A business owner asks his provider whether they are secure. The answer is yes, they have antivirus and a firewall.
Both are true and neither addresses how a small business is realistically compromised, which is usually a stolen password, an email that looked genuine, or a system that was never patched.
Eighteen months later somebody signs in to a company email account from another country, and the insurer's first question is whether multi factor authentication was enabled.
Ask 1: is multi factor authentication enabled everywhere
Email, remote access, administrative accounts and any cloud system. This single control prevents the most common realistic compromise and its absence is what insurers ask about first.
Ask 2: who has administrative access and why
Administrative rights on everyday accounts turn a single compromise into a complete one. This is basic, it is frequently wrong, and it costs nothing to fix.
Ask 3: how is patching actually managed
Not whether updates happen. Which systems, how often, how it is verified and what happens with anything that cannot be patched.
Ask 4: are the backups tested
Existence is not the question. When a restore was last performed successfully is, and a business that cannot name the date of the last successful restore does not have working backups.
Ask 5: what protects the email
Filtering, impersonation protection and what happens with a convincing invoice change request. Email remains where most losses actually originate.
Ask 6: what happens when somebody leaves
Accounts disabled, access removed, devices returned and credentials changed. This is a common and entirely preventable exposure.
Ask 7: how are devices managed
Encryption, screen locks, the ability to wipe a lost device and what happens with personal devices used for work.
Ask 8: what would we do in an incident
Who is called, what the first steps are and whether anybody has practised it. A plan nobody has rehearsed is a document rather than a capability.
Ask 9: what is not covered
The most useful question in the whole list. Every arrangement has boundaries and knowing them is what lets a business decide whether to close the gap.
Ask 10: what does our insurance require
Policies increasingly specify controls. Reading the requirements and checking each one is a short exercise with substantial consequences.
Ask 11: what training do our people get
Most incidents involve somebody doing something reasonable that turned out to be a mistake. Short, regular, practical training is more effective than any tool.
Ask 12: how would we know something had happened
Monitoring, alerting and who reviews it. Many small business compromises run for months undetected because nobody was looking.
Ask 13: what about the systems we bought ourselves
Cloud services signed up for by departments, which the provider may not know exist and therefore is not protecting.
Publish the honest answers to all of this
An assistant that answers what is included, what is extra, what the provider covers and what a client needs to arrange themselves turns a vague reassurance into a conversation a business can act on. The breach concerns sit in security questions from clients worried about a breach, the service picture in managed service enquiries from small businesses, the same scrutiny of any vendor in ai chatbot security questions to ask a vendor, and the banking equivalent in business account questions small firms ask. See features, start at try, and the sector view sits under it services.