How staff should report a suspicious email
People report more effectively when the route is easy to find and the response is clear. Ask for the message and what happened after it, without encouraging further interaction.
Security Guides
Security Guides
How to roll out a password manager to a small company
A team vault needs an ownership model as well as an app. Decide what is personal, what the organization owns, and how access will be removed when someone leaves.
How to remove access when someone leaves
A person’s access may extend beyond their main account. Use a planned sequence to protect information, close sessions and tokens, and transfer legitimate ownership without losing critical work.
Who can send mail as the company
Your domain may appear in messages from staff, marketing tools, websites, and finance services. Record each sender and connect it to an owner and an intended authentication setup.
How a team of five can patch without stopping the work
A workable patch routine names an owner, prioritizes exposed and important systems, and checks the affected workflow after an update. Keep exceptions visible rather than indefinitely postponed.
How a small team proves it can restore a backup
A backup job marked successful does not prove that people can resume work. Restore a representative sample into a safe environment and check the data, access, and dependencies.
What DMARC does for a small company’s email
DMARC connects your domain’s email authentication results to a published policy. A successful rollout starts with a complete list of legitimate senders and careful delivery checks.
SSRF explained: when a server fetches a destination it should not
A server-side request feature can reach resources that the user cannot directly access. Review allowed destinations and the authority available to the fetching service.
Practical zero trust: verify access to each important service
For a small team, zero trust starts with explicit access decisions around important services. Identity, device context, least privilege, and review matter more than adopting a label.
TLS checks: protect the connection all the way to the service
A valid certificate at the public edge is only part of a secure connection. Review protocol settings, hostname validation, internal hops, and the origin that ultimately handles the request.