A practical security software buying plan for a UK small business

Start with the work you cannot afford to lose

Write down the services your business needs to trade: email, bookings, finance, customer records and shared documents. For each, identify an owner, administrator and recovery contact. Use this inventory to define a buying brief rather than starting with a vendor's longest feature list. Our suggested first exercise is simple: imagine the office laptop and the usual administrator are both unavailable tomorrow. Record who could regain access, what information would be missing and which customer promises would be affected.

• List critical services and business owners.
• Identify unmanaged devices and shared administrator accounts.

Separate three different buying decisions

A password manager controls stored credentials and sharing. Endpoint protection detects or restricts suspicious behaviour on devices. Backup software maintains recoverable copies. These overlap in some suites, but one subscription should not be assumed to perform every job. The NCSC's small-organisation guidance treats accounts, devices and backups as distinct areas of protection. Use our category comparisons to create separate requirements, then ask whether a proposed bundle meets each one. Prefer a configuration your team can operate consistently over one with many unused controls.

• Name the person responsible for each control.
• Identify services already included in existing subscriptions.

Use an account-lifecycle demonstration

Ask the password supplier to demonstrate a new starter receiving access to a shared business record, a contractor being restricted to one project, and a departing employee losing access while company information remains available. Include recovery when the administrator loses their phone. Where AI agents use business credentials, test a separate identity with limited scope and an attributable access record. A secret-management add-on may be required; the presence of AI branding does not establish those controls. Keep test credentials separate from production data.

• Test revocation as well as onboarding.
• Record the precise plan and add-ons demonstrated.

Establish who responds to device alerts

For endpoint tools, bring the actual mix of Windows, Mac and server versions into the evaluation. Ask the supplier to walk through a safe sample alert, device isolation, investigation and release back to normal operation. Decide who reviews alerts when your main administrator is absent. A dashboard is useful only when someone has the time and authority to act. If an IT provider performs this work, request a written responsibility map covering alert handling, escalation, maintenance and reporting. Do not assume detection means the incident is resolved.

• Check server licensing separately.
• Test how urgent alerts reach a responsible person.

Buy a recovery outcome

Choose a representative deleted file and a critical workload, then agree acceptable data loss and downtime for each. During a trial, restore to a safe location and check the result with the person who uses the information. Test retrieval over your normal connection, including any large download or transfer charge. Ask what happens when a user, administrator or attacker tries to delete retained copies. Deletion protection has configuration and retention limits; a successful backup notification alone does not show that the business can resume operating.

• Record restore time and missing data.
• Include credentials and recovery instructions in the exercise.

Compare the complete UK operating cost

Request a quote for your device, user, workload and storage counts, with ordinary renewal pricing, billing currency and VAT treatment. Clarify hosting location, support hours, subcontractor access and the process for leaving the service. A UK sales office does not establish UK-only storage. Include implementation, staff training and any managed-service labour in your comparison. Record a small set of acceptance tests in the purchase brief, assign owners, and repeat the recovery and access-removal exercises after material changes. Make renewal conditional on a short evidence review: current device coverage, access changes, unresolved alerts and the most recent successful recovery exercise, with exceptions assigned to someone who can resolve them.

• Keep the quote and configuration together.
• Review coverage when staff, systems or suppliers change.

Explore the comparisons