Website and web apps
Customer portals, booking systems, online forms and admin logins, tested against common web vulnerabilities.
Dacres AI×Security
For businesses with 5–250 staff
Find the weak spots
before someone else does.
Authorised vulnerability testing for small and growing businesses, with findings in plain English and the fixes carried out for you. Not just a report you have to work out yourself.
Nothing is tested without a written scope and your signed permission.
↗Know where you are exposed↗Fixes done, not just listed↗Proof for clients and insurers
Why SMEs get caught out
Attackers don’t check
how big you are first.
Most attacks on smaller businesses are automated: scanners look for an unpatched server, a reused password or an email account without multi-factor sign-in. Large firms have security teams for this. Most SMEs have an IT provider stretched thin, or nobody at all. We give you a clear picture of what is exposed, then help close the gaps in order of risk.
What we look at
The places problems usually start.
Email and Microsoft 365 / Google
Sign-in protection, admin accounts, sharing settings, and SPF, DKIM and DMARC to make your domain harder to spoof.
Network and remote access
Internet-facing systems, open ports, VPNs and remote desktop, firewalls and out-of-date software.
AI tools and automations
What data staff put into AI tools, what your integrations can access, and whose credentials they run on.
Three ways to work together
Test it. Fix it.
Keep it fixed.
Start with a health check, go further with a full test and fix, or keep things covered month to month. Each is scoped to your business before any work begins.
01 / Start here
Security Health Check
A fixed-scope review of your internet-facing systems and core accounts. A clear picture of where you stand, with a prioritised fix list in plain English.
- External vulnerability scan
Your website, domains and internet-facing systems, checked for known weaknesses.
- Email and account review
Microsoft 365 or Google Workspace settings, admin access and multi-factor sign-in.
- Email spoofing check
SPF, DKIM and DMARC records, so others can’t easily send email as you.
- Prioritised fix list
What to fix first, what it involves, and what you can safely leave.
A clear starting point · fixed scope
02 / Test and fixMost complete
Vulnerability Test & Fix
A deeper, authorised test of the systems that matter most, then we carry out the fixes with you and retest to confirm each issue is closed.
- Authorised vulnerability testing
Web apps, networks and cloud services, within a written scope and agreed testing window.
- Fixes carried out
Patching, configuration hardening, access clean-up and multi-factor roll-out, scheduled around your working day.
- Retest and close-out report
Each finding retested and marked fixed, accepted or outstanding, so you have a record to show clients and insurers.
Found, fixed and checked · agreed milestones
03 / Keep it fixed
Managed Security
Ongoing monitoring and support so new weaknesses are spotted and dealt with, not discovered by someone else. A monthly retainer, scoped to your systems.
- Monthly scanning and reports
Regular checks of your internet-facing systems, with new issues flagged and explained.
- Patch and configuration watch
Keep track of updates and settings drift across your key systems.
- Staff phishing awareness
Short, practical training and simulated phishing emails, run with your agreement.
- Help when something looks wrong
A named contact to call when something looks suspicious.
Ongoing cover · monthly retainer
Illustrative scope, not off-the-shelf packages. We confirm the systems in scope, testing windows, access and permissions in writing before any testing starts. Fees are agreed against that scope.
How an engagement works
Permission first. Then test, fix, prove.
Agree exactly what is tested
We list the systems, testing windows and contacts, and you sign written authorisation. If a system is hosted by a third party, we confirm their permission too.
Find what is exposed
We run the agreed tests, then walk you through the findings in plain English, ranked by risk to your business rather than by technical score.
Close the gaps, with evidence
We carry out or support the fixes with your team or IT provider, then retest and hand over a close-out report showing what changed.
Careful testing.
No surprises.
No surprises.
We never test without written permission, and we agree testing times so live systems aren’t disrupted. Findings and any data we see are handled confidentially, kept only as long as agreed, and shared only with the people you name.
Before we start
Practical questions.
Straight answers.
We already have an IT provider. Do we still need this?
Often, yes. IT support keeps things running; a test checks whether they are secure. We work alongside your provider, share findings with them and can hand fixes to them or carry them out ourselves.
Could testing break anything?
Testing is planned to avoid disruption. We agree what is in scope, when tests run and who to contact, and we avoid anything risky on live systems unless you have specifically agreed to it.
Will this help with certifications, client questionnaires or insurance?
It can help you prepare. Fixing findings often covers technical controls that schemes such as Cyber Essentials or ISO 27001 look at, and typical insurer or client security questions, and the close-out report gives you evidence of what was done. Certification itself is awarded by an accredited certification body.
We’re small. Is it worth it?
Start with the Health Check. It is fixed in scope and shows whether you have real gaps. If it finds little, we’ll tell you, and you don’t need to go further.
Let’s check where you stand
Find it. Fix it. Prove it’s fixed.
Tell us roughly how many staff you have, which systems you use (website, Microsoft 365 or Google, remote access) and whether you have an IT provider.
Book a 30-minute call hello@dacres.ai
No obligation. We’ll suggest a sensible first step,
and tell you if you don’t need us.