Cybersecurity & operational security
Practical protection for small businesses, from the devices on your desk to the decisions you make every day.
Let’s talk about security
Protecting what keeps you going
Your email, customer records, payments, and devices keep your business moving. Losing access—or losing someone’s trust—can interrupt much more than your computer.
You don’t need to be a large company to be caught by an automated attack or a convincing scam. AI gives criminals new ways to imitate people and tailor their approach. Good protection combines technical safeguards with routines your team can actually use.
We start with what matters most to your business, then work through manageable improvements. The aim is to reduce risk, limit disruption, and give you a clear way to recover.
Know what to look for
Urgency. Authority. A request to keep something quiet. The technology changes, but many attacks still depend on getting someone to act before they check.
Explore the situations that can catch a busy business off guard.
A supplier’s invoice arrives with new banking details. A text sounds just like a colleague. AI can make these messages fluent, personal, and convincing; even a real email conversation can be hijacked.
Use a saved number to confirm changes to payments or sensitive requests. Open the service through a trusted bookmark. Good spelling, a logo, and a familiar name are not proof.
We can review email protection, set up payment-verification routines, and practise realistic phishing scenarios with your team.
An urgent caller claims to be the owner, a customer, or technical support. AI-generated audio and video can imitate someone you know and pressure you to send money, share a code, or reset an account.
Pause and reconnect through a number you already trust. Require a second approval for unusual payments or access changes, even when the person sounds or looks familiar.
We help put a simple verification process in place and rehearse it, so staff have permission to stop and check.
Reused passwords, fake sign-in pages, repeated approval prompts, and an innocent-looking “connect this app” request can expose email and business files. Stolen browser sessions can also bypass a fresh login.
Use unique passwords and multifactor authentication (MFA), favouring passkeys or security keys where supported. Review connected apps and recovery methods; deny unexpected approval prompts.
We can strengthen sign-in and recovery, remove unused access, review sharing permissions, and separate administrator accounts from everyday work.
An unpatched laptop, an exposed remote-access tool, or an old router can put everyday work at risk. Ransomware can lock files and steal information. A synced folder alone may also copy deletions or damage.
Keep devices supported and updated, limit access, and maintain protected backups with separate access. Test that important files can actually be restored.
We assess vulnerabilities, help prioritise fixes, configure endpoint protection, and build a recovery plan around the systems your business relies on.
A public holiday post, a visible customer list, a discarded drive, or a shared front-desk login can give someone useful information or access. Fraud often starts with learning how your business works.
Limit unnecessary public details, lock screens and equipment, separate guest Wi-Fi, and remove access when someone leaves. Verify unexpected visitors and support requests.
We review your workspace, device handling, public footprint, and everyday procedures to make practical operational security part of the routine.
Pasting a client file into an unapproved AI service can expose information. Connected AI assistants may also act on malicious instructions hidden in documents or web pages—a risk called prompt injection.
Agree which tools and data are approved. Give AI only the access it needs, and keep human approval for payments, external messages, and sensitive changes.
We help review AI tools, permissions, and data handling, then teach your team how to use them with clear limits and checks.
Further guidance: social engineering, generative AI, and connected AI agents from the Canadian Centre for Cyber Security.
How H&BITS can help
We bring assessment, hands-on improvements, and education together. We agree the priorities, cost, and responsibilities before making changes, with on-site or remote work arranged around what you need.
Review devices, accounts, networks, backups, and working practices. Where agreed, use vulnerability scans to identify weaknesses and turn the findings into a prioritised plan.
You leave with: a practical list of what to fix first.
Hands-on setup for updates, endpoint protection, encryption, routers, firewalls, and separate guest Wi-Fi. Review remote access and help replace or retire unsupported equipment.
You leave with: stronger foundations and clear ownership.
Set up password managers, MFA, and supported passkeys or security keys. Review email and cloud permissions, recovery options, shared access, and joining or leaving procedures.
You leave with: access that matches people’s roles.
Review who can reach equipment and information. Improve screen locking, secure storage, device inventory, visitor routines, and arrangements for safe data erasure and equipment disposal.
You leave with: safer physical handling of your technology.
Plan and configure protected backups, test restoration, and document who to contact if something goes wrong. Walk through an incident scenario and agree where specialist help is needed.
You leave with: a recovery checklist you can find and use.
Arrange follow-up reviews, vulnerability checks, and refresher training as your tools and team change. Where monitoring or ongoing maintenance is needed, agree the coverage and response arrangements.
You leave with: a realistic plan for continued care.
Our starting points draw on the Canadian Cyber Centre’s small-business security controls and CISA’s phishing-resistant sign-in guidance (PDF).
Operational security, made everyday
Operational security—or OPSEC—means thinking about what your routines reveal, who can access important information, and how a request is checked before anyone acts.
Education is part of the protection
Our founder made security awareness a core part of the business. We’re building on that with patient, practical learning for owners and teams—using the situations you actually encounter.
Talk to us about team trainingPractise phishing, fake invoices, QR-code scams, and voice or video impersonation. Learn a reliable verification process instead of relying on spotting a visual flaw.
Set up secure sign-in together. Practise sharing files, checking app permissions, and deciding what information belongs in an AI tool.
Walk through a suspicious message or lost device, then leave with short checklists and clear reporting routes. Training and agreed simulations focus on learning, without blame.
Carrying our founder’s work forward
Cybersecurity assessments, vulnerability management, endpoint protection, and security awareness were part of the original H&BITS practice. That foundation still matters. We’re extending it to today’s connected workplaces and AI-enabled threats, with the same belief that people deserve clear advice and thoughtful help.
These archive articles describe the founder’s practice. Today’s services and support arrangements are agreed for each engagement.
A clear place to start
Yes. We can start with the accounts, devices, and information you rely on most. A focused review and a few useful changes can be a manageable first project.
Yes. We can arrange on-site work in London and Southwestern Ontario for equipment, networks, and workspace reviews, alongside remote help for accounts, cloud tools, and training. We confirm location, availability, and scope together.
These are planned security services. Response hours, monitoring, and ongoing support are agreed explicitly; an enquiry through this site does not establish emergency cover. If you suspect an active incident, use your established IT or incident-response contact. For a suspected fraudulent payment, contact your financial institution immediately through a trusted number.
No security service can remove every risk. We work to reduce exposure, strengthen everyday decisions, and improve recovery. Specialist testing, forensic investigation, or certification requirements are scoped separately.
Let’s find a useful first step
Bring your questions, your current setup, or a concern you’ve been putting off.
We’ll work out where to start, together.