Cybersecurity

Some links on this page are affiliate links: we may earn a commission at no extra cost to you. Our approach

Cybersecurity is not a product you buy once: it is a set of good habits and rules that stay in place over time. For an SME, the essentials are not found in sophisticated tools but in the basics: controlled access, up-to-date systems, tested backups and a team that recognises an attempted fraud. ## The three most common attack vectors The first is the exposed website: software that is not updated, an open administration page, a malicious extension. The second is messaging: phishing, a fake supplier invoice, a fake technical support contact. The third is compromised access: a reused password, an old account from a provider who is still active, no two-factor authentication. In most cases, an incident costs more than its prevention: a website offline for days, lost trust, loss of customer data, legal obligations. ## Steps to take right now - Enable two-factor authentication on all professional accounts. - Confirm that backups exist, sit on separate media and have been restored at least once. - List all accesses and remove those no longer needed. - Train the team: a person who spots a suspicious email does more for security than many tools. ## Where to start A security audit gives you a picture of your exposure and a list of actions ranked by risk. It is often the only deliverable an SME needs, as long as the basic fixes are implemented and monitoring stays in place.

When this guide is for you

• Your website, email accounts or internal systems have been compromised or attacked
• You suspect phishing, wire fraud or a fake supplier invoice
• You want to check your backups, access rights and updates before there is an incident
• A client, bank or public tender asks you to show that your security is under control
• You want a basic training session for your team to recognise fraud attempts

Step by step

1. Initial security audit — Map your exposure: website, email, user accounts, devices and data, external service providers. Identify what is critical and what is not.
2. Quick fixes — Enable two-factor authentication everywhere, update software, remove unused accesses, check and test backups.
3. Hardening of the essential systems — Secure the website (updates, firewall, SSL), protect email, set up the rights of each service provider and separate sensitive data.
4. Team awareness — Train staff to recognise phishing, fake invoices and urgent payment requests, and set a simple procedure for confirming suspicious requests.
5. Monitoring and response plan — Set up basic monitoring, write down who to call in case of an incident and test restoring a backup.
6. Policies and access management — Document passwords, two-factor authentication and authorisation rules for each tool.

What it costs (in MAD)

Service	Indicative price	Good to know
Initial security audit	15,000 – 60,000 MAD (approx. 1,400 – 5,500 €)	Exposure map and prioritised action plan
Fixes and hardening	5,000 – 20,000 MAD (approx. 450 – 1,800 €)	Updates, accesses, two-factor authentication, backups
Team training	5,000 – 15,000 MAD (approx. 450 – 1,400 €)	Session of 2 to 4 hours plus reference materials
Monitoring	1,500 – 6,000 MAD / month (approx. 140 – 550 €)	Website, accounts and certificates
Incident response	10,000 – 50,000 MAD (approx. 900 – 4,500 €)	Depends on the damage and the time needed

Indicative ranges for the Moroccan market in 2026, excluding tax. Prices vary with scope and provider.

Mistakes to avoid

• Buying sophisticated tools before securing the basics: updates, two-factor authentication and tested backups
• Leaving service provider accounts (agencies, IT providers, freelancers) active long after they have finished
• Keeping backups on the same server or the same account as the site
• Reusing passwords across professional services
• Relying on one person, without documenting accesses and procedures

Updated on 20 October 2026

Related guides

Version française: /services/devops-securite/cybersecurite/ · AR · NL