Training, devices, and business applications

Short training for staff combined with simulated phishing emails, and a score that tracks whether behaviour is improving. The most common way into a small business is still somebody clicking something, which makes this one of the few controls that addresses the actual entry point. Effectiveness depends on it being routine rather than annual.

Adjusts what each person is taught based on what they demonstrably get wrong, rather than sending everyone the same course. Staff who never fail a simulation stop receiving material they do not need, which preserves the goodwill the programme depends on. Also covers policy acknowledgement, which insurers increasingly ask about.

Generates phishing simulations automatically and delivers training to whoever falls for one. The automation is the point — awareness programmes usually fail because nobody has time to run the next campaign. Designed to keep going without attention.

Deliberately low-effort awareness training, built to run continuously in the background without an administrator scheduling campaigns. Aimed at businesses that will never assign anyone to manage a training programme. Modest by design, and consistently more effective than an ambitious programme that stops after two months.

Photoshop, Illustrator, InDesign, and the rest, licensed per seat. Where design work genuinely happens in-house there is no real substitute. Where it does not, the full suite is frequently bought when a single application or a cheaper PDF tool would cover what is actually used.

Remote access and remote support, so somebody can take control of a machine to fix it without travelling to it. Long established and familiar to most users, which reduces friction when the person on the other end is stressed. Also covers unattended access to machines that need reaching out of hours.

Manages phones, tablets, and laptops across Windows, Apple, and Android from one console. Suits estates too mixed for a single-platform tool to cover. For a business already holding Microsoft 365 Business Premium, Intune covers much of this ground at no extra cost, which is worth checking first.

Apple-specific device management, built around how Macs and iPhones actually work rather than treating them as an afterthought to Windows. Relevant where the business runs on Apple hardware — design, media, and a growing number of professional practices. Depth on one platform instead of breadth across several.

One identity across every application a business uses, with the rules about who can sign in from where enforced centrally. The practical gain is offboarding: switching off one account removes access to everything, rather than hoping somebody remembers all fourteen systems. Most valuable where the application count has grown past what a spreadsheet tracks.

Provides the directory, single sign-on, and device management that a traditional Windows domain controller used to, without a server in a cupboard. Suits businesses retiring their last on-premises server, and those with a mix of Windows and Mac that a Windows domain never handled well. One platform covering several jobs that are usually bought separately.

Adds a second authentication step in front of applications, including older systems that have no modern login of their own. That reach into legacy software is its distinguishing feature. Multi-factor is the single highest-value control available to a small business, and the obstacle is almost always coverage of the awkward remaining systems.

Password management with two-factor authentication built in rather than added separately. Covers the core requirement for a small team without much to configure. A straightforward option where the need is basic and the appetite for administration is low.

Email filtering and archiving, plus continuity — if Microsoft 365 is unavailable, staff can still send and receive through Mimecast. That continuity is the differentiator, and it matters to businesses for which a few hours without email is a genuine operational problem rather than a quiet morning.

Encrypts email and attachments from inside the mail client, and allows access to be withdrawn after sending — including from a message already delivered to the wrong person. Sending to the wrong recipient is far more common than interception, which is what makes revocation useful. Adds little friction for the sender.

Encrypts outbound email and can apply rules that catch sensitive content leaving the business before it goes. Common in healthcare and financial services where the obligation is explicit. The rules need tuning to the business, or they generate noise until people learn to ignore them.

Routes internet traffic through its own network for inspection and policy, wherever the user happens to be, replacing filtering that used to live in an office appliance. Suits businesses whose staff are no longer behind a single boundary. An architectural commitment rather than an add-on.

Sits in front of a public website to speed it up, absorb attack traffic, and filter malicious requests. Relevant where the website is a revenue channel rather than a brochure. Also handles DNS, which is frequently the reason a business ends up there in the first place.

Managed protection for public websites and the APIs behind them, with the tuning handled as a service rather than left to the customer. Aimed at businesses running something public and internet-facing without security staff. The managed element is what distinguishes it from a product you configure yourself.

Awareness training built around changing habits rather than passing a quiz, with a lighter tone intended to avoid the resentment compliance training usually generates. Whether people take it seriously matters more than what it contains. A reasonable choice where previous training has been openly disliked.

Backs up cloud applications — Microsoft 365, Google Workspace, and Salesforce — which none of those vendors undertake to restore from a customer's own deletion. Salesforce coverage is the less common part and matters where the CRM is the business. Restores are self-service, which keeps an ordinary recovery from becoming a project.

Google's cloud platform, usually present because a specific application or vendor requires it rather than because it was chosen. Strong in data and analytics work. As with the other large clouds, the deciding factor for a small business is normally what the rest of the estate already uses.

Monitors servers and applications in detail and alerts when something degrades, ideally before customers notice. Aimed at businesses running software of their own rather than only using other people's. Consumption-based pricing that can move quickly with volume, which is worth understanding before deploying it broadly.

Delivers applications to devices and manages those devices from one place, across platforms. Built for larger and more mixed estates. As with the rest of VMware, licensing and ownership have shifted since the Broadcom acquisition, so anything here deserves a fresh look at renewal.

The most widely recognised electronic signature service, with a detailed record of who signed what and when. Recipients almost always know what to do with it, which reduces the friction of asking a customer to sign something. Where a signature might later be disputed, the audit trail is what is actually being purchased.

Adobe's signature service, natural where Acrobat is already in use and documents are prepared there. Keeps preparation and signing in one place. Competes on integration rather than on the signing itself, which is much the same everywhere.

The reference PDF application — creating, editing, combining, redacting, and form work. Redaction in particular is worth doing correctly, since covering text with a black box in another tool leaves the text underneath perfectly readable. Where the requirement is basic, cheaper alternatives cover it.

Straightforward electronic signatures, formerly HelloSign, with a clean signing experience and minimal setup. Suits businesses sending a steady trickle of routine agreements rather than running complex approval routing. Deliberately simpler than the larger platforms.

Electronic signatures positioned on value, covering the core requirement without the enterprise workflow features. Sensible where signature volume is high and the documents are routine. The recognition factor is lower than DocuSign, which occasionally matters with cautious recipients.

File sync and sharing, still widely embedded in businesses that adopted it early and in creative work where large files move between organisations. Where a business already pays for Microsoft 365, running Dropbox alongside SharePoint usually means paying twice and splitting files across two places. Sometimes the right answer anyway, because a client or partner works that way.

Adds controlled documents and approval workflow inside Google Workspace — versions, sign-offs, and retention. Aimed at businesses on Google that have quality or compliance obligations Drive alone does not meet. Narrow, and valuable exactly where that applies.

Support ticketing with a customer-facing help centre, so requests arrive in one queue instead of scattered across individual inboxes. Relevant where customers need support and the volume has outgrown a shared mailbox. The help centre only earns its keep if somebody maintains the articles.

A broad suite covering CRM, invoicing, helpdesk, and much else, priced well below assembling the equivalent from separate vendors. Individual applications are rarely the strongest in their category, but they work together and the economics are hard to argue with. Suits businesses that would otherwise run five subscriptions and reconcile them by hand.

Builds contact records from email and calendar activity rather than waiting for someone to type them in. Directly targets the reason most small CRM deployments fail, which is that nobody updates them. Suits relationship-driven businesses more than structured sales pipelines.

A CRM that works inside Gmail and Google Calendar, so updating it does not mean leaving the inbox. Only makes sense for businesses committed to Google Workspace, where it is a strong fit. Adoption follows from staying where people already work.

Invoicing, expenses, and time tracking aimed at service businesses billing for hours or projects rather than selling stock. Simpler than full accounting software and often used alongside it. Suits consultancies, trades, and professional practices.

Captures time and expenses and feeds both payroll and client invoicing from the same entries, so hours are recorded once rather than twice. Relevant wherever staff time is the product. Removes a reconciliation step that is otherwise done monthly by hand.

Helps staff actually use software the business is already paying for, most often Microsoft 365. Addresses a real and rarely acknowledged problem: the gap between licensed and used is usually the largest single waste in a small business technology budget. Cheaper than buying more tools nobody adopts either.

Measures how the business actually uses its tools, producing a picture of engagement across applications. Useful for finding licences nobody touches, and capable of feeling like surveillance if introduced badly. Worth being deliberate about what it is for and telling staff plainly.