Loading page
Bastion is a private demonstration page, not a security vendor or managed service provider, and is not affiliated with any company named on it.
Small and midsize business
You will not be hit by a zero-day. You will be hit by an invoice.
Almost everything that happens to a business your size arrives through a mailbox: a fake invoice, a redirected payment, a password that worked somewhere else. None of it needs advanced tooling to stop, and most of the defences cost nothing.
- The four routes that account for most incidents, in order
- What is free, what is cheap, and what needs a person
- The two controls that do more than the rest combined
The size-matched checklist
What a business your size should actually do, in order. Move the slider and it says what it will send.
8
Under 10 — everything on your list is free or built into what you already pay for. No managed service, no separate tooling.
How it actually happens
Four routes, in the order they are used
None of these is sophisticated. That is the point — they work because they are ordinary, and because the defence is a process rather than a product.
Most common
Invoice and payment redirection
Stopped by a callback rule
An email that looks like a supplier — or your own director — asking for a payment or a change of bank details. The technical part is trivial; the loss is not. The defence is a rule that any change of bank details is confirmed by phone on a number you already had, and that the rule applies to everyone including the owner.
Second
A mailbox taken over
Stopped by multi-factor authentication
One password guessed or reused, and an attacker sits inside the mailbox reading threads for weeks before joining one. It is why so many fraudulent invoices arrive with correct context. Multi-factor authentication on email is the single highest-value control on this page.
Third
Ransomware through a normal door
Stopped by tested backups
Usually a remote-access service exposed to the internet or credentials bought from a previous breach — not a clever exploit. The thing that decides how bad it gets is whether you have a backup you have actually restored from, rather than one you assume works.
Fourth
A departing employee's access
Stopped by an offboarding list
Accounts that were never closed, on services nobody remembers buying. Less dramatic and very common. A written list of every service and who has access, reviewed when someone leaves, closes it.
Where the money goes
Free, cheap, and worth a person
In that order, because the free layer stops more than the paid one and skipping it makes the paid one an expensive way to feel prepared.
Costs nothing
Do these before you buy anything
All of it is already inside the accounts and devices you pay for. Most businesses of any size have at least one of these switched off.
- Multi-factor authentication on email, for everyone
- The callback rule for any change of bank details
- Automatic updates on every device, including phones
- A written list of services, and who has access to each
Costs a little
The layers worth a small budget
Per-person costs that are small relative to a single fraudulent invoice, and that solve problems the free layer cannot.
- A password manager with shared vaults for the team
- Backup that is separate from the system it protects
- Managed device settings, so a lost laptop can be wiped
- Filtering on inbound mail beyond the default
Costs a person
When you need someone accountable
Past roughly fifty people, or wherever you hold regulated data, the gap is not tooling — it is that nobody is responsible for noticing.
- A named person or provider who owns this
- An incident plan someone has actually rehearsed
- Log monitoring by somebody who reads the alerts
- A restore test on a schedule, with a written result
Straight answers
Questions owners actually ask
- We are too small to be a target. Are we?
- Targeting is mostly automated, so size does not exclude you — but it does change the threat. You are unlikely to be picked out by name and quite likely to be caught by something scanning everyone. That is why ordinary controls work so well at this size.
- Is cyber insurance worth it?
- Often, and read the conditions before you rely on it. Policies increasingly require specific controls — multi-factor authentication is the usual one — and a claim can be reduced or refused if the control was not in place. The questionnaire is a decent free checklist in itself.
- Do we need a managed provider?
- Below about ten people, usually not: your list is free things and one or two subscriptions. The honest trigger is not headcount but whether anyone is accountable for noticing something is wrong.
- What about staff training?
- Useful, and less useful than the process. Training asks a busy person to spot a good fake; a callback rule means they do not have to. Do both, and put the rule first.
- How often should we test backups?
- Often enough that you know the answer. A backup nobody has restored from is an assumption. Once a quarter, restore something real and write down that it worked.
- We were hit. What now?
- Disconnect the affected machine rather than wiping it, change passwords from a device you trust, tell your bank immediately if money moved, and report it to the FBI's IC3. Speed matters most for payment fraud, where funds can sometimes be recalled within days.
Go straight to the source
Federal references, none of them selling anything
- CISA — Cyber EssentialsThe federal baseline written specifically for small organisations.
- FBI IC3Where to report payment fraud, and quickly.
- FTC — cybersecurity for small businessPlain guidance and short training material from the regulator.
- NIST Small Business Cybersecurity CornerStandards translated for organisations without a security team.
- CISA — Secure Our WorldThe four basics, for staff as much as for owners.
- SBA — protect your businessThe Small Business Administration's own overview.
One email, then we leave you alone
Take the checklist sized for your business
The free layer first, then what a business your size should actually pay for. One page, no vendor names.
The size-matched checklist
What a business your size should actually do, in order. Move the slider and it says what it will send.
8
Under 10 — everything on your list is free or built into what you already pay for. No managed service, no separate tooling.