Skip to content
Cydekick

Security fundamentals

Practical security for businesses without a security team.

Most small-business breaches don’t start with sophisticated hacking. They start with a reused password, a missing update, an old account or a backup nobody tested. We put the fundamentals in place and keep checking them.

Review my security basics

What we are — and aren’t

We are

Your IT partner who builds and maintains a sound security baseline, and helps when something goes wrong.

We aren’t

A 24/7 security operations center or managed security service provider. When you need one, we’ll help you choose and work alongside them.

The Cydekick baseline

Twelve controls that matter more than any shiny tool.

Multi-factor authentication

Required on email, cloud apps, admin accounts, remote access and AI tools. We move away from text-message codes where better options exist.

Phishing-resistant sign-in

Hardware security keys and passkeys for owners, finance and administrators — the accounts attackers want most.

Endpoint protection

Business-grade anti-malware on every managed device, with alerts routed to us instead of ignored pop-ups.

Patching

Operating systems, browsers and common apps updated on a schedule, with reporting on devices that fall behind.

Password management

A company-owned password manager for shared credentials, so logins don't live in spreadsheets, sticky notes or one person's memory.

Administrator separation

Everyday work happens on standard accounts. Admin rights live on separate, protected accounts used only when needed.

Backups

Multiple copies, one off-site, one tamper-resistant, and restore tests on a schedule — the last line of defense against ransomware.

Disk encryption

BitLocker or FileVault on laptops and desktops, with recovery keys stored in your tenant — so a stolen laptop is a hardware problem, not a data breach.

Remote-access controls

No remote-desktop ports open to the internet. Remote access goes through controlled, MFA-protected, logged tools.

Employee lifecycle

Written onboarding and offboarding, so access is granted deliberately and removed the day someone leaves.

Vendor access

Outside vendors get named accounts with the least access they need, and that access expires or is reviewed.

Security baseline

A written standard for how your devices and accounts are configured — and regular checks that they still are.

How we roll it out

Secure without grinding the business to a halt.

Security that stops people working gets bypassed. We phase changes in, explain them to your staff in plain language, and start with the accounts and systems that carry the most risk.

  • Admin and owner accounts protected first
  • MFA rolled out with a short, friendly walkthrough for staff
  • Backups verified before anything else changes
  • Old accounts and forgotten vendor access cleaned up
  • A written baseline you can show to insurers or clients who ask
  • Periodic reviews so the baseline doesn't quietly erode

Questions

Security questions

What happens during a security incident?

Call us. We help you contain the problem — for example isolating a device, resetting compromised accounts, revoking sessions and blocking malicious mail rules — preserve evidence, and restore normal operations from clean backups.

Cydekick is not a 24/7 security operations center, and we'll say so plainly. For serious incidents we help you bring in your cyber-insurance carrier, specialist incident-response firms and legal counsel, and we work alongside them. Knowing who to call before something happens is part of the security plan we build with you.

Do you support regulated businesses?

We work with many kinds of small businesses, but we don't claim any automatic compliance status — for example HIPAA, PCI DSS, CJIS, SOC 2 or legal-industry requirements. Regulated organizations often need specific contracts (such as business associate agreements), additional technical controls and review by their own compliance or legal advisors.

If you're regulated, tell us early. We'll be honest about what we can support, what would need to be added, and when a specialist is the better fit.

Does Cydekick know our passwords?

We don't need your employees' personal passwords, and we'll ask you not to send them to us. We use our own admin accounts to do our work. When a password must be reset, the employee sets the new one.

For shared business credentials — a router, a vendor portal — we recommend a business password manager owned by your company, with access for Cydekick granted and revoked like any other staff member.

How do backups work?

We design backups around what you'd actually need to recover: computers, servers, file shares, and cloud data such as Microsoft 365 or Google Workspace mailboxes and files — which aren't automatically protected the way many people assume.

Good backups follow a few rules: more than one copy, at least one copy off-site, at least one copy that ransomware can't alter, and regular restore tests. We report on backup health and test restores on a schedule, because a backup nobody has tested is a hope, not a plan.

Know where your security really stands.

We'll check the fundamentals — MFA, admin access, backups, patching, remote access and old accounts — and give you a prioritized, plain-language list of what to fix.

Book a technology reviewRequest an AI readiness assessment