Cybersecurity

Cybersecurity for small businesses, without the big-consultancy price tag

Most small businesses don't have a security team. We give you one when you need it — fixed-price checks and fixes for your website, servers, email and cloud, delivered with automated agents for speed and senior engineers for judgement.

Talk to a security engineer PHP2Shell emergency fix

PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP web servers without logging in. PHP released fixes on 21 October 2026.

Check if you're affected

Fixed-Price Services

Start with a clear scope and a clear price

Focused engagements that close the gaps small businesses most often have. Each is quoted upfront — no retainers, no open-ended consulting hours.

Urgent

PHP2Shell Emergency Fix

Patch CVE-2026-109618 and CVE-2026-109619 on your servers, verified, with a check for signs of compromise.

Inventory of every PHP runtime on the server (FPM, Apache, CLI, containers)
Update to a fixed PHP release or vendor-patched build
Restart and verify every PHP worker is on the fixed build
Check logs and processes for known exploitation indicators
Short written report you can file for Cyber Essentials or your insurer

Fixed price per server, quoted within one business day

Request a quote

Small Business Security Check

No security team? We check the things attackers go after first in a small business, and tell you in plain English what to fix.

Website and hosting: PHP and CMS versions, HTTPS, exposed admin pages
Email: SPF, DKIM and DMARC so criminals can't send email as you
Accounts: MFA on email, cloud and admin logins
Backups: do they exist, are they offsite, can you actually restore
A plain-English report with your top fixes — and we can do them for you

Fixed price, quoted upfront

Request a quote

AWS Security Health Check

Is GuardDuty on? Inspector scanning? Root MFA set? A full baseline review of one AWS account, with fixes.

GuardDuty, Inspector, Security Hub, CloudTrail and Config coverage across every region
IAM review: root MFA, unused keys, over-privileged roles, Access Analyzer findings
Public exposure: S3 Block Public Access, open security groups, public snapshots
Encryption, backups and billing alarms
Prioritised findings report and a call to walk through it

Fixed price per AWS account, quoted upfront

Request a quote

Cyber Essentials Readiness (UK)

Get ready for Cyber Essentials: gap assessment against the five controls and hands-on fixes before you apply.

Gap assessment against the five Cyber Essentials technical controls
Patching, MFA, firewall and admin-account fixes on your devices and cloud services
Help completing the self-assessment question set
Introduction to an IASME-licensed certification body for certification

Fixed price based on number of devices, quoted upfront

Request a quote

Built for Small Businesses

Big-company security habits, sized for a small team

Attackers don't only go after large companies. Small businesses get hit by the same automated attacks — unpatched websites, spoofed invoices, reused passwords — usually with less help on hand. We focus on the handful of fixes that stop most of them.

No retainer, no lock-in
Fixed-scope, fixed-price work. Come back when you need us.
We fix it, not just report it
Patches applied, MFA switched on, email authentication set up — with your approval.
Plain English
Reports written for owners and managers, with the technical detail attached for whoever runs your IT.
Works with what you have
Shared hosting, a single VPS, one AWS account, WordPress or a custom app — no need to buy new tools first.

Capabilities

Security work that ends in fixed systems, not just reports

Most security reviews end with a PDF. Ours end with the patches applied, the services switched on and the evidence filed.

Vulnerability Response & Patching

When a critical flaw like PHP2Shell lands, we find every affected runtime across your servers and containers, patch or upgrade it, and prove it's fixed.

AWS & Cloud Security

GuardDuty, Inspector, Security Hub, CloudTrail and Config switched on and actually monitored, with IAM, network exposure and encryption reviewed account by account.

Server & Web Application Hardening

Linux, Apache, Nginx and PHP stacks — including WordPress and Magento — brought onto supported versions, locked down, and kept patched.

Cyber Essentials Readiness

For UK organisations: a gap assessment against the five controls and hands-on fixes, so your certification body assessment goes through first time.

Compromise Checks & Clean-up

Log, process and file-integrity review when you suspect something's wrong, followed by clean rebuilds and credential rotation where needed.

Continuous Security Monitoring

Scheduled, automated checks of your cloud accounts and servers, with findings triaged by an engineer before they reach you — no alert floods.

How We Work

Agents do the legwork. Engineers make the calls.

Automated agents handle inventory, scanning and evidence collection across every server and region in minutes. That's why we can offer fixed prices — and why a human still reviews every finding and approves every change.

01
Read-only discovery
Automated agents inventory your servers, PHP runtimes, cloud accounts and exposed services using read-only access. Nothing changes yet.
02
Engineer-reviewed findings
An engineer validates every finding, removes false positives and ranks what's left by real risk to your business.
03
Fixes you approve
We apply patches and configuration changes only after you approve them, in a maintenance window that suits you, with a rollback plan.
04
Verified and documented
Every fix is re-tested and written up — evidence you can hand to an auditor, insurer, customer or Cyber Essentials assessor.

Security insights

All insights

Cybersecurity

PHP2Shell (CVE-2026-109618, CVE-2026-109619): What It Is and How to Patch Every Server

A practical PHP2Shell guide: affected and fixed PHP versions, how to find every PHP runtime, patching per platform, workarounds and compromise checks.

11 min read

Cybersecurity