The questions we get asked.
Straight answers to the things clients ask on scoping calls, written down so you can read them before you call us.
Who is allowed to take control of your screen?
Remote support software is how your IT provider fixes your laptop. In September it was also how attackers got in, by two different routes.
Read →The apps plugged into your systems
You checked the platform. Nobody checked the chat widget, the store app or the connector a contractor installed three years ago.
Read →The invoice that came from your supplier's real mailbox
Nothing about the email is fake. The domain is right, the thread is real, and the bank details are new. This is the fraud that costs the most money.
Read →SPF, DKIM and DMARC: why your email lands in spam
Three DNS records decide whether Gmail believes your mail is yours. Getting them right also stops other people sending as you.
Read →Microsoft 365 deadlines between now and April 2027
Microsoft retires a great deal that never affects a 30-person office. Five of the current batch do, and one of them needs action this month.
Read →The Microsoft sign-in method you should probably turn off
Device code flow was built for smart TVs and meeting room screens. It is now a reliable way to take over an account without ever seeing the password.
Read →The Cyber Essentials mark: what it takes to pass
CSA's baseline certification, in plain terms. Five control areas, most of them configuration rather than purchase, and subsidy available for Singapore SMEs.
Read →Your staff are already pasting company data into ChatGPT
Banning it does not work and blocking it rarely holds. The practical answer is to give people one approved tool and make that one the easiest to reach.
Read →Offboarding someone properly on their last day
Disabling the account is about a third of the job. The parts people miss are active sessions, the apps outside Microsoft 365, and where the mailbox goes next.
Read →What does an MSP cost in Singapore, and what drives the price?
We do not publish a price list. Here is what actually moves the number, and why packaged tiers usually cost more.
Read →In-house IT or outsourced: when to switch
Rarely a question of cost alone. It is coverage, depth, and what happens when your one IT person takes leave.
Read →How to protect email on Business Basic or Standard
The July 2026 packaging change gave these plans link checking at time of click. It is useful, and it is not the same as Defender for Office 365.
Read →Business Basic vs Standard vs Premium: what you actually get
The gap between Standard and Premium is not more Office. It is the entire security and device management layer.
Read →Do I need to buy EDR if my license is Business Premium?
Usually not. Business Premium already includes Defender for Endpoint — the question is whether anyone has switched it on.
Read →Work email on personal phones
Most staff read work email on their own phones. The question is what happens to that mailbox when the phone is lost or the person leaves.
Read →Before anyone resets a password over the phone
Some of the most damaging attacks of recent years started with a call to a helpdesk. The caller sounded like staff and asked for a reset.
Read →Do I need MDR if I already have Microsoft Defender?
Defender is the detection tool. MDR is the people who read what it produces. Whether you need both depends on who is awake at 3am.
Read →Stop. Look. Think.
Never click a link or open an attachment you were not expecting. Five signs worth a second look, and what to do if you already clicked.
Read →Why staff training beats buying another security product
Most incidents start with a person making a reasonable decision on a convincing page. No product catches all of that.
Read →We got phished. What happens in the first hour?
Speed matters more than blame. Cut the attacker off, work out what they touched, stop it working on the next person.
Read →Onboarding: what a new hire needs on day one
Account, laptop and file access ready by 9am. Most of it can be done the week before, if someone tells IT the start date.
Read →Is Microsoft 365 backed up?
No. Microsoft protects the platform; your data inside it is your responsibility, and the built-in retention is shorter than most people assume.
Read →Intune vs NinjaOne: which patches what, and why we use both
Windows updates and third-party application updates are different problems. The second one is how most estates get breached.
Read →Who can see the files you have shared outside the company?
Sharing a file takes two clicks. Few businesses have ever checked how many of those links still work, or who holds them.
Read →PDPA: what a small business in Singapore actually has to do
The obligations are lighter than most people fear and broader than most people assume. The practical version.
Read →New office IT setup: a checklist for Singapore businesses
Fit-out timelines slip. Internet line applications do not care. The order things need to happen in, and how early to start.
Read →Quick answers
Shorter questions that come up often enough to write down.
How do I protect email on Business Basic or Standard?
Since July 2026 both plans include URL time-of-click checking, but that is a subset of Safe Links rather than Defender for Office 365 — despite what a lot of coverage claimed. You still do not get Safe Attachments, impersonation protection or threat reporting. Start with the free controls: MFA everywhere, legacy authentication disabled, SPF, DKIM and DMARC configured properly, external auto-forwarding blocked, audit logging on. Then either add Defender for Office 365 P1 as an add-on, or move to Business Premium — the gap is now USD8 and buys considerably more than mail security.
Read the full article →Do I need MDR if I already have Microsoft Defender?
Defender is the detection tool. MDR is the people who read what it detects. Defender will raise an alert at 3am; without someone watching, it sits in a portal until Monday. Managed detection and response adds 24/7 human triage, correlation across endpoints, servers and Microsoft 365, and containment while the incident is still small. If you have a security team covering nights and weekends, you may not need it. Most businesses under a few hundred staff do not.
Read the full article →Business Basic vs Standard vs Premium: what do you actually get?
Basic is cloud services only — no installed Office apps on the desktop. Standard adds the desktop apps. Premium is the meaningful jump: it adds Entra ID P1 with Conditional Access, Intune for device management, Defender for Business as endpoint protection, Defender for Office 365 for mail security, and Azure Information Protection. Since July 2026 Standard costs USD14 and Premium is unchanged at USD22, so the gap has narrowed to USD8 for that entire security and management layer. For most businesses Premium now costs less than buying those pieces individually.
Read the full article →Intune vs NinjaOne: which patches what?
We use Intune for Windows and operating system updates, and NinjaOne for third-party applications and non-Windows patching — the browsers, PDF readers and runtimes that are the more common way in. Where a client is on Business Basic or Standard and has no Intune entitlement, NinjaOne handles both. Either way the compliance position is reported per device, so you can see what is patched rather than assume it.
Read the full article →Why does staff training beat buying another security product?
Because the majority of incidents we respond to start with a person, not a system. Someone enters credentials on a convincing page, or approves an MFA prompt they did not trigger. No filter stops all of it. Short, regular training with realistic phishing simulations moves click rates measurably within a few months, and it costs a fraction of another security platform. It is also the control that improves the effectiveness of everything else you own.
Read the full article →