Solutions / Security, Backup & Access
Security, Backup & Access
Security, Backup & Access Solutions
Security, backup and access tools protect accounts, data and websites and keep them recoverable. Start with what you are working on, see the main paths side by side and, where we list a suitable option, go to the provider when you are ready.
- Start from your situationFive business contexts
- Same criteria throughoutEight dimensions for every option
- Trade-offs up frontWhat to watch for, stated plainly
Which area are you working on?
Choose the closest match. Each context sets out the questions to ask, the main solution paths and, where we list one, a suitable option.
Managing passwords and access
Controlling who can sign in to what, and how credentials are kept and shared.
Protecting websites and online services
Keeping a website your customers rely on safe, monitored and recoverable.
Backing up and recovering business data
Making sure a lost device, a deleted folder or ransomware does not cost you your data.
Securing remote access and distributed work
Controlling who gets in when people work from different places and devices.
Protecting sensitive or regulated information
When the data you hold carries obligations beyond a small-business baseline.
Find the solution that fits
Work through the context that matches yours. For the full decision, read the Security, Backup & Access guide.
Affiliate links may earn Kybervega a commission. Disclosure
Managing passwords and access
In a small business, access often grows informally: a shared login for the social accounts, a spreadsheet of passwords, credentials pasted into a chat. It works until someone leaves, an account is compromised, or a client asks how you protect their access. The questions are where credentials live, who can see them and how access is controlled and recovered. Two things work together: a business password manager and multifactor authentication, with account recovery planned underneath both.
More about this context
In a small business, access often grows informally. A shared login for the social accounts, a spreadsheet of passwords, credentials pasted into a chat to get someone started, the same password reused across tools because it is easier to remember. It works until someone leaves, an account is compromised, or a client asks how you protect their access.
This section is about where credentials live, who can see them and how access is controlled and recovered. It covers business password management and the sign-in rules, such as multifactor authentication, that sit around it.
How the paths differ
Two things work together. A business password manager gives the team one controlled place to store and share credentials, with administrators deciding who can see what. Multifactor authentication adds a second step to sign-in on the accounts that matter, so a stolen password is not enough on its own. Account recovery sits underneath both: you want to be able to regain access without weakening the rest.
Supporting detail
Questions to ask yourself. 4 questions to settle first
- How are logins shared today, and who can see them?
- Is multifactor authentication required where it matters?
- What happens to access when someone leaves?
- How would you recover an account if the owner is unavailable?
Why this decision matters. What is at stake
Weak or reused passwords and credentials shared in plain sight are a common weak point. When someone leaves, the question becomes which accounts they could still reach.
A controlled place for credentials, with sensible sign-in rules, closes the most common gaps without changing how the team works.
Before choosing. A short checklist
- Check that administrators, not individuals, control who can see shared credentials
- Plan how existing credentials will be moved and who will do it
- Decide which accounts must require multifactor authentication, and how recovery works
- Check what happens to a leaver’s access, and how quickly it can be removed
- Check minimum user numbers and which features sit in higher tiers
Want the full background? Access: passwords and multifactor authentication
Choose the path that fits
Select a path to see why it fits and what to watch for.
Business password manager
One controlled place for the team’s credentials, with administrators deciding who sees what.
Best fit
- Shared team logins
- Required two-factor and sharing rules
Main thing to check
The team has to adopt it
Multifactor authentication and account recovery
A second sign-in step on the accounts that matter, with recovery planned before it is needed.
Best fit
- Several people on business accounts
- Email, banking, domain and hosting
Main thing to check
Plan account recovery first
Business password manager
Why choose it
- The team gets one controlled place for credentials, instead of chat messages and spreadsheets
- Administrators decide who can see what
- Sharing a login no longer means sharing the password in plain sight
Best when
- Several people share accounts and logins
- You want controls such as required two-factor authentication and sharing rules
Watch for
- It does not enforce good habits by itself, so the team needs to adopt it
- Moving existing credentials across is a one-off job
Full decision detail
Why it helps
- The team gets one controlled place for credentials, instead of chat messages and spreadsheets
- Administrators decide who can see what
- Sharing a login no longer means sharing the password in plain sight
Fits when
- Several people share accounts and logins
- You want controls such as required two-factor authentication and sharing rules
- You want privacy-focused tooling for business data
A tool that stores credentials for the whole team, lets you share them securely and gives administrators control over who can see what.
A business password manager stores credentials for the whole team, lets you share them securely rather than pasting them into chat, and gives administrators control over who can see what. It also generates strong, unique passwords, and some include built-in authenticators and monitoring. It does not enforce good habits by itself, so the team needs to adopt it, and moving existing credentials across is a one-off job.
When you may need more. If you need central control of sign-in across many services, including single sign-on, check what the higher tiers of a product offer.
Multifactor authentication and account recovery
Why choose it
- A stolen password alone is no longer enough
- Recovery is planned, not improvised
Best when
- Several people use business accounts
- You can manage the extra step for staff
Watch for
- Plan account recovery before you need it
- Staff need to know why it is required
Full decision detail
Why it helps
- A stolen password alone is no longer enough
- Recovery is planned, not improvised
Fits when
- Several people use business accounts
- You can manage the extra step for staff
Watch for
- Plan account recovery before you need it
- Staff need to know why it is required
A second sign-in step on the accounts that matter, with recovery routes planned before they are needed.
Multifactor authentication adds a second check to sign-in, such as a code from an app or a security key. Turned on for email, banking, domain, hosting and administrator accounts, it blocks the most common takeover route. The practical work is deciding which accounts require it, how staff recover access if they lose a device, and who can reset an account.
Protecting websites and online services
A website your customers rely on is part of the business, so an attack or a bad update costs you directly. Responsibility for it is shared between you, your host and your developer, and unclear ownership is where problems hide. Prompt updates, least-privilege administrator accounts and restorable backups close the most common routes in and are worth having before buying tools. Monitoring adds alerts, but alerts need someone who acts on them.
More about this context
Customers rely on your website, so an attack or a bad update costs you directly, and responsibility is shared between you, your host and your developer.
A website your customers rely on is part of the business, and responsibility for it is shared between you, your host and your developer. Unclear ownership is where problems hide.
How the paths differ
Website security and monitoring scans, filters bad traffic and alerts you to changes. Prompt updates, least-privilege administrator accounts and restorable backups close the most common routes in and are worth having before buying tools. Alerts need someone who acts on them.
Supporting detail
Questions to ask yourself. 4 questions to settle first
- Who is responsible for updates, you, your host or your developer?
- Who has admin access, and with what rights?
- How quickly would you know if something changed?
- Could you restore the site after a bad update or an attack?
Why this decision matters. What is at stake
When customers rely on a website, an attack or a bad update costs you directly. Responsibility is shared between you, your host and your developer, and unclear ownership is where problems hide.
Before choosing. A short checklist
- Alerts need someone who acts on them
- Monitoring does not fix weak passwords or unpatched software on its own
- Agree who is responsible for what (see the Hosting Guide’s responsibility table)
- Backups and updates still matter
Want the full background? The responsibility map: four things to protect
Choose the path that fits
Select a path to see why it fits and what to watch for.
Website security and monitoring
Scans, filters bad traffic and alerts you to changes.
Best fit
- Customers rely on the site
- Several people with admin access
Main thing to check
Alerts need someone who acts on them
Prompt updates and least-privilege access
Prompt updates, least-privilege admin accounts and restorable backups.
Best fit
- A baseline before buying tools
- Several people with admin access
Main thing to check
Tools do not fix weak passwords or unpatched software
Website security and monitoring
Why choose it
- You are alerted when something changes
- Bad traffic is filtered
- It is clearer who is responsible for what
Best when
- Customers rely on your website
- Several people have admin access
Watch for
- Alerts need someone who acts on them
- Monitoring does not fix weak passwords or unpatched software on its own
Full decision detail
Why it helps
- You are alerted when something changes
- Bad traffic is filtered
- It is clearer who is responsible for what
Fits when
- Customers rely on your website
- Several people have admin access
- You want to know quickly when something changes
Watch for
- Alerts need someone who acts on them
- Monitoring does not fix weak passwords or unpatched software on its own
- Agree who is responsible for what (see the Hosting Guide’s responsibility table)
- Backups and updates still matter
Website security and monitoring: it scans, filters bad traffic and alerts you to changes, alongside prompt updates, least-privilege admin accounts and backups.
Prompt updates and least-privilege access
Why choose it
- Closes the most common routes in
- Makes responsibilities explicit
Best when
- Several people have admin access
- You want a baseline before buying tools
Watch for
- Tools do not fix weak passwords or unpatched software on their own
Full decision detail
Why it helps
- Closes the most common routes in
- Makes responsibilities explicit
Fits when
- Several people have admin access
- You want a baseline before buying tools
Watch for
- Tools do not fix weak passwords or unpatched software on their own
Applying updates promptly, giving admin accounts only the rights they need, and keeping restorable backups.
How the two fit together
Show the comparison. The paths side by side
| What to look at | Website security and monitoring | Updates and least-privilege access |
|---|---|---|
| What it does | Scans, filters bad traffic and alerts you to changes | Closes the most common routes in and makes responsibilities explicit |
| Best suited to | A site customers rely on, where you want to know quickly when something changes | A baseline you want before buying tools |
| Main thing to check | Alerts need someone who acts on them | Tools do not fix weak passwords or unpatched software on their own |
No option listed yet
We’re currently reviewing suitable options for this area.
Backing up and recovering business data
Important files sit on laptops, in cloud accounts and on websites. A lost device, a deleted folder, a failed update or ransomware can cost data, and cloud sync is not a backup. A backup and recovery service copies data automatically and lets you restore it, following the 3-2-1 approach: three copies, on two types of storage, with one copy off-site. Website and server backups cover what lives on the web. A backup you have never restored is a hope, not a plan.
More about this context
Important files sit on laptops and in cloud accounts, and a lost device, a deleted folder or ransomware could cost you data. Cloud sync is not a backup.
Important files sit on laptops, in cloud accounts and on websites. A lost device, a deleted folder, a failed update or ransomware can cost data, and cloud sync is not a backup.
How the paths differ
A backup and recovery service copies data automatically and lets you restore it, following the 3-2-1 approach of three copies, on two types of storage, with one copy off-site. Website and server backups cover what lives on the web. In both cases, a backup you have never restored is a hope, not a plan.
Supporting detail
Questions to ask yourself. 4 questions to settle first
- Where does your important data live: laptops, cloud accounts, websites?
- When did you last restore from a backup?
- How long are copies kept, and who can delete them?
- How fast must you be back up and running?
Why this decision matters. What is at stake
A backup you have never restored is a hope, not a plan. Cloud sync is not a backup, and separate copies in separate places protect against loss of the original.
Before choosing. A short checklist
- A backup you have never restored is a hope, not a plan
- Check where copies live, how long they are kept, restore speed and who can delete backups
- Cloud sync is not a backup
Want the full background? Backup: the 3-2-1 approach and why testing is the point
Choose the path that fits
Select a path to see why it fits and what to watch for.
A backup and recovery service
Copies data automatically and lets you restore it, following the 3-2-1 approach.
Best fit
- Laptops and cloud accounts
- A regular, automatic routine
Main thing to check
Whether you have ever restored it
Website and server backups
Backups of a website or server, taken by the host or a plugin, stored away from the original.
Best fit
- Data you cannot recreate
- A way back from a bad update
Main thing to check
Copies kept only on the same server
A backup and recovery service
Why choose it
- Copies are made automatically
- Separate copies protect against loss of the original
- Restores can be tested before you need them
Best when
- Business data lives on laptops and in cloud accounts
- You want a regular, automatic routine
Watch for
- A backup you have never restored is a hope, not a plan
- Check where copies live, how long they are kept, restore speed and who can delete backups
Full decision detail
Why it helps
- Copies are made automatically
- Separate copies protect against loss of the original
- Restores can be tested before you need them
Fits when
- Business data lives on laptops and in cloud accounts
- You want a regular, automatic routine
- You can test a restore
Watch for
- A backup you have never restored is a hope, not a plan
- Check where copies live, how long they are kept, restore speed and who can delete backups
- Cloud sync is not a backup
A backup and recovery service: it copies data automatically and lets you restore it, following the 3-2-1 approach of three copies, on two types of storage, with one copy off-site.
Website and server backups
Why choose it
- A way back from a bad update or an attack
Best when
- Your website or server holds data you cannot recreate
Watch for
- Check where copies are stored and whether you can restore them yourself
- A backup kept only on the same server is not enough
Full decision detail
Why it helps
- A way back from a bad update or an attack
Fits when
- Your website or server holds data you cannot recreate
Watch for
- Check where copies are stored and whether you can restore them yourself
- A backup kept only on the same server is not enough
Backups of a website or server, taken by the host or by a plugin or tool, stored away from the original.
What each one covers
Show the comparison. The paths side by side
| What to look at | Backup and recovery service | Website and server backups |
|---|---|---|
| What it covers | Business data on laptops and in cloud accounts | A website or server |
| Best suited to | A regular, automatic routine you can test | A site or server holding data you cannot recreate |
| Main thing to check | Where copies live, how long they are kept, restore speed and who can delete them | Where copies are stored and whether you can restore them yourself |
No option listed yet
We’re currently reviewing suitable options for this area.
Securing remote access and distributed work
People sign in to business systems from different places and devices, and you need to control who gets in. When people sign in from different places, control of who gets in matters more than where they sit. Identity and two-factor tools give central sign-in, enforcement of multifactor authentication and account recovery. A business VPN encrypts traffic between a device and the VPN’s network and can restrict access to internal systems; it does not make you anonymous or protect you from phishing.
More about this context
People sign in to business systems from different places and devices, and you need to control who gets in.
When people sign in from different places and devices, control of who gets in matters more than where they sit.
How the paths differ
Identity and two-factor tools give central sign-in, enforcement of multifactor authentication and account recovery. A business VPN encrypts traffic between a device and the VPN’s network and can restrict access to internal systems; it does not make you anonymous or protect you from phishing.
Supporting detail
Questions to ask yourself. 4 questions to settle first
- Which systems should not be open to everyone?
- How do people sign in, and is it centrally controlled?
- Do internal systems need a private route in, such as a VPN?
- Can you manage the extra step for staff?
Why this decision matters. What is at stake
When people sign in from different places and devices, central control of who gets in matters more than where they sit. A VPN has a narrower job than it is often sold for.
Two jobs are easy to confuse: deciding who may sign in, and protecting the route they sign in over. Sign-in control and account recovery come first; a VPN adds a controlled route to internal systems and is worth choosing once you know which systems need one.
Before choosing. A short checklist
- A VPN does not make you anonymous or protect you from phishing or malware
- Marketing that promises more than a VPN provides
- Cost and complexity for a small team
- Plan account recovery before you need it
Want the full background? The tool classes
Choose the path that fits
Select a path to see why it fits and what to watch for.
Identity, SSO and workforce access
Central sign-in, enforced multifactor authentication and account recovery.
Best fit
- Remote or distributed teams
- Internal systems not open to everyone
Main thing to check
Plan account recovery first
A business VPN
Encrypts traffic between a device and the VPN’s network and can restrict access to internal systems.
Best fit
- Controlled access to internal systems
Main thing to check
It does not stop phishing or malware
Identity, SSO and workforce access
Why choose it
- Central control over who signs in
- Multifactor authentication can be enforced
Best when
- A remote or distributed team
- Internal systems should not be open to everyone
Watch for
- Plan account recovery before you need it
Full decision detail
Why it helps
- Central control over who signs in
- Multifactor authentication can be enforced
Fits when
- A remote or distributed team
- Internal systems should not be open to everyone
- You can manage the extra step for staff
Watch for
- Plan account recovery before you need it
Central sign-in and single sign-on, with team accounts and permissions managed in one place for the people who work with you. Multifactor authentication and account recovery as everyday practice are covered separately.
A business VPN
Why choose it
- Can restrict access to internal systems
Best when
- Internal systems need to be reachable only through a controlled route
Watch for
- A VPN does not make you anonymous or protect you from phishing or malware
- Cost and complexity for a small team
Full decision detail
Why it helps
- Can restrict access to internal systems
Fits when
- Internal systems need to be reachable only through a controlled route
Watch for
- A VPN does not make you anonymous or protect you from phishing or malware
- Cost and complexity for a small team
A virtual private network encrypts traffic between a device and the VPN’s network and can restrict access to internal systems.
A business VPN encrypts the traffic between a device and the VPN’s network, and can be set up so that internal systems are reachable only through that route. It suits a team that works from different places and has systems that should not be open to everyone. Its job is narrower than it is often sold for: it does not make anyone anonymous and it does not protect against phishing or malware, so it works alongside central sign-in, multifactor authentication and tested account recovery rather than instead of them.
When you may need more. If your systems are all hosted services with their own sign-in, enforcing multifactor authentication and central sign-in usually does more than a VPN would.
What each one covers
Show the comparison. The paths side by side
| What to look at | Identity and two-factor tools | Business VPN |
|---|---|---|
| What it controls | Who signs in, centrally | How devices reach internal systems |
| Best suited to | A remote or distributed team | Internal systems reachable only through a controlled route |
| Main thing to check | Plan account recovery before you need it | It does not protect from phishing or malware; cost and complexity for a small team |
Protecting sensitive or regulated information
Regulated or sensitive data carries obligations beyond a small-business baseline, and the baseline is still the first thing to put in place. A security baseline lists your critical accounts, turns on multifactor authentication, adopts a password manager, sets up backups you can restore, applies updates and writes down who does what. Qualified advice then focuses on the obligations specific to your business and your data.
More about this context
Regulated or sensitive data carries further obligations than a small-business baseline covers.
Regulated or sensitive data carries obligations beyond a small-business baseline, and the baseline is still the first thing to put in place.
How the paths differ
A security baseline lists your critical accounts, turns on multifactor authentication, adopts a password manager, sets up backups you can restore, applies updates and writes down who does what. Qualified advice then focuses on the obligations specific to your business and data.
Supporting detail
Questions to ask yourself. 4 questions to settle first
- What sensitive or regulated data do you actually hold?
- Is the baseline in place: accounts, multifactor, password manager, restorable backups?
- Who is responsible for what, in writing?
- Which obligations apply to your business and your markets?
Why this decision matters. What is at stake
A baseline closes the common gaps first, and it is the same work whatever you hold. Regulated businesses have further obligations that tools alone do not meet.
Before choosing. A short checklist
- A baseline is not a complete security programme
- Regulated businesses have further obligations
- Take qualified advice on the rules that apply to you
Want the full background? Your first thirty days: a baseline in order
Choose the path that fits
Select a path to see why it fits and what to watch for.
A security baseline, in order
Close the common gaps first, in order, and write down who does what.
Best fit
- Baseline not yet in place
- Showing who is responsible
Main thing to check
A baseline is not a complete security programme
Qualified advice on your obligations
Specialist advice on the rules that apply to your business and data, once the baseline is in place.
Best fit
- Regulated or sensitive data
- After the baseline
Main thing to check
This site gives general information, not advice
A security baseline, in order
Why choose it
- A baseline closes the common gaps first
- Responsibilities are written down
- Advice can focus on what is specific to you
Best when
- You handle regulated or sensitive data
- You need to show who is responsible for what
Watch for
- A baseline is not a complete security programme
- Regulated businesses have further obligations
Full decision detail
Why it helps
- A baseline closes the common gaps first
- Responsibilities are written down
- Advice can focus on what is specific to you
Fits when
- You handle regulated or sensitive data
- You need to show who is responsible for what
- The baseline is not yet in place
Watch for
- A baseline is not a complete security programme
- Regulated businesses have further obligations
- Take qualified advice on the rules that apply to you
List your critical accounts, turn on multifactor authentication, adopt a password manager, set up backups you can restore, apply updates and write down who does what.
Qualified advice on your obligations
Why choose it
- Focuses effort on what is specific to you
Best when
- You handle regulated or sensitive data
Watch for
- This site gives general information, not advice on the rules that apply to you
Full decision detail
Why it helps
- Focuses effort on what is specific to you
Fits when
- You handle regulated or sensitive data
Watch for
- This site gives general information, not advice on the rules that apply to you
Specialist advice on the rules that apply to your business and your data, once the baseline is in place.
Want to know what sits behind each option? See how we evaluate security and backup tools