The five steps to do before buying anything.
Most of what protects an SME cannot be ordered: it has to be done. Five steps, a week of work, no licence. What can be bought comes afterwards — and costs less once those five are done.
Published on 4 August 2026 · 6 min read · by the SkyNet technical team
A salesperson calls in on a Tuesday. They leave a quote behind: licences per user, a console, a monthly subscription. The document is a serious one. It simply comes too early in the order of things.
In the installations we take over, what is missing is almost never a product. It is a visitor network plugged into the same wire as the till. A mailbox protected by a single password. A backup that nobody has ever tried to restore. A firewall (the equipment that filters what comes in and out of your network) left on the version it had the day it was installed. And, on the evening of the incident, nobody who knows which number to dial.
None of these five points is settled with a licence. All of them are settled with hours: that is the only compulsory expense.
Five steps.
A week’s work.
None of the five requires a purchase order. All of them require sitting down for an hour, looking at what is actually plugged in, and writing down what was found.
Separate the WiFi used by visitors.
A network is a corridor. By default, everything plugged into it can talk to everything else: a guest’s phone, a contractor’s computer, the accounts server. On a flat network (without segregation), an unknown laptop that joins the waiting-room WiFi is, from the network’s point of view, a colleague.
The step: two separate WiFi networks, on two VLANs (separate lanes inside the same cable), and a firewall rule that forbids the visitor corridor from going to look at the business corridor. On professional hardware, that is an afternoon of configuration. On a consumer box, it is often impossible — and it is the only place in this article where a purchase is justified from the outset.
Two-factor authentication on email.
Two-factor authentication (a second code, on your phone, in addition to the password) does not make your password unbreakable. It makes it useless to whoever steals it. A password on its own can be replayed from anywhere in the world, silently, for weeks.
Yet payment fraud does not start with a virus: it starts with someone reading a mailbox. The attacker watches who pays whom, then slips in at the right moment with new bank details. And a compromised mailbox is a personal data breach, to be notified to the CNIL within 72 hours — the GDPR provides no exception for small organisations. It is free everywhere: start with management, accounts and purchasing.
Restore a backup. Once, for real.
A backup that has never been restored is not a backup: it is a hypothesis. What you discover when you try is always of the same kind. The files are copied, but not the database of the business software. The vault password left with the person who created it. Or putting everything back takes more time than the business can withstand.
The step: pick a folder that matters, put it aside, delete it, then put it back from the backup. Time it. Write the date and the duration on a sheet of paper. Do it again every six months. Check at the same time that a copy lives off the network: ransomware (a program that encrypts your files and demands a ransom) also encrypts any backups it can reach.
Update the firewall and the access points.
Nobody thinks about them, because those boxes never complain.
A workstation asks for its updates. A firewall does not: it goes on working exactly the same, years later. Except that the flaws fixed by the manufacturer are published — and therefore known to everybody, except you.
- Make the list — firewall, WiFi access points, switches, backup router, with the version installed on each.
- Compare with the latest version published by the manufacturer.
- Schedule it for the evening — a firewall update cuts the link.
- Change the administrator password — it is still often the technician’s.
Know who to call at 21:00 on a Saturday.
That one costs nothing, and it is the one most often missing. On the evening a workstation displays a ransom demand, the question is not technical, it is organisational. Who decides to unplug everything? Who tells the staff? Where is the list of numbers, if email is precisely the problem?
The step: one printed A4 sheet, in a drawer and in a car. Five lines on it. Who decides in the director’s absence. The direct number of your network provider, not its switchboard. Your insurer, with the policy number. Your bank, to stop payments in progress. The police station or the gendarmerie where you file the complaint. And the reflex: you unplug the network cable, you do not switch the machine off — a machine that is switched off loses evidence.
What we do not sell
Saying it beforehand is better than discovering it along the way.
- No SOC — we do not run a centre that watches your workstations 24 hours a day.
- No managed EDR — we do not take on the continuous watching of your computers by analysts.
- No incident response — if you are attacked tonight, we are not the right people to call.
- The link, operated under our own Arcep operator identifier: SKBS
- The network, its segregation, its filtering rules
- The equipment, its configuration and its versions
- Monitoring of what we operate — and a written scope, with what is not covered
A provider that claims to cover everything has not read its own contract.
Five questions
that do the sorting.
A provider who answers those five precisely has looked at your installation. One who answers with a product range has not opened it yet.
- “Which network is the visitors’ WiFi plugged into?” Then: show me the rule that stops it reaching the accounts.
- “What is the date of the last successful restore?” And how long it took.
- “Which version is running on my firewall?” And which is the latest published by the manufacturer.
- “What does your contract cover outside working hours?” On what number, and within what written time.
- “What is NOT covered?” Silence on that particular question is already an answer.
We have no figure to give you on the average cost of an incident, and we will not invent one. The only one that concerns you is measured at your own premises: how many hours your business can hold out without a network, without a telephone and without business software.
What to remember
- Four of the five steps cost no licence at all: they cost hours.
- A backup that has never been restored is not a backup. The date of the last successful test is the only figure that counts.
- Visitor WiFi placed on the same network as the accounts cancels out everything else, whatever product has been bought.
- We sell neither a SOC, nor workstation monitoring, nor incident response. We hold the link, the network and their segregation — and we write it down.
Have your network looked at before you buy
How your networks are separated, what version your equipment is running, what your current contract really covers. You leave with a written document — including what we do not know how to do.