NexusSec.There is an awkward stage most growing businesses pass through. The network is no longer simple enough to ignore, but not yet complex enough to justify a full-time technical hire. It usually lasts a couple of years, and it is where most of the avoidable damage happens.
Why this stage is the dangerous one
At ten people, everything fits in one person's head and the exposure is genuinely small. At two hundred, there is an IT team and a budget. In between, the estate has grown past what anyone is tracking, while the assumption that it is somebody's job quietly persists without that somebody existing.
The specific failure pattern is consistent: an office manager or a director's relative has admin access for historical reasons, an external contractor set something up two years ago and still has a way in, and nobody has looked at the backup since it was configured. None of these are visible until they matter.
Days 1 to 30: get the keys back
Start with control, not with technology. Find out who can administer the firewall, the servers, the domain registrar, the hosting account and the email tenant. Write the list down. It is usually longer than expected and includes at least one person who has left.
Then move credentials into a password manager the business owns rather than an individual. This is unglamorous and it is the single highest-value thing on the list, because every other control depends on it. If you do nothing else in ninety days, do this.
While you are in there, remove access for anyone who has left, and for suppliers who finished a project and never had access revoked. That pattern shows up in almost every assessment we run.
Days 30 to 60: close the two doors that matter
Multi-factor authentication on remote access and on email. That is the whole task. It is not exciting and it prevents more real incidents than anything else available at this size, because stolen passwords are how most compromises start and multi-factor authentication makes a stolen password insufficient on its own.
Do email first if you have to choose, because business email compromise, where somebody reads your mail and then sends a convincing invoice with changed bank details, is the attack that most often produces a direct financial loss at this scale. Domain authentication helps here too; see email security and DMARC.
Days 60 to 90: prove you can recover, and write it down
Restore something from backup. Not check that the backup ran, actually restore a file or a machine and time it. Businesses discover their backup has been silently failing for months during an incident, which is the worst possible moment for that discovery.
Then produce two documents. A network diagram, even hand-drawn, showing sites, links, firewalls, servers and where things physically are. And an inventory of what each server does and who supplies it. Both should live where the business can reach them, not on one laptop.
That is ninety days. No hire, no large project, and the majority of the risk that ends small businesses has been addressed.
What to deliberately leave alone
We sell security services, so this section is against interest, but it is the part most worth reading.
Do not buy a penetration test yet, unless a customer or insurer has specifically demanded one. Testing an undocumented network with shared admin passwords produces findings you could have predicted, and spends money that would do more good on the four items above.
Do not buy a SIEM, a threat intelligence feed, or anything described as AI-driven. At this size they generate alerts nobody has time to read, which is worse than no alerts because it manufactures a feeling of coverage.
Do not restructure the network yet. Segmentation is genuinely valuable and it is a later problem; get control and recovery sorted first.
When to actually hire
The trigger is usually not headcount, it is sites. One office with a competent office manager and an external supplier works for a long time. The moment there are two or three locations, someone internal needs to own it, because coordination becomes a daily job rather than an occasional one.
Even then, the first hire is usually a generalist who keeps things running, with specialist engineering brought in for design and security work. That is more resilient than one person carrying everything, because knowledge sits in more than one place. Our managed services are built for that arrangement.
A note on frameworks
If you want to check this plan against something neutral, the first controls of the CIS Critical Security Controls cover inventory, credentials and recovery in roughly this order, and the NIST Cybersecurity Framework frames the same ground. CERT-In publishes India-specific advisories worth watching once the basics are in place.
What to do this week
Write the list of who has administrative access to what. On paper, in an hour, from memory, then verify it. Almost every business that does this finds at least one entry that should not be there, and finding it is free.
