IT security

Attacks have changed.Has your protection?

AI makes deception easier and attacks more efficient. We help you protect accounts, data and everyday processes with sensible fundamentals, a prepared team and targeted security assessments.

Discuss your project ↗

Your systems. New possibilities.

Possible choices, matched to your tasks and existing systems.

Bitwarden
Cloudflare
Yubico
1Password
Microsoft

More than suspicious emails

Many ways in.
One business that needs to keep running.

Stolen logins, malicious downloads or open sharing links: different entry points can affect the same essentials. Choose an area to see the risk and what helps.

Possible risks · not a live assessment

Your businessData · Money · Ability to work

Choose an entry point. The highlighted path shows the selected example, not a detected attack.

Devices & downloads

One download. More than one device affected.

What can happen

Malware can reach a device through a tampered download or an exploited software vulnerability.

What it means for you

Files may be stolen or encrypted. Connected systems and the team's ability to work may also be affected.

What helps

Timely updates, limited privileges and suitable endpoint protection. Separate, tested backups support recovery.

No single measure covers every path. We combine technology, clear responsibilities and workable routines — with priorities that fit your business.

Accounts & access

Stolen or reused credentials can give other people access to your accounts.

Email, customer data and connected services may be affected — especially when access rights are too broad.

What helps

Unique passwords, phishing-resistant MFA where possible, clear access rights and consistent offboarding.

Websites & applications

Unpatched vulnerabilities or incorrect permission checks can enable unwanted access.

Confidential data may be exposed. Outages can interrupt enquiries, orders and internal workflows.

What helps

Updates, server-side access checks and targeted security tests with written authorization and follow-up remediation.

Cloud & sharing

Public sharing links or outdated permissions can make documents accessible to people who should not see them.

Quotes, personnel files or customer information may leave their intended audience.

What helps

Restrict sharing, review access regularly, remove unnecessary links and assign responsibility for staff changes.

Calls & identity

A caller may impersonate someone else. AI-generated voices can provide additional support for this deception.

Under time pressure, people may approve payments, disclose sensitive information or change account access.

What helps

Call back using a number you already know. Independently confirm sensitive changes and use clear joint approval rules.

Why now?

AI makes your working day easier.
Unfortunately, it helps attackers too.

The tricks are not all new. The effort needed to use them is changing. Attackers can combine convincing language, research and automation — while businesses often still rely on familiar routines.

More convincing

Messages can be fluent, personal and tailored to your business. Poor spelling is not a reliable safety check.

Less effort

AI helps with researching targets, writing deceptive messages and generating basic malicious code.

Greater reach

When preparation takes less effort, attackers can pursue more attempts. Being a small business is not a safeguard.

Background: the UK NCSC assesses how AI makes existing attack methods more effective and efficient. Read the assessment (PDF, English)

Not just a big-company issue

You do not have to be big for an attack to hurt.

What matters is what your business depends on. Anyone using business email, online accounts or a website should know how those essentials are protected.

An email account

Customer conversations, quotes and trusted contacts — all in one place.

A payment approval

A changed bank account can turn a routine payment into a costly mistake.

A website or application

When access or availability fails, enquiries and daily work can stop too.

From an abstract risk to your inbox

Would you trust this message?

A familiar business situation. Explore the message, the deception and the safeguards at your own pace.

01 / First impressions

Just an ordinary message?

A familiar name. A professional tone. A request that fits a normal working day. That is why a second look matters — without asking your team to distrust every email.

Not a spelling test
Good writing and a plausible reason do not prove who is behind a message.
Not a guessing game
You do not have to spot every fake. What matters is reliably verifying sensitive changes.

Read the message. Then explore what creates trust — and which process helps protect you.

Fictional example · no real email

Inbox01 / 01

Supplier · Accountsrechnung@lieferpartner.exampleTo: your accounts team

Our payment details for the current order

Hello,

thank you for working with us on the current order. We have updated the bank details for our invoicing.

Please use the new payment details for the outstanding invoice. The updated information is in the attached document.

So we can complete the booking today, a brief confirmation by email will be sufficient.

Kind regards
Your supplier's accounts team

Payment-details.pdfIllustration only · no download

Illustrative view — nothing is sent or opened.

Familiar is not verified.

In this fictional example, the payment request is fraudulent. AI can help make such messages convincing and tailored to a business. The text alone cannot reliably establish its origin.

A familiar name

The sender's display name looks familiar. Even an apparently correct address is not proof: accounts can be compromised.

A plausible reason

An ongoing business relationship makes the change look like routine administration.

A small shortcut

Time pressure and the request to confirm only by email are meant to replace an independent check.

The risk is not a single typo. It is allowing a message alone to trigger a change in payment details.

Do not rely on gut feeling alone.

Clear rules help your team avoid decisions under pressure. For changed bank details, three practical steps make a difference:

Call a known number

Contact the business partner on a number you already hold — not new contact details supplied in the message.

Approve changes together

Independently confirm new payment details and use an agreed two-person approval process. Keep the payment on hold until then.

Make reporting simple

A clear contact and a short reporting route help warn others and investigate the incident.

Technology supports the process: secure accounts, appropriate access and MFA. Password protection alone cannot prevent a manipulated payment approval.

The right protection, not the biggest package

Start with what your business actually needs.

Every business needs sensible fundamentals. Not every business needs a full penetration test straight away. We review your situation together, prioritise the gaps and agree what to implement or test.

Discuss your security

The starting point

Who still has access?

A password is sitting in a group chat. A former employee still has access. An urgent payment request sounds like it came from management. These situations need simple, dependable routines: who verifies the request, who removes access and how do you recover an account after losing a device?

What you get

A joint inventory of accounts, devices, access rights and existing safeguards.
Introduce a password manager such as Bitwarden: store passwords, share them securely and onboard the team.
Work through multi-factor authentication (MFA), recovery and access changes during on/offboarding.
Awareness training: recognise phishing and AI deception, verify payment requests via a second channel and report incidents.
Authorized phishing simulations and penetration tests within a written scope; document findings and provide a prioritised checklist with remediation and owners.

Safeguards that work in daily life.

We work with the people responsible on your existing settings and routines. The aim is a practical security baseline: understandable access rights, usable safeguards and a team that knows what to do with unusual requests.

Clear steps. Shared decisions.

From a shared overview to safer routines.

01
Review existing safeguards and risks together; agree priorities, scope and effort
02
Implement agreed fundamentals; run simulations and tests only with written authorization and a defined scope
03
Remediate, train the team and carry out a retest where included

What you need to get started.

Who should take part?

Someone with an overview of your IT and the people who manage accounts or staff changes. We involve the relevant users for onboarding and awareness exercises.

What do we receive?

An inventory, a prioritised action list and the fundamentals we have put in place, with checklists. You know who grants access, what happens when someone leaves and how unusual requests are checked.

Can we start with the password manager?

Yes. We review your accounts and team structure, set up suitable storage and sharing, and practise everyday use and recovery together.

Let’s make it concrete.

Let’s organise your accounts and access.

Tell us how your team manages passwords and access today. We will identify a useful starting point.

Discuss your project

You choose how we work together

Your capability. Support when you want it.

Setup & enablement

A working setup, documented access and practical training. Your team can use the system, change templates and maintain agreed areas independently.

Discuss setup ↗

Ongoing support & operations

Choose help with monitoring, maintenance, content or approved workflow adjustments. We agree responsibilities and scope; access and decisions stay with you.

Discuss ongoing support ↗

Attacks have changed.Has your protection?

Many ways in.One business that needs to keep running.

One download. More than one device affected.

What can happen

What it means for you

What helps

AI makes your working day easier.Unfortunately, it helps attackers too.

More convincing

Less effort

Greater reach

You do not have to be big for an attack to hurt.

An email account

A payment approval

A website or application

Would you trust this message?

Just an ordinary message?

Not a spelling test

Not a guessing game

Our payment details for the current order

Start with what your business actually needs.

Who still has access?

What you get

Safeguards that work in daily life.

From a shared overview to safer routines.

What you need to get started.

Let’s organise your accounts and access.

Your capability. Support when you want it.

Setup & enablement

Ongoing support & operations

Many ways in.
One business that needs to keep running.

AI makes your working day easier.
Unfortunately, it helps attackers too.