When people ask me what the biggest cybersecurity risk is, they usually expect me to say ransomware, phishing or artificial intelligence.

My answer is much simpler.

People.

Not because people are careless, but because bad habits become normal. Those habits eventually catch up with a business, regardless of how much money has been spent on technology.

This is a true story from our time providing managed IT support and business cybersecurity services. We’ve deliberately kept the customer anonymous, but the lessons apply to thousands of UK businesses.

The First Cyber Attack

Before they became a customer of Castra Solutions, the business suffered a serious cyber breach.

The attack destroyed almost nine years of business data.

Imagine arriving at work and discovering years of customer records, financial information, documents and project files had simply disappeared.

That wasn’t just an IT problem.

It affected productivity, customer confidence, staff morale and ultimately the business itself.

After the attack, they came to us looking for help.

Building a Secure IT Environment

We completely reviewed their IT infrastructure and implemented a layered cybersecurity strategy.

That included:

• Advanced endpoint protection
• Email security
• Multi-layered threat detection
• Secure backups
• Continuous monitoring
• Microsoft 365 security hardening
• Identity protection
• Managed IT support
• Regular maintenance and security reviews
• Segmented network
• Firewalls
• Resilience
• Awareness training
• Simulation testing

No single product protects a business.

Good business cybersecurity comes from multiple security controls working together.

For several years, those controls did exactly what they were designed to do.

The Challenge Was Never the Technology

The difficult part wasn’t installing security software.

It was changing behaviour.

Despite regular conversations, reminders and recommendations, the same risky habits continued.

Passwords were shared between colleagues.

The same passwords were reused across multiple systems.

Passwords were written on Post-it notes and left attached to monitors.

Old devices appeared from cupboards and were plugged straight into the network.

One day an external hard drive from a computer that had been involved in the original cyber breach was connected into the business network.

Nobody asked first.

Nobody considered the risk.

Fortunately, our security systems immediately detected suspicious activity and prevented anything more serious from happening.

It wasn’t the only time.

Our security platform quietly blocked threats, detected unusual behaviour and prevented countless issues from becoming major incidents.  We provided plain English details and recommendations in our monthly service reports but nothing changed.

In truth, our systems were working incredibly hard to compensate for risky user behaviour.

Then They Changed IT Provider

The business decided to move to another IT company.

That happens. Businesses change suppliers all the time and this one had done so 4 times in three years.

What concerned us wasn’t that they were leaving.

It was the thinking behind the decision.

The new provider reportedly told them that all they really needed was Microsoft Business Premium.

Let’s be absolutely clear.

Microsoft Business Premium is an excellent product but buying Microsoft Business Premium doesn’t automatically make a business secure.  You need other third-party tools to go with it.

It’s like buying the best alarm system available and then leaving the front door unlocked.

Without the right configuration, continuous monitoring, user education and proactive management, you’re only using a fraction of what you’re paying for.

Even more importantly, the new provider had no knowledge of the company’s history.

They hadn’t experienced the previous breach.

They hadn’t seen passwords written on sticky notes.

They hadn’t witnessed shared logins.

They hadn’t watched old storage devices being connected to live systems.

Because they operated remotely, many of those day-to-day behaviours simply weren’t visible.  Also because they were product led not requirements led, they left the client with cyber security gaps.

Two Months Later…

Around two months after we handed over support, the business suffered another cyber breach.

We weren’t involved, so we can’t comment on the exact technical details of what happened but we know it was an email compromise.

Technology alone doesn’t stop cyber attacks.

People, processes and technology working together do.

Each time this client chose an new IT provider, the new company was initially fully trusted as an expert.

There were no meaningful background checks.

No customer references.

No independent reviews.

No competitive quotations.

No real due diligence.

At the same time, the same risky behaviours inside the business continued.

Changing your IT provider doesn’t automatically improve your cybersecurity.

Changing your cybersecurity culture does.

The Biggest Mistake Businesses Make

One of the biggest misconceptions we see is that cybersecurity is something you can buy.

It isn’t.

You can buy software.

You can buy licences.

You can buy firewalls.

You can buy antivirus.

But cyber resilience comes from people making better decisions every single day.

That’s why effective managed IT services include far more than fixing computers.

They involve educating users.

Questioning unsafe practices.

Reviewing risks.

Monitoring systems continuously.

Testing backups.

Responding to threats before they become incidents.

Technology is only one layer of protection.

Before You Choose Your Next IT Provider…

If you’re considering changing your IT support provider, ask a few simple questions.

• Can they provide customer references?
• Do they understand cybersecurity, not just IT support?
• What monitoring do they provide?
• How do they help change user behaviour?
• What happens after installation?
• Who is responsible for keeping your business secure every day?

If the conversation only focuses on licences and price, you’re probably not getting the full picture.

Final Thoughts

Cyber criminals are getting smarter every year.

Businesses need to do the same.

The strongest cybersecurity strategy isn’t built around a single product. It’s built around experienced people, proven processes and technology that is actively managed.

At Castra Solutions, we’ve always believed that managed IT support, cybersecurity, business WiFi, Microsoft 365 security, network security, cloud services and user education all work together.

Because after nearly two decades in the industry, we’ve learned one simple truth.

The biggest vulnerability in any network usually isn’t the firewall.

It’s the habits that people think are harmless.

Get in touch to find out more