How Do You Choose a Cybersecurity Company?

The short answer: to choose a cybersecurity company, start with what your business actually needs protecting, then shortlist providers that hold Cyber Essentials (ideally Cyber Essentials Plus), can explain their incident response in plain English, include out-of-hours support in the price, and don't lock you in. If a provider leads with fear or product names instead of questions about your business, keep looking.

When someone asks me how to pick a cybersecurity company, my first question back is always what problem they're actually trying to solve. A corner shop worried about card machine fraud needs something completely different to a logistics firm handling client data across three sites. Get honest about what you're protecting and what a bad day actually looks like if it goes wrong. That's the starting point, not a company's logo or how slick their website is.

None of this is about finding the biggest name or the cheapest quote. It's about finding someone who actually understands your business well enough to protect the right things, and who's still answering the phone in a year's time. I've sat in on enough of these first conversations, on both sides of the table, to know the difference between a provider who's genuinely listening and one who's already decided what package they're going to recommend before you've finished explaining your business.

Start With What You're Actually Protecting, Not the Sales Pitch

Before I'd even look at a single provider, I'd write down what actually matters: customer data, payment systems, email accounts, whatever keeps the business running day to day. A good cybersecurity company asks about this before they mention a single product. If the first conversation is entirely about their tools and packages rather than your business and what you'd stand to lose, that tells you something about how the relationship is likely to go once you've signed.

The Questions I'd Actually Ask Before Signing Anything

I'd want to know exactly what happens if something goes wrong at 2am on a Sunday, not just during office hours. Who actually responds, how quickly, and what does that cost on top of the monthly fee. I'd ask for a plain-English explanation of what they'd do in the first hour of a ransomware attack, and I'd be wary of anyone who can't answer that without reaching for jargon. I'd also ask how they measure whether their own work is actually reducing risk, rather than just billing for hours, and I'd ask to speak to an existing client if that's on offer, since how a company handles a reference request tells you almost as much as the reference itself.

Watch How They Talk About Risk, Not Just Tools

The companies I'd trust talk about risk in terms of your business, not just firewalls and endpoint protection. They should be able to explain what happens to your specific data if a laptop gets stolen or an employee clicks the wrong link, in language that doesn't need translating. If every answer comes back as a product name rather than an outcome, that's usually a sign they're selling software rather than actually managing your risk.

Credentials That Actually Mean Something

Certifications aren't everything, but they're not nothing either. Cyber Essentials, and the more rigorous Cyber Essentials Plus, are the baseline I'd look for in the UK, since they're independently assessed rather than self-declared, and the NCSC's own Cyber Essentials scheme is worth reading through even if you never hire anyone, just to understand what "good" actually looks like. I've written more about the tools and habits I'd personally put in place either way in my cybersecurity buying guide for small businesses, since a good provider should be reinforcing those basics, not replacing the need for them entirely. A provider who's never heard of the scheme, or dismisses it as unnecessary paperwork, is a provider I'd want to ask a lot more questions of before signing anything.

The Contract Details Everyone Skips Reading

This is the part people rush past, and it's usually where the regret shows up later. I'd want to know exactly what's included in the monthly fee versus what gets billed as an "incident," because a shockingly common trap is a cheap retainer that turns into a huge bill the one time you actually need help. I'd also check the notice period for cancelling and whether your data and configurations are genuinely portable if you ever decide to leave, since being locked in with a provider you've lost confidence in is its own kind of risk.

Red Flags That Would Make Me Walk Away

Fear-based sales pitches are the biggest one for me. Anyone leading with worst-case horror stories designed to panic you into signing immediately, rather than a calm assessment of your actual exposure, is telling you how they'll behave later too. I'd also be cautious of a provider who can't clearly explain what they don't cover, since the gaps in a contract matter just as much as what's included, and I'd walk away from anyone who gets defensive rather than curious when I ask a genuinely basic question. A password manager like NordPass is worth using internally regardless of who you hire, since it closes off one of the most common ways a business actually gets breached in the first place, no external provider required.

Ongoing Support or One-Off Help: Which Do You Need?

Not every business needs a monthly contract. If you're a sole trader or a small team with a handful of laptops, a one-off setup to get the basics right, plus a clear plan for what to do if something goes wrong, might be all you need for now. If you hold a lot of customer data, take card payments online, or have staff working from several places, an ongoing managed service starts to make more sense, because someone is watching for problems while you get on with running the business. A good provider will tell you honestly which one you are, even if it means a smaller invoice for them.

Choosing a Cybersecurity Company: Questions I Get Asked

Do small businesses really need a cybersecurity company?

Not always straight away. Getting the basics right, like two-factor authentication, updates, backups and a password manager, covers a huge amount of risk on its own. A provider becomes worth it once you hold sensitive data or can't afford a day of downtime.

What is Cyber Essentials?

It's a UK government-backed scheme that checks your business has five basic protections in place: firewalls, secure settings, controlled user access, malware protection and keeping software updated. It's a sensible baseline for any business, and some contracts now ask for it.

What's the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a self-assessment that's independently reviewed. Cyber Essentials Plus adds a hands-on technical check by an assessor, so it carries more weight.

What questions should I ask before hiring a provider?

Start with what happens out of hours, what's included in the monthly fee, and how you'd leave if it didn't work out. I've put together the questions I'd ask before hiring any cybersecurity company as a separate checklist.

What a Good Fit Actually Looks Like

The best working relationship I've seen between a small business and a cybersecurity company looks less like a vendor and more like a colleague who happens to specialise in something you don't have time to learn yourself. They explain things without condescension, they're upfront when something isn't their area, and they'd rather prevent an incident than bill you for cleaning one up. If a provider passes that test alongside the practical checks above, I'd feel genuinely comfortable recommending them.

My Safety Toolkit has the tools and settings I'd put in place myself regardless of who you end up hiring, and if you want a second opinion on a contract or a provider you're considering, feel free to get in touch. I'm always happy to look over the details before you sign anything.

I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.

Keep reading

This guide is part of Kells Security Solutions, where I explain online safety in plain English. Next, have a look at cybersecurity advice for small businesses or how to build a password worth trusting. If something has already gone wrong, here is where to report a scam in the UK.