Ongoing IT support · under subscription
Business cybersecurity in layers matched to risk and budget
We start with the safeguards that give the most at your scale: a second sign-in factor, tidy accounts and a tested backup. For each layer, we tell you what it costs and what it does not cover.
When to deal with IT security in your business
You don't need to wait for an incident. These situations are reason enough.
If you recognise two or three of these signs, a free IT review will show you where to start.
- Staff sign in to business email with just a password, no second factor.
- A backup exists, but nobody has ever checked whether data can be restored from it.
- Former employees may still have active accounts or access to files.
- The same admin passwords are used in several places.
- There's no device list, so nobody can say how many devices have up-to-date protection.
- The business processes personal data or client data covered by an NDA.
- An insurer or business partner has started asking about security in a questionnaire.
The layers of protection we implement as part of this service.
The order is deliberate. We start with the measures that give the most protection for the least money and move on to those that only make sense at a higher level of risk.
- 1
Two-factor authentication
A second factor for email, files and administrator accounts. One of the cheapest changes: a stolen password on its own is no longer enough to sign in.
- 2
Tidy accounts and permissions
Reviewing accounts, removing unused ones, limiting admin rights and separating admin accounts from everyday accounts.
- 3
Workstation and server protection
Deployment and maintenance of protection for computers and servers in a central console, with policies matched to each workstation. A basic option or an option with detection and response, depending on the risk.
- 4
Email security
Sender domain authentication with SPF, DKIM and DMARC, attachment filtering and rules for messages impersonating management. According to the ENISA Threat Landscape 2025 report, phishing accounted for about 60% of initial intrusion vectors.
- 5
Updates as a process
Security-critical updates go in first and are recorded. In the same report, exploitation of known vulnerabilities was the second most common intrusion vector (21%), including at businesses that run antivirus.
- 6
Backup as the last line of defence
Three copies of the data on two types of media, one of them off site, plus a restore test. After a successful ransomware attack this is usually the only way to recover data without paying a ransom, provided the attacker had no access to that copy.
- 7
Network segmentation
Separating the networks for guests, staff, production equipment and servers. This limits how far an attacker can get after compromising one device.
- 8
Incident reporting procedure
One page: what an employee does, whom they notify, what they must not do and who decides to cut a device off from the network. Once written, rehearsed with the team.
A consumer router is a door. A firewall is a security guard.
A door lets in anyone with a key. A guard checks who comes in and what goes out, and keeps a log. It makes sense from around ten workstations, or when you handle client data or work remotely.
What you get in writing.
Prioritised risk register
A list of identified risks ranked by impact and cost to fix, clearly marking what we haven't checked.
Security policy configuration
Device protection policies, email rules and authentication settings, described so that another engineer can recreate them.
Incident reporting procedure
A one-page sheet to put up near workstations, plus an extended version for the decision-maker with the order of actions and a contact list.
Backup restore test report
A document confirming that the backup was restored, exactly what was restored and how long it took. Dated and signed.
Who is responsible for what.
Security isn't a service you can buy in full and then stop thinking about. Part of the responsibility stays with you, and we'd rather say so up front.
On the NexaIT side
- deploying and maintaining the agreed protection layers and policies in the central console
- monitoring security alerts using the available tools, within your package's support window
- security-critical updates within the agreed scope
- technical support during an incident, including isolating devices and restoring data from backup
- regular configuration reviews and a protection status report
- backup restore testing in line with your package
On your side
- deciding which layers to implement and the licence budget
- approving two-factor authentication and communicating it to staff
- training staff to report suspicious messages
- telling us promptly when someone leaves, so their accounts can be blocked
- decisions on reporting an incident to the supervisory authority or to clients
- physical security of premises and storage media
- managing contracts with suppliers who have access to your systems
What this service doesn't include.
Clear scope boundaries are part of a good contract. We talk about them before the contract is signed.
For penetration testing, compliance audits and digital forensics, we help you find the right specialist and take part in the technical discussion. We leave the work itself to specialised teams.
Show the list of exclusions
- a guarantee that no incident will happen. No provider can honestly promise that
- penetration testing and compliance audits by a certification body
- legal representation and notifications to the supervisory authority, which are the data controller's decision and obligation
- post-incident digital forensics, a separate laboratory specialism
- recovering data from physically damaged media
- negotiating with attackers. We don't hold such talks and don't recommend paying a ransom
- the device protection licence, which we bill separately for each device
- monitoring outside the support window in the START IT and BUSINESS IT packages
Who the cybersecurity service is for
It makes sense if
- The business processes data whose loss or leak would have real consequences.
- You want to start with the things that give the biggest risk reduction at a reasonable cost.
- You need to answer a security questionnaire from a business partner or insurer.
- Safeguards need to be maintained and reviewed after deployment.
We don't recommend it if
- You are looking for a compliance certificate. That is a job for a certification body.
- You expect a guarantee that nothing will happen. We won't give one.
- An incident is already under way and you need digital forensics. Your first call should be to a specialist incident response team.
- The business isn't ready for two-factor authentication. Without it, the other layers are worth far less.
How much business cybersecurity costs
Workstation protection in the base package costs from PLN 19 net a month per device, and the option with threat detection from PLN 29 net. Assistance with deploying the console for up to 99 workstations costs from PLN 1,000 net, and an audit of an existing Bitdefender installation from PLN 500 net. Configuration of the second factor, accounts and backups is billed at PLN 280 net per hour or within the hours of a support package. The price depends on:
- the number of devices and servers to protect, because licences are billed per device
- the protection tier: base or detection and response
- the number of add-on modules, such as disk encryption or email security
- the starting point: no two-factor authentication and untidy accounts mean more work at the start
- the number of sites and whether the network needs physical segmentation
- whether a disaster recovery plan is needed alongside the backup
- whether reporting is required for a business partner or insurer
Questions before you decide.
Is antivirus included in the managed IT price?
No. It's charged per device, from PLN 19 net per month for base protection and from PLN 29 for detection and response. Keeping these separate is deliberate: you pay for the devices we actually protect, and our support price can be compared with other providers' offers.
Where would you start in a business with 15 workstations?
With two-factor authentication for email and admin accounts, a review of accounts left behind by former employees, and a backup restore test. These three things cost little, yet they limit the damage from a stolen password or encrypted data. Device protection and network segmentation are the next step.
What do you do when an incident happens?
We isolate infected devices from the network, secure what can be secured, assess the scope and start restoring data from backup. At the same time we inform the decision-maker, because some decisions, including notifying the supervisory authority, are yours as the data controller. We don't negotiate with attackers.
Is this enough for GDPR compliance?
It covers the technical side, and only that. Compliance also includes records, data processing agreements, legal bases and procedures, which are the data controller's responsibility, often with a lawyer's help. We say so plainly rather than selling technical safeguards as compliance.
From our projects, without client names.
All case studiesRelated
Free · 60 minutes online · no obligation
An IT review, an hour with an engineer instead of a sales presentation.
- You talk to an engineerOnline, by video call. Not with a salesperson. We don't install or change anything.
- We check 8 areasBackups, access, network, email, server, licences, protection and KSeF readiness.
- You get a scorecardThree priorities on one page, emailed after the meeting. Yours to use however you like.
office@nexait.plMessage us on WhatsApp
We don't use a contact form, but we answer the phone and reply to emails and WhatsApp messages during working hours.