a predictable, affordable monthly arrangement that keeps the business secure as it grows.

The session ran as part of a wider FSB event that also featured talks on marketing, leadership and AI in business. The cyber security slot prompted questions well beyond the allotted time – a sign of how much appetite there is for this kind of practical, no-nonsense guidance at the SME level.

Several attendees stayed afterwards to speak with Will directly, either to discuss their own setups or to ask about next steps. The conversations ranged from ‘we’ve never been shown this before’ to ‘we thought we were covered but now I’m not so sure.’ Both are exactly the kind of starting point Netserve is set up to help with.

It’s the kind of conversation Netserve has been having with small businesses for over two decades – and one they’re always glad to have.

“I want people to leave with something practical they can take back to their business – not a sales pitch, not a scare story. Just the things that actually matter.”

– Will Bellows, Managing Director, Netserve

If you attended the FSB event and want to follow up, or if you’ve read this and want an honest conversation about where your business stands – get in touch with the Netserve team. We’re based in Southampton, we work with small businesses every day, and we’ll tell you what actually matters for your situation.

No jargon. No hard sell. Just practical advice from people who’ve been doing this for 23 years.