The Alpha IT blog
Practical, jargon-free advice on managed IT, cybersecurity, cloud and web design. Written for business owners across Dagenham, East London & Essex.
Cybersecurity
Is AI dangerous for my business? The fears, checked
Seven fears about AI at work, checked against the NCSC, Microsoft, the ONS and the High Court. Two are right. Most point at the wrong risk.
Cybersecurity
How long does Microsoft 365 keep audit logs?
180 days for the audit log, a week or a month for sign-ins, and on Business plans the audit log may not be recording at all. What to check first.
Cloud
Is my business ready for Microsoft Copilot?
Copilot answers from everything each person can already open. The licence check, the permissions clean-up, and why the first seat unlocks the tools to do it.
Web Design
Do I need PCI compliance if I use Stripe?
Stripe takes the card data, but your website is still in scope. Which questionnaire applies, the quarterly scan, and the 2025 rule on checkout scripts.
Cybersecurity
Is the Microsoft 365 spam filter enough on its own?
What the built-in filtering catches, what Defender for Office 365 adds, and the stronger settings that sit switched off until somebody turns them on.
Managed IT
What should an IT asset register include?
A list of laptops is not a register. The columns worth keeping, the assets most small firms leave off, and why "Windows 11" is not a version number.
Cloud
How to restrict external sharing in OneDrive and SharePoint
An Anyone link opens for whoever holds it, and in an untouched tenant every personal OneDrive allows them. The six settings that fix it, and what each breaks.
Infrastructure
Windows Server 2016 end of support: what to do
Security updates stop on 12 January 2027, there is no paid bridge on the table, and the server carries on booting as if nothing happened.
Managed IT
New starter IT setup: what to do before day one
The account takes minutes. The laptop does not. What to order, what to decide, and why the second factor now gets enrolled on the first morning.
Business Continuity
Does Microsoft 365 back up your data?
Microsoft keeps the service running. Your content is your problem. The real retention windows, what a deleted account costs you, and what backup costs.
Infrastructure
Why your office Wi-Fi is slow, and how to fix it
Dropped calls in the far meeting room are almost never the broadband. The band and channel problem, why a second router backfires, and what a fix costs.
Cybersecurity
What to do when your website has been hacked
Flagged by Chrome, redirecting somewhere odd, or full of pages you never wrote. The order to work in, what to replace, and how the warning gets lifted.
Web Design
Who actually owns your business website?
Your domain, your hosting account, your code. What you own by default under UK law, why copyright usually stays with the builder, and how to get a domain back.
Cloud
The Microsoft 365 licences you are paying for and nobody is using
Most small firms pay for Microsoft 365 licences nobody opens. How to count yours, why the seven-day rule stops you dropping them, and what breaks if you do.
Compliance
What actually happens in a Cyber Essentials Plus audit
Cyber Essentials Plus swaps the questionnaire for five hands-on tests on your own machines. What an assessor runs, what fails people, and what it costs.
Business Continuity
Backups are the easy half of disaster recovery
Backups copy your data. A recovery plan decides what comes back first, who starts it and how long it takes. What to agree before you need any of it.
Cloud
What actually moves when you move to Microsoft 365
Cutover, staged, hybrid or IMAP: which path fits a small business, what each one leaves behind, how long Microsoft says it takes and what it costs.
Cybersecurity
The firewall you own is the router your broadband company posted you
What Cyber Essentials asks of a firewall, the support end date the law makes your router's maker publish, and five checks for the box in the cupboard.
Cybersecurity
Your team is already using AI. The account type is the problem.
What NCSC says really happens to the text your staff paste in, why free and business accounts have opposite defaults, and the one page worth writing.
Cybersecurity
Someone will click. What matters is whether they tell you.
Why NCSC warns against leaning on phishing simulations, what to measure instead of click rate, and where staff training really sits among the four layers.
Cybersecurity
The account you read email with should not be the one that can change everything
Who needs administrator rights, why one person should hold two accounts, and the local admin password that is the same on every machine.
Cybersecurity
Your machines say up to date. That is not the same as patched.
Windows Update only covers Windows, a downloaded update is not an installed one, and pausing updates can roll one back.
Compliance
The old computers in your store cupboard are still your problem
Deleting is not wiping, an SSD does not overwrite the way you think, and a certificate of destruction proves nothing on its own.
Cybersecurity
Offboarding: what actually has to be switched off when someone leaves
UK GDPR gives you 72 hours to tell the ICO about a breach that risks harm to people. What counts, what to record, and what happens if you miss it.
Compliance
Data breach notification: what has to happen in the first 72 hours
UK GDPR gives you 72 hours to tell the ICO about a breach that risks harm to people. What counts, what to record, and what happens if you miss it.
Compliance
Cyber insurance: what insurers actually check before they'll pay out
Most UK cyber insurers now decline cover without MFA, EDR and tested backups. What underwriters actually check before they quote or pay a claim.
Cybersecurity
Multi-factor authentication: the one login step that blocks most account takeovers
Fewer than half of UK businesses have two-factor authentication switched on. What it actually stops, which type to use, and the new Cyber Essentials rule.
Cybersecurity
Antivirus vs EDR: what's the real difference, and do you need both
Signature antivirus catches known malware. What EDR actually watches for instead, what NCSC guidance really says, and what it costs to add.
Infrastructure
The PSTN switch-off: what stops working on 31 January 2027
The copper phone network closes on 31 January 2027. What it takes with it, why alarms and card machines are at risk, and what to check first.
Cybersecurity
The 3-2-1 backup rule, and why almost nobody tests it
What the 3-2-1 rule actually means, why cloud sync isn’t a backup on its own, and the restore test almost nobody does.
Cybersecurity
Business email compromise: how invoice fraud really works
How a real invoice thread turns into a fraudulent bank transfer, what UK Finance’s numbers say it costs, and the checks that stop it.
Cybersecurity
What 1,241 login attempts a day taught us about remote access security
Our own server took 1,241 password-guessing attempts in a day. What that shows about SSH and remote access security for any small business.
Cybersecurity
Password managers for small teams: what actually works
Sticky notes and browser autofill aren’t a password policy. What a proper password manager gets a small team, and how to roll one out without a mutiny.
Cybersecurity
Still running Windows 10? Here's what end of support actually means
Windows 10 stopped getting security updates on 14 October 2025. What that means for Cyber Essentials, cyber insurance, ESU pricing, and whether your hardware can run Windows 11.
Cybersecurity
The first hour of a ransomware attack: what to do, in order
What to do, in order, in the first hour after finding ransomware: isolate without wiping evidence, don't pay or reply yet, and exactly who to call first.
Cybersecurity
DMARC, SPF and DKIM: stopping people spoofing your business
What SPF, DKIM and DMARC actually check, why a domain with none of them lets scammers send convincing fake invoices as you, and how to move to full blocking without breaking your own mail.
Compliance
NHS DSPT for dental and GP practices: what it actually takes
The ten standards in plain English, what Standards Met really means, what you lose by missing the deadline, and the five things that actually hold practices up.
Web Design
How much should a small business website cost in 2026?
What UK web design really costs in 2026, from freelancers to agencies. The costs quotes leave out, and where our £270, £450 and £900 packages honestly sit.
Cloud
Microsoft 365 Business Standard vs Premium: which do you need?
Both plans have identical apps. Premium buys control over devices and identities. Here’s when that is worth paying for, and when it isn’t.
Pricing
Are we the cheapest managed IT support in London?
Published London rates for 2026 next to ours, including the headcounts where we are not the cheaper option.
Switching
Changing IT firm: what it really costs
The switching fees that are real, the ones that aren’t, and why our own platform keeps rates lower.
Compliance
Do you need Cyber Essentials to win council contracts?
Which contracts really require it. And whether you need Plus.
Pricing
Managed IT vs break-fix: which is actually cheaper?
The honest comparison, with the breakpoint.
Pricing
How much does IT support cost in London? (2026 pricing guide)
A clear 2026 breakdown of IT support pricing models in London: per-user, per-device and break-fix. Typical monthly costs, what drives the price, and how to avoid hidden fees.
Cybersecurity
Cyber Essentials: a plain-English guide for Essex businesses
What Cyber Essentials is, the five security controls, Cyber Essentials vs Plus, typical cost and timescales, and why East London and Essex businesses increasingly need it to win work.
Managed IT
Managed IT Support in Dagenham & East London: a small-business guide
What managed IT support really includes, why East London and Essex SMEs are switching from break-fix, and how to choose a provider in 2026, from a local Dagenham IT company.