When we begin an assessment, the first thing we ask is not what security software you have bought. It is a plainer question: who can sign into the business email, and would a single stolen password be enough to get in. In most of the businesses we check, the honest answer is yes, and that one fact tells us more about the real risk than any product on the shelf.

Email is where the money decisions live. It is where invoices arrive, where bank details get confirmed, where a supplier says “new account, please update your records”. An attacker who reads that inbox for a week does not need to break anything. They just wait for the right thread and reply to it, in your voice, from your address.

A stolen password on its own should never be enough, and the fix is not expensive. Turning on a second step at sign-in - a code on the phone, or a prompt in an app - means a leaked password is a nuisance rather than a catastrophe. It is the single change that moves the needle furthest, and it is usually free with the email you already pay for.

The reason we lead with this is honesty. We could sell you a longer, more impressive list. But if the front door is unlocked, the rest of the house barely matters. Get sign-in right first, then we can have the interesting conversation about everything else.

For a sole trader that means one account made properly safe in an afternoon. For a regulated firm it means the same discipline across a team, and a record that shows it was done. The principle does not change with size. Only the number of doors does.