In short
Managed security services for small business give a smaller organisation 24/7 threat detection and response without hiring a security team. Forever Systems supplies vendor MDR services such as ThreatDown, Sophos, Blackpoint, Todyl, Acronis and WatchGuard, sets them up, manages them and handles escalation, on top of a Cyber Essentials baseline.
Get a quote for managed security for small business
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why small businesses need managed security
Small businesses are attacked for the same reasons as large ones: they hold money, data and access to other organisations. Many attacks are automated, so the attacker rarely knows or cares how big you are. A stolen Microsoft 365 password, a laptop missing a security update or a convincing invoice email is enough to start.
What small businesses usually lack is not technology but time. Endpoint protection, Microsoft 365 and the firewall all raise alerts, and in a small firm those alerts land on an office manager, a busy director or an IT provider whose contract covers fixing problems in office hours. An attack that starts on a Friday evening or over a bank holiday can run for days before anyone reads the alert.
A managed security service closes that gap. Depending on the service, analysts working for the vendor watch your devices and accounts around the clock, investigate what looks wrong and take agreed actions, such as isolating an infected laptop or stopping a malicious process, before the problem spreads. It is the practical way for a small organisation to get managed SOC services without building a SOC.
Common prompts for looking at this include a cyber insurance questionnaire asking about monitoring and response, a larger customer's supplier security questions, a phishing near miss or a move to Microsoft 365.
What a right-sized service includes
For most small organisations a sensible managed security service is a short list of things done properly rather than a long list of products. A typical scope looks like this:
- Endpoint protection with EDR on every laptop, desktop and server, deployed and kept up to date
- 24/7 managed detection and response (MDR) from a vendor SOC that investigates alerts and contains threats within limits you agree
- Microsoft 365 account protection, watching for suspicious sign-ins, mailbox rules and account takeover; see managed ITDR
- Email security that catches phishing and impersonation which gets past standard filtering; see managed email security services
- A managed firewall where you have an office network to protect; see managed firewall services
- Backups you can restore, kept separate from the systems they protect
- Staff awareness training, because many attacks start with a message to a person
- Cyber Essentials controls in place, so the basics are covered before anything else
You do not need all of it on day one. We usually start with endpoints and Microsoft 365 identities, because a phished password or an unprotected laptop is a common way in, and add the rest as budget and priorities allow. The full catalogue is on our managed security services page.
Vendor MDR services that suit smaller organisations
Several of the vendor services we supply suit smaller organisations well: a single agent or a simple cloud connection, and licensing counted per endpoint, user or device, so it scales down. The table describes how each works; it is not a ranking, and the right choice depends on what you already run.
| Vendor service | What the vendor's team does | Licensed by | Often suits |
|---|---|---|---|
| ThreatDown MDR | 24/7 monitoring of ThreatDown-protected endpoints; can terminate processes, isolate devices and remove malware | Per endpoint | Small teams wanting a straightforward endpoint service |
| ThreatDown Managed Threat Hunting | A lighter option: prioritised alerts with remediation guidance, with your IT provider taking the action | Per endpoint | Firms with an IT provider who can act on guidance |
| Sophos MDR | 24/7 monitoring and response on Sophos and supported third-party tools, with a choice of response modes | Per user and per server | Organisations wanting control over what the SOC may do |
| Blackpoint CompassOne Essentials | 24/7 MDR or ITDR, with a security posture rating and asset inventory | Endpoints, identities and package | Microsoft 365-centred businesses |
| Todyl | One agent for SASE, EDR, SIEM and 24/7 MXDR, with modules chosen per organisation | Mostly per device | Firms that also want secure remote access |
| Acronis MDR Standard or Advanced | Runs on Acronis EDR or XDR, delivered by Acronis's own Threat Research Unit or a regional MSSP working through Acronis; Advanced adds 24/7 remediation and, by agreement, attack rollback and recovery from backup | Endpoints and tier | Businesses that already use Acronis backup |
| WatchGuard Core MDR or Core MDR for Microsoft | WatchGuard's SOC watches WatchGuard endpoints, or Microsoft Defender for Endpoint in the Microsoft version | Per endpoint or per user | WatchGuard firewall or Microsoft Defender users |
Sophos MDR's response modes are a good example of why the detail matters. In Authorize mode Sophos analysts act on threats and then tell you; in Collaborate mode they investigate but take response actions only with your consent (optionally switching to Authorize if nobody answers); in Notify Only mode they send notifications and take no containment action, and Sophos does not recommend that mode for long periods. A small firm with no IT staff usually wants the vendor to act; a firm with an in-house IT person may prefer to collaborate. Read more on Sophos MDR or our vendors page.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Already paying for Microsoft 365 security?
Many small businesses already license Microsoft security tools through Microsoft 365, for example through Microsoft 365 Business Premium. The licence gives you the tools; it does not give you anyone to watch them at 2am.
You do not necessarily need to replace what you have. Some vendor services work with Microsoft's own security products: WatchGuard Core MDR for Microsoft watches Microsoft Defender for Endpoint, Blackpoint MDR integrates with Microsoft Defender, and Sophos MDR works with Microsoft security tools and can use Microsoft 365 audit logs, subject to your Microsoft subscriptions. Which Microsoft licences each service supports is checked before we recommend it. Our page on MDR for Microsoft Defender explains the options.
Start with Cyber Essentials
Cyber Essentials is the UK government-backed baseline: five technical controls covering firewalls, secure configuration, user access control, malware protection and security update management. It helps protect against the most common, unsophisticated attacks, and customers or insurers may ask for it. Cyber Essentials for small business explains the scheme and how to certify.
Cyber Essentials and managed detection and response do different jobs. Cyber Essentials makes you harder to break into; MDR notices when someone gets in anyway and acts. The two fit together: the endpoint agents an MDR service uses also help evidence the malware protection control, and the device inventory built during onboarding helps with scope.
People matter as much as technology. Security awareness training for small business helps staff spot phishing and report it, and gives the SOC fewer incidents to deal with.
Is managed security for small business the right fit for you?
We will check it against your systems and requirements and recommend the right option.
What Forever Systems does
How our model works. Forever Systems does not run its own security operations centre. The 24/7 monitoring, investigation and response come from the vendor service you choose, run by that vendor's security analysts. We recommend the service, set it up, manage it, act as your escalation point and review it with you. Who does what is written down and confirmed at quote.
For a small business that means one point of contact instead of a set of vendor portals:
| Task | Vendor SOC | Forever Systems | You |
|---|---|---|---|
| Recommend a service that fits your size, tools and budget | - | Yes | Agree the choice |
| Deploy agents and connect Microsoft 365 | Provides the platform | Yes | Grant access |
| 24/7 monitoring, triage and investigation | Yes | - | - |
| Containment within agreed permissions | Yes | Helps set the permissions | Approve the rules |
| Escalation contacts and what happens next | Uses them | Yes, as your escalation point | Name your contacts |
| Policy changes, new starters and leavers | Provides the console | Yes | Tell us about changes |
| Service reviews and recommendations | Provides reports | Yes | Decide on actions |
Forever Group also supplies Microsoft 365, connectivity, telephony and backup, so security can be planned alongside the rest of your IT rather than bolted on. If you already have an IT support provider, we can work alongside them; responsibilities are agreed at quote.
Getting started
A small business engagement is deliberately simple:
- Tell us how many people and devices you have, what you use for email and files, and what security products are in place today.
- We recommend one or two vendor services that fit, with the reasoning and what each would and would not cover.
- We agree response permissions, escalation contacts and the responsibilities split with you, confirmed at quote.
- We deploy the agents, connect Microsoft 365 and see the service through the vendor's onboarding.
- We manage it from there and review it with you, adding email security, training or Cyber Essentials when you are ready.
Pricing depends on users, devices and the service tier, so ask us for a quote; our MSSP pricing guide explains what drives the cost. Contact us to talk through what would suit your business.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
Do small businesses need managed security services?
Most small businesses have nobody watching security alerts at night, at weekends or on holidays, so an attack can run unnoticed until the next working day. A managed service adds a vendor SOC that monitors and responds around the clock, which is usually more practical and affordable than hiring security staff.
What is MDR for small business?
Managed detection and response for small business is a service in which a vendor's security analysts monitor your devices and accounts 24/7, investigate suspicious activity and contain confirmed threats within limits you agree. Services such as ThreatDown MDR, Sophos MDR and Blackpoint are licensed per endpoint or per user, so they scale down to smaller organisations.
Is Cyber Essentials enough for a small business?
Cyber Essentials is a strong baseline that blocks many common attacks, but it does not include monitoring or response. If an attacker gets past the basics, MDR is what notices and acts. Many small businesses use both.
Can we use managed security with our existing IT provider?
Usually, yes. We can set up and manage the security service while your IT provider continues with day-to-day support, with responsibilities agreed and written down at quote.
How much do managed security services cost for a small business?
It depends on the number of users and devices, the vendor service and tier, and whether email security, firewall management or training are included. Ask us for a quote and we will scope it with you.
Does Forever Systems run its own SOC?
No. The 24/7 monitoring and response come from the vendor service you choose. Forever Systems recommends the service, sets it up, manages it and handles escalation with you.
Still have a question about managed security for small business?
Ask us and a member of our team will reply by email.