Separating real risks from anxiety

Excerpt: £20 a month. A team who answered at midnight. And the end of staring at the ceiling wondering if today was the day it all fell apart.

---

From Night Terrors to Sleeping Soundly

How TransCrypt took me from 3am panic to actually knowing what I was doing

---

I need to tell you about 3am.

Not a specific 3am. All of them. The months of lying awake, staring at the ceiling, running through catastrophe scenarios.

What if we get hacked? What if customer data gets stolen? What if we lose everything? What if I have to call our clients and tell them their information is compromised because I didn't know what I was doing?

I didn't know what a firewall actually did. I didn't know if we had one. I didn't know what we should have, what we did have, what the gap was between them. I just knew enough to be terrified.

That's where I was when I found TransCrypt.

The Things That Kept Me Awake

Let me be specific about the fears.

The breach I wouldn't see coming. Something happening right now, in our systems, that I wouldn't know about until it was too late. Data leaving. Criminals inside. And me, oblivious.

The ransom demand. Waking up to find everything locked. A message demanding Bitcoin. The choice between paying criminals or losing years of work.

The client phone call. Having to tell someone who trusted us with their information that we'd let them down. That their data was out there because I hadn't taken security seriously.

The insurance claim denied. Finding out, after something happened, that our policy didn't cover it because we hadn't met basic requirements I didn't know existed.

The tender we'd lose. Watching opportunities go to competitors because we couldn't tick the security boxes. Being too small, too unprepared, too late.

These weren't irrational fears. They were real possibilities. I just didn't know which ones to prioritise, which ones were imminent, which ones I could actually do something about.

That's the worst part of not knowing: everything feels equally terrifying.

Finding TransCrypt

I've told this story before. Midnight. Desperate Googling. A company offering Cyber Essentials support for £20 a month.

Twenty quid. Less than our coffee bill when we had a big job on.

I filled in the form expecting nothing. A sales call. A pitch for something more expensive. The usual.

Brian called the next day. And he just... listened.

Not "here's what you need to buy." Not "you're in terrible danger." Just questions. About the business. About my team. About what was keeping me up at night.

By the end of that call, the fears hadn't gone away. But they'd started to organise themselves. Some things were urgent. Some things could wait. Some things I'd been terrified of weren't actually the real risks.

That was the beginning.

What £20 a Month Actually Got Me

I'll be specific, because I would have wanted to know this.

The platform. A system that walked me through Cyber Essentials step by step. Not assuming I knew anything. Not drowning me in jargon. Just clear questions, clear guidance, one thing at a time.

The assessment. At the end of the process, the actual certification assessment. That's included. You don't pay separately for someone to come and verify your answers - it's built into the £20.

The support. Real humans who answered real questions. Not a chatbot. Not a FAQ page. People who understood that I was scared and confused and needed help at weird hours.

The resources. Templates for policies. Guides for implementation. The things I would have spent hours searching for, already written, ready to adapt.

The only additional cost was the IASME certification fee - the official government body that issues the certificate. That's separate from TransCrypt, and it's a fixed fee whoever you go through. About £300 for a business our size.

So: £20 a month for the platform and support, plus the IASME fee at the end. That's it. That's what it cost to go from night terrors to certified.

The Things I Learned Not to Fear

Here's what TransCrypt taught me that I wasn't expecting: some of my fears were misplaced.

I was terrified of sophisticated hackers. The reality? Most attacks on small businesses aren't sophisticated. They're automated. They're looking for open doors - weak passwords, unpatched software, default configurations. Close those doors and most threats pass you by.

I was terrified of the technology. The reality? Most of what needed to happen wasn't technical. It was process. Policies. Training. Decisions. The technical bits that Danny handled were the easy part.

I was terrified of failing the assessment. The reality? The assessment isn't a trap. It's a verification that you've done the work. If you've followed the process honestly, you pass. TransCrypt's platform wouldn't let me submit until I was ready.

I was terrified of the cost. The reality? £20 a month. I'd been imagining thousands. I'd been assuming security was for businesses with bigger budgets. I was wrong.

The Things I Learned to Take Seriously

But some fears were justified. Some things should have been keeping me awake.

Our passwords were a disaster. "Welcome1" for the WiFi. "Password1" for the customer database. This was a real risk I hadn't fully grasped. TransCrypt helped me understand why, and more importantly, how to fix it.

Our people were our biggest vulnerability. Not because they were careless, but because they'd never been taught. Kev clicking on dodgy emails wasn't his fault - it was mine, for never training him. That fear was valid. The solution was education.

Our lack of documentation was a liability. If something went wrong, we had no plan. No process. Nothing written down. That's not paranoia - that's a gap that would have cost us dearly.

The Support at 3am

I'm not speaking figuratively. I contacted TransCrypt support at 3am.

Week four of the certification process. I'd hit a wall on something technical - firewall configurations, I think. I couldn't understand the question, couldn't understand what we needed to do, couldn't see how we'd ever get through this.

I sent a message fully expecting to wait until morning. Someone responded within the hour. Walked me through it. Didn't make me feel stupid. Didn't charge extra for the inconvenience.

That's when I knew this was different. This wasn't a software platform that happened to have a support email. This was people who understood that small business owners don't work 9-to-5, that our crises don't wait for business hours, that sometimes you need a human voice telling you it's going to be okay.

Brian and the Team

I want to name them, because they deserve it.

Brian, who took that first call. Who listened before he advised. Who never made me feel like a small fish in a big pond.

The support team, who answered questions I was embarrassed to ask. Who explained things three different ways when I didn't get it the first time. Who celebrated with us when we passed.

The community they've built - other business owners going through the same journey, sharing war stories, helping each other out.

This isn't a faceless corporation. It's people who genuinely care about small businesses surviving and thriving. That sounds like marketing copy. It isn't. It's what I experienced.

The Night the Terrors Stopped

I remember the specific night.

We'd passed the assessment. Certificate issued. I'd printed it out, put it in a frame, hung it on the wall.

I went to bed that night and realised: I wasn't afraid anymore.

Not because all risk had disappeared. It hadn't. Cyber threats don't vanish because you've got a certificate.

But I understood our risks now. I knew what we'd done to address them. I knew what to do if something went wrong. I had a plan, a process, a team who knew what they were doing.

The terror comes from not knowing. Once you know - even if the news isn't all good - the terror fades.

I slept through the night. First time in months.

What I'd Tell Someone at 3am

If you're reading this at 3am, scared, staring at the ceiling, wondering if your business is about to fall apart because of something you don't understand - I was you.

Here's what I want you to know:

The fear is valid. You're right to be concerned. Small businesses are targets. The risks are real.

The fear is manageable. There's a path from where you are to where you need to be. It's not as long as you think. It's not as expensive as you think.

You don't have to figure this out alone. There are people who will help. Not sell to you - help you. TransCrypt was that for me. They might be that for you.

£20 a month. That's what it cost me to go from night terrors to sleeping soundly. Whatever you're imagining the cost is, divide it by ten. Then divide it again.

Start tomorrow. Not next month. Not when things calm down. Tomorrow. The longer you wait, the longer you spend at 3am staring at the ceiling.

Sleeping Soundly

Three years on. Government contracts. Private sector clients. A proper IT department. A consultancy side that helps other businesses through the same journey.

And I sleep through the night.

Not because I'm naive. I know the threats are still out there. I know new risks emerge all the time. I know security is never "done."

But I know what I'm doing now. I know who to call. I know how to respond.

TransCrypt gave me that. Brian and the team gave me that. For £20 a month and the cost of an IASME certificate.

From night terrors to sleeping soundly.

That's the journey. That's what's possible.

If you're still awake, still afraid, still wondering - there's a way through.

I found it. You can too.

---

Jim Simpson is an SME Cyber Resilience Consultant with TransCrypt. He still occasionally wakes at 3am, but now it's because Monty the dog wants to go outside, not because of cyber security fears. He considers this an improvement.