Ostratto - Blog | Ostratto , Guides

How much water does AI actually use?

Mon, 21 Sep 2026 08:20:00 +0000

Every time someone asks ChatGPT a question, generates an image or uses AI to analyse a document, computers inside a data centre process the request.

Those computers generate heat. Keeping them cool can require water, while generating the electricity that powers them may use even more.

For one simple AI prompt, the amount can be tiny. Across billions of prompts and increasingly powerful data centres, the figures become much harder to ignore.

The short answer

Google estim ates that a median Gemini text prompt consumes approximately 0.26 millilitres of water, or around five drops.

At that rate, you could submit nearly 2,000 prompts before using the equivalent of a 500 ml bottle of water. Even 10,000 prompts would account for approximately 2.6 litres.

However, earlier academic research estimated that GPT-style models could consume around 500 ml for every 10 to 50 responses.

The estimates differ because they examine different models, locations, cooling systems and sources of water use. AI infrastructure has also become considerably more efficient.

The larger figures reveal the real scale:

Global data centres consume more than 560 billion litres annually
A large 100 MW data centre could consume around 2.5 billion litres per year
Global data centre consumption could reach 1.2 trillion litres annually by 2030
AI-related water withdrawal has been projected to reach 4.2 to 6.6 trillion litres in 2027

Not all data centre activity relates to AI, and water withdrawal is different from water permanently consumed. Nevertheless, AI is helping to drive the rapid expansion of this infrastructure.

Why does AI use water?

AI’s water footprint comes from three main sources.

The first is data centre cooling. The processors used to run AI models generate substantial heat. Some data centres use evaporative cooling, where water absorbs the heat before evaporating. A UK report on water use in AI and data centres suggests that around 80% of the water used by these systems can be lost through evaporation.

The second is electricity generation. Many power stations use water for cooling and other processes, creating an indirect water footprint outside the data centre.

The third is chip manufacturing. Semiconductor factories use highly purified water to clean silicon wafers while producing the advanced processors on which AI depends.

Some data centres use air cooling, closed-loop systems or reclaimed wastewater, so the amount of drinking-quality water required varies significantly between facilities.

Data-center Cooling

Water removes heat generated by servers. In evaporative cooling systems, much of that water is lost to the atmosphere.

Electricity Generation

Generating the power used by AI can consume water away from the data centre, creating an indirect water footprint.

Chip Manufacturing

AI servers rely on advanced processors, which require ultrapure water to clean silicon wafers during manufacturing.

Not every AI request is equal

A short text question does not require the same computing power as generating a video, analysing hundreds of pages or asking an advanced model to work through a complex problem.

Water use can be affected by:

The model selected
The length of the input and response
Whether extended reasoning is required
The number and size of uploaded files
Whether the system generates text, images, audio or video
The efficiency of the processors
The cooling system and local weather
The source of electricity

The International Energy Agency reports that the energy needed for individual AI tasks has been falling rapidly. However, video generation, extended reasoning and autonomous agents can consume hundreds or thousands of times more energy than simple text generation.

AI is becoming more efficient, but it is also being used more frequently and for more demanding work.

What does a large data centre use?

A 100 MW hyperscale data centre could consume approximately 2.5 billion litres of water annually, depending on its design and location.

That is equivalent to:

1,000 Olympic swimming pools every year
Nearly 6.9 million litres every day
The average daily household use of around 50,000 people in England

Not every data centre uses this much. Facilities using air cooling or recycled water may use considerably less. Climate also makes a difference, with hotter locations generally requiring more cooling.

The figure still demonstrates the difference between one prompt and the infrastructure processing millions of them around the clock.

From 224,000 to 480,000 swimming pools

Data centres globally currently consume more than 560 billion litres of water each year.

That would fill approximately:

224,000 Olympic swimming pools per year
More than 600 Olympic swimming pools every day
The equivalent annual domestic water use of over 11 million people in England

Not all of this is caused by AI. Data centres also support websites, cloud storage, streaming services and business software.

However, AI is contributing to the construction of new data centres and the installation of more powerful computing equipment. By 2030, global data centre water consumption could reach 1.2 trillion litres annually, equivalent to approximately 480,000 Olympic swimming pools.

That is more than 1,300 swimming pools every day, or almost one every minute.

How much do technology companies use?

In 2022, Google’s data centres consumed approximately 19.5 billion litres of water, enough to fill around 7,800 Olympic swimming pools.

Microsoft reported global water consumption of approximately 6.4 billion litres during the same year, representing an increase of 34% from 2021. That equates to roughly 2,560 swimming pools.

These totals cover wider cloud and corporate operations rather than AI alone. They do, however, show why per-prompt efficiency only tells part of the story.

A company can reduce the water required for each AI response while increasing its total consumption because the number of users, services and data centres is growing faster.

Could AI withdraw trillions of litres?

Academic research has projected that global AI demand could be responsible for withdrawing between 4.2 and 6.6 trillion litres of water in 2027.

At the upper end, that is enough to fill approximately 2.6 million Olympic swimming pools.

This figure relates to water withdrawal, which is the amount taken from a water source. Some of that water may later be treated and returned. Water consumption refers to the portion that evaporates or is otherwise unavailable for immediate reuse.

The figure therefore does not mean that 6.6 trillion litres will disappear. However, withdrawing water can still affect local supplies, particularly if it is returned somewhere else, at a different temperature or after the period when it was most needed.

Why this matters in the UK

The average person in England uses 136.5 litres of water per day. For comparison, a bath uses around 80 litres, a standard ten-minute shower can use between 100 and 150 litres, and a washing-machine cycle typically uses around 50 litres.

England is forecast to face a daily water deficit of nearly five billion litres by 2050. That is equivalent to the current daily household use of more than 36 million people.

Several existing and proposed data centre clusters are in areas already considered seriously water stressed. Cooling demand may also be highest during hot weather, precisely when household, agricultural and environmental demand is under the greatest pressure.

Water use is therefore not just about the global total. Where and when it is consumed matters enormously.

Should businesses use AI less?

The answer is not necessarily to stop using AI. A useful prompt that saves several hours of work may be a reasonable use of resources.

The better question is whether AI is being used deliberately or added to processes without a clear benefit.

Businesses can make more responsible choices by selecting smaller models for straightforward tasks, limiting unnecessary image and video generation, avoiding repeated requests without a purpose and considering environmental transparency when choosing technology providers.

Responsibility should not sit entirely with individual users. Technology companies need to report water use more consistently, including how much drinking-quality water they consume, where it is used and which cooling technologies they deploy.

Water use is falling

AI models, processors and data centres are becoming more efficient. A simple prompt can now require less energy and cooling water than it once did, reducing the environmental impact of each individual task.

AI usage is rising

At the same time, more people and businesses are adopting AI for increasingly complex work. The growth in users, prompts, image generation and other demanding tasks can outweigh the savings achieved per interaction.

Five drops can still become a flood

It is misleading to suggest that every short AI conversation consumes an entire bottle of water. Recent provider data indicates that a straightforward text prompt can use only a fraction of a millilitre.

It would be equally misleading to use that figure to dismiss the industry’s wider impact.

Data centres already consume hundreds of billions of litres each year. That demand could reach 1.2 trillion litres by 2030 as AI use grows and applications become more demanding.

One useful prompt is unlikely to create a meaningful water problem. Billions of prompts and enormous data centres concentrated in water-stressed areas potentially can.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

Could AI actually be a risk to humanity?

Sun, 13 Sep 2026 20:48:00 +0000

There is something unusual happening in artificial intelligence. Some of the people working on the world's most advanced AI systems are warning that the technology they are helping to develop could eventually pose a catastrophic risk to humanity. Others within the same field argue that these fears are exaggerated, based on speculative assumptions about technologies that do not yet exist.

That disagreement might be easier to dismiss if AI development were progressing slowly. It isn't. The largest technology companies are spending extraordinary amounts of money on computing infrastructure, new models are arriving regularly, and AI systems are being given greater autonomy and access to tools that allow them to do more than simply generate text.

Governments have responded by establishing AI safety institutes and developing new regulations, while researchers are testing whether increasingly capable models can operate independently, deceive evaluators or perform some of the tasks that would theoretically be required to replicate themselves.

The debate has now reached some unlikely places. King Charles is hosting an AI summit at Dumfries House, bringing together senior figures from the technology industry to discuss the future development of artificial intelligence and its impact on society.

Against that background, the question of whether AI could eventually present a serious risk to humanity no longer feels quite as easy to dismiss as science fiction. The difficult part is working out how seriously we should take a danger that remains highly uncertain.

How worried are the people building it?

In September 2026, concerns about AI risk received renewed attention following warnings from researchers working close to the technology. In an interview examining whether AI could realistically threaten humanity within the next decade, The Conversation discussed an estimate from Anthropic alignment researcher Evan Hubinger that there was a greater than 10% probability of AI killing humanity within that period.

That figure needs considerable context. Humanity has never built a superintelligent AI, so there is no historical evidence from which anyone can reliably calculate such a probability. Professor Kate Devlin of King's College London points out that predictions of human-level or superhuman AI being only a few years away have been made before, and nobody actually knows whether today's technology will ultimately lead there.

But uncertainty doesn't necessarily make the issue irrelevant. When the possible consequences are sufficiently severe, even a small and uncertain probability can justify precautions. The problem with AI is that we're being asked to make those judgements while the technology itself is changing extremely quickly.

What could actually go wrong?

The popular version of an AI catastrophe usually involves machines becoming conscious and turning against humans. Most serious AI safety research is considerably less cinematic.

One of the more immediate concerns is misuse. The 2026 International AI Safety Report examines the potential for increasingly capable AI to assist with cyber attacks and provide information relevant to biological and chemical weapons. There are still substantial practical barriers between an AI providing information and somebody successfully causing serious harm, but more capable systems could gradually make specialist knowledge and complex processes easier to access.

AI also doesn't necessarily need to be deliberately misused. As we move from chatbots that provide answers towards AI agents that can access browsers, files, software and other systems, mistakes become more consequential. An incorrect chatbot response can be ignored; an autonomous system acting on an incorrect assumption may be able to make changes before a human intervenes.

The most extreme scenario is a future AI sufficiently capable and autonomous that humans struggle to control it. Today's systems aren't capable of this, something the International AI Safety Report makes clear. What interests researchers is whether some of the capabilities that might eventually contribute to such a scenario are beginning to emerge.

Some of those capabilities are improving quickly

The UK's AI Security Institute tests frontier AI models against tasks associated with autonomy, cyber security and other potentially dangerous capabilities.

One particularly striking example involves simplified self-replication evaluations. These are controlled tests of individual skills that might be required for an AI to obtain computing resources and maintain access to them. In 2023, the strongest models achieved success rates below 5% across many of these evaluations. By 2025, frontier models had achieved more than 60%.

That does not mean an AI currently has a 60% chance of escaping onto the internet and copying itself. AISI says current models still struggle with important parts of the process and there is no evidence that models are spontaneously attempting to self-replicate.

The significance is the speed at which capabilities are changing. AISI has found rapid improvements across the areas it measures, with performance in some categories doubling approximately every eight months.

That doesn't demonstrate that an AI catastrophe is approaching. It does explain why some researchers are uncomfortable waiting for definitive evidence of danger before taking precautions.

There are good reasons to be sceptical

Existential AI risk shouldn't be treated as established fact simply because prominent people within the industry are discussing it.

As Professor Kate Devlin argues, we don't currently have superintelligence and nobody knows when, or even whether, it will arrive. Today's systems remain unreliable in surprisingly basic ways, and there is no guarantee that making current models larger will eventually create something vastly more intelligent than humans.

There are commercial incentives worth considering too. AI companies benefit from the perception that the technology they're developing is extraordinarily powerful. Describing AI as potentially civilisation-changing can attract investment, political attention and customers as effectively as it can generate genuine concern.

There is also a risk that hypothetical extinction scenarios distract attention from problems already happening. AI-assisted fraud, misinformation, copyright disputes, environmental impacts and disruption to employment don't require superintelligence.

It shouldn't have to be one debate or the other. We can address the measurable harms of today's AI while investigating the potentially much larger risks of future systems.

The bigger risk may be the race

Perhaps the strongest reason for taking AI safety seriously is the incentive structure surrounding its development.

OpenAI, Anthropic, Google, Meta and others are competing for customers, investment, computing power and technical talent. Governments increasingly regard AI leadership as strategically important too.

That makes slowing down difficult. If one company delays a new system because it believes further safety research is required, a competitor may continue. The same problem exists between countries. Cautious development might benefit everyone collectively while rapid development remains the rational choice for each individual participant.

This is behind some of the calls for international intervention. Writing in The Guardian, Gaby Hinsliff argues for pausing particularly risky areas of AI research while international safeguards are developed, rather than stopping AI research altogether.

That distinction matters. We already accept that potentially transformative technologies can require significant restrictions without abandoning them. Pharmaceuticals undergo clinical trials, aircraft require certification and nuclear technology is subject to extensive controls. AI is different from all of those technologies, but the principle that greater potential consequences justify greater scrutiny isn't particularly radical.

So, could AI actually threaten humanity?

There is currently no good reason to believe that ChatGPT, Claude, Gemini or another existing AI system is about to destroy humanity. Current models lack the autonomy and broader capabilities required by the more extreme scenarios being discussed.

There is equally little basis for confidently saying that sufficiently advanced AI could never become dangerous. We don't know how capable these systems will become, how quickly those capabilities will emerge or whether the safety techniques being developed alongside them will prove sufficient.

The 2026 International AI Safety Report reflects this uncertainty rather well. Its contributors don't agree on the probability of humanity losing control of future AI systems and the report doesn't predict that such an outcome will happen. It does, however, recognise that the possible consequences are serious enough to justify research and preparation.

The fact that King Charles is now bringing some of the industry's biggest names together to discuss the future of AI is another indication of how far this discussion has moved beyond technology companies and research laboratories.

Perhaps today's fears about superintelligence will eventually look misplaced. Current AI architectures might reach their limits and the predicted leap towards vastly more capable systems may never happen.

But we're currently developing the technology while simultaneously trying to understand what its limits and risks might be. The important question isn't whether anyone can prove that AI will threaten humanity, because nobody can. It's how much evidence of that possibility we should require before deciding that some precautions are worthwhile.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

What we learned from our most recent 50 Zoho CRM implementations

Thu, 10 Sep 2026 08:40:00 +0000

Every Zoho CRM implementation is different. Some businesses are replacing spreadsheets, while others are moving away from an established CRM that no longer suits them. Some need a relatively straightforward sales pipeline, while others need to manage complex customer relationships, operational processes, renewals, contracts and integrations.

Having reviewed our most recent 50 Zoho CRM implementations, however, we found that many of the same challenges and decisions appear repeatedly. The technology matters, but the success of an implementation usually depends on how well the CRM reflects the business using it.

Here are the most important lessons we have learned.

1. The best implementations begin with the process, not the software

It is tempting to start by creating fields, adding modules and building workflows. Before configuring anything, though, the business needs to understand what the CRM is supposed to support.

That means establishing how an enquiry becomes a customer, what information needs to be collected, who is responsible at each stage and what should happen next. It also means identifying exceptions, handovers and processes that currently depend on somebody remembering to do something.

Our strongest implementations have always started with discovery. Once the underlying process is understood, Zoho CRM can be designed around it. Without that work, businesses risk recreating their existing problems in a new system.

2. CRM structure matters more than the number of features

Zoho CRM provides a considerable amount of flexibility, but flexibility needs to be used carefully. One of the most important decisions is how different types of information should be represented and connected.

Contacts should normally represent people. Accounts should represent organisations. Deals should represent potential or confirmed business. Other records, such as properties, policies, memberships, sites, equipment or contracts, may require their own modules.

When fundamentally different things are combined within the same module, duplication and reporting problems quickly develop. It can also make integrations with applications such as Zoho Books considerably harder.

A well-designed data structure may not be the most visible part of an implementation, but it determines how reliable and adaptable the CRM will be in the future.

3. More fields do not necessarily create better data

Many CRM systems contain far more fields than their users actually need. Some were created for an old process, some duplicate information held elsewhere and others were added without considering how they would be used.

Every unnecessary field makes a layout harder to understand. It also increases the amount of information users must review and creates more opportunities for inconsistent data.

We have found that every field should have a clear purpose. It should support an operational process, reporting requirement, automation or customer interaction. If nobody can explain why a field is needed, it probably should not be there.

Conditional layouts, layout rules and different module designs can then be used to show the right information at the right time, instead of presenting every possible field to every user.

4. User experience directly affects data quality

A CRM can be technically correct and still fail if it is inconvenient to use.

When users have to search through long layouts, complete irrelevant fields or perform unnecessary steps, they begin finding ways around the system. Information is entered inconsistently, notes are stored elsewhere and important updates are delayed.

Successful CRM design therefore needs to consider the everyday experience of the people using it. Clear layouts, sensible field names, helpful descriptions and well-designed views can make a significant difference.

The objective is not simply to capture more information. It is to make the correct action the easiest action.

5. Automation should support a proven process

Automation is often one of the main reasons a business invests in Zoho CRM. Workflows, blueprints, scheduled functions and integrations can remove repetitive administration and help ensure that important actions are not missed.

However, automating an unclear or inconsistent process usually makes the problem harder to correct. Before building an automation, the trigger, required information, responsible person and expected outcome all need to be understood.

We generally prioritise automations that have a clear operational benefit, such as:

Assigning new enquiries to the correct person
Creating follow-up activities
Notifying users when action is required
Generating documents or related records
Updating information between connected applications
Identifying records that have stopped progressing

The most valuable automations are often not the most complicated. They are the ones that remove a frequent manual task or prevent a costly omission.

6. Data migration needs more attention than most businesses expect

Moving data into Zoho CRM is not simply a matter of uploading a spreadsheet. Existing data often contains duplicates, inconsistent formatting, incomplete records and values that no longer match the new CRM structure.

Migration also requires decisions about relationships. Contacts need to remain connected to the right companies, deals, activities and other records. Record ownership, notes, attachments and historic information may also need to be retained.

Cleaning the data before migration is usually more effective than importing everything and attempting to repair it afterwards. Test migrations are equally important because they allow relationships, field mappings and formatting to be checked before the final move.

A carefully configured CRM cannot compensate for unreliable source data.

7. Reports need to influence the design from the beginning

Businesses often wait until the end of an implementation before deciding what they want to report on. By that point, the information required to produce those reports may not have been captured consistently.

Reporting requirements should be discussed during discovery. If the business needs to measure conversion rates, sales by service, time spent at each stage or the source of new customers, the CRM must be designed to record the relevant information.

This does not mean creating every possible dashboard at the outset. It means understanding the decisions the business wants its data to support and ensuring the necessary information is collected reliably.

8. Integrations depend on clearly defined ownership of data

Zoho CRM rarely operates alone. It may be connected to Zoho Books, Zoho Desk, Zoho Projects, Zoho Analytics, marketing platforms, telephony services or external applications.

Before connecting systems, it is important to decide where each type of information should be maintained. For example, the CRM might own sales and relationship information, while Zoho Books remains responsible for invoices, payments and accounting records.

Without clear ownership, the same information can be edited in several places, creating conflicting values and confusing users. A good integration does more than move data. It establishes which system is authoritative and when information should be created, updated or synchronised.

9. Internal ownership is essential

The most successful customers have somebody internally who takes responsibility for the CRM. That person does not need to become a Zoho developer, but they should understand the business process, coordinate feedback and help maintain consistent use.

Without internal ownership, small decisions are delayed, training becomes fragmented and different teams may begin developing their own ways of working.

External consultancy can provide the architecture, configuration and specialist knowledge, but the system still needs an internal owner who can connect it to the day-to-day needs of the business.

10. A phased implementation is usually more effective

Trying to perfect every process before launch can make an implementation unnecessarily long and complicated. It can also mean designing around assumptions that have not yet been tested by real users.

A phased approach allows the essential structure and processes to be introduced first. The business can then gather feedback, refine how the CRM is used and add further automation or integrations once the foundations are working properly.

This does not mean launching an unfinished system. It means distinguishing between what is necessary for a successful first release and what can be developed responsibly afterwards.

What the 50 implementations taught us overall

The clearest lesson is that a successful Zoho CRM implementation is not defined by how many features have been configured. It is defined by whether the system helps people work more consistently, gives the business reliable information and remains manageable as requirements change.

Zoho CRM is flexible enough to support a wide range of businesses, but that flexibility makes good design particularly important. Clear processes, sensible data architecture, focused automation and genuine user involvement consistently produce better results than adding functionality without an overall plan.

At Ostratto, our implementation process begins with understanding how the business operates. We then design, configure and test the CRM around those requirements before helping users adopt it in practice. The result should not simply be a new system. It should be a better way of working.

If you are planning a new Zoho CRM implementation or want to improve an existing system, talk to Ostratto about your requirements.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

What does a Zoho CRM implementation cost in the UK in 2026?

Thu, 03 Sep 2026 08:34:00 +0000

One of the first questions businesses ask us about Zoho CRM is: how much does it cost to implement?

The software itself is relatively easy to price. Implementation is harder because two businesses using exactly the same Zoho CRM edition can require completely different systems.

A small company replacing a spreadsheet with a straightforward sales pipeline might need little more than some configuration and a data import. Another might need several sales processes, years of historical data, automation, integrations and custom development.

Both are "Zoho CRM implementations", but their costs can be very different.

So, what should you realistically budget in the UK in 2026?

How much does Zoho CRM cost?

There are two separate costs to consider: the Zoho CRM licences and the implementation.

At the time of writing, Zoho CRM's UK pricing when billed annually is:

Edition	Price per user/month
Free	£0
Standard	£12
Professional	£18
Enterprise	£35
Ultimate	£42

Prices exclude VAT and monthly billing is available at a higher rate. As pricing and packaging can change, we'd always recommend checking Zoho's current pricing before making a purchasing decision.

The edition you need depends less on the size of your business and more on what you need CRM to do. Higher editions introduce greater customisation, automation, process management and system limits.

It's also worth looking beyond standalone CRM licensing. If your business expects to use several Zoho applications, Zoho One can be worth considering as it includes CRM alongside a much wider suite of business applications.

Importantly, paying for the licence gives you access to the software. Implementation is the work required to turn that software into a CRM that works around your business.

How much does Zoho CRM implementation cost?

As a broad guide for UK businesses:

Implementation	Typical cost
Basic setup	£500 - £1,500
Typical SME implementation	£2,000 - £6,000
More complex implementation	£6,000 - £15,000
Large/custom implementation	£15,000+

These aren't fixed Ostratto packages. They're indicative ranges to help demonstrate the difference in scale between CRM projects.

A basic setup might involve configuring the standard CRM modules, creating a sales pipeline, adding some custom fields and importing a clean spreadsheet.

A typical SME implementation is more likely to include discovery, multiple processes, automation, permissions, reporting, data migration and training.

A more complex implementation might introduce custom modules, Blueprint processes, custom functions, integrations, significant data migration or several teams with different requirements.

At the upper end, CRM can become part of a much wider operational system involving applications such as Zoho Books, Desk, Analytics, Forms, Sign or Projects.

What are you actually paying for?

Professional CRM implementation isn't simply paying somebody to create fields in Zoho.

Depending on the project, you're paying for discovery to understand how the business operates, CRM architecture to determine how those processes should be represented, and then the actual configuration of modules, fields, layouts, pipelines, permissions and reporting.

There may also be data migration, including cleaning and restructuring existing information before it can be imported properly. Automation and integrations need to be designed, built and tested. Users need training, and somebody needs to manage the transition from the old way of working to the new system.

The implementation might therefore include:

Discovery and process mapping
CRM architecture and configuration
Data cleaning and migration
Workflow automation
Integrations and custom development
Testing
User training
Go-live
Post-launch support

Some projects need very little of this. Others need all of it.

That's where most of the difference in price comes from.

Discover

We start by understanding your business, your existing processes and what you actually need the CRM to achieve. We look at how your teams work today, the data and systems already in place, and where the biggest opportunities or problems are. This gives us the context needed to design the right solution rather than simply recreating your existing processes in Zoho.

Implement

Once the requirements are clear, we design and build your Zoho CRM around them. This can include CRM architecture, configuration, data migration, automation, integrations and reporting, followed by thorough testing. Throughout the implementation we work with your team to validate the solution and make sure what we're building works in practice, not just on paper.

Operate

We help you move confidently into the new system with user training, go-live support and the guidance your team needs to start using Zoho effectively. After launch, we can continue to support, maintain and improve your CRM as requirements change, helping the system evolve alongside your business rather than becoming another piece of software that gradually falls out of date.

The £1,000 Zoho CRM implementation versus the £20,000 implementation

This is where comparing CRM implementation quotes based on price alone becomes difficult. Two suppliers may both describe their service as a "Zoho CRM implementation", while the amount of work included in each proposal can be substantially different.

At the lower end, a £1,000 implementation might cover the configuration of a sales pipeline, some custom fields, an import of existing customer data and a training session. For a business with straightforward requirements, that may be everything it needs and could represent perfectly good value.

A £20,000 implementation is likely to represent a very different project. It might include detailed process discovery, CRM architecture, multiple modules and pipelines, complex data migration, integrations with other systems, custom functions, extensive automation, management reporting, testing, training and support during the transition to the new system.

The difference in price therefore isn't necessarily an indication that one supplier is expensive and another is cheap. In many cases, the underlying scopes simply aren't comparable. When reviewing proposals, it is more useful to understand what has been included, what has been excluded and how closely the proposed solution reflects what the business actually needs.

An inexpensive implementation can become costly if important requirements are discovered later and have to be added retrospectively. Equally, there is little benefit in paying for a sophisticated implementation if the business only needs a well-configured sales pipeline and a clean customer database. A good proposal should make it clear why each element of the project is required and how it contributes to the finished CRM.

What makes a Zoho CRM implementation more expensive?

The number of users is often less important than the complexity of the business processes being implemented. A company with 50 CRM users following one straightforward sales process could require less implementation work than a six-person company with several workflows, integrations and different types of customer.

Costs tend to increase where there are multiple processes or teams to accommodate, significant amounts of existing data to migrate, integrations with other systems, custom development, more sophisticated automation or complex reporting and permission requirements.

Data migration can be a particularly significant factor. Importing a clean spreadsheet containing 500 customers is relatively straightforward. Migrating ten years of information from an existing CRM may involve duplicates, inconsistent formatting, historic activities and relationships between different records. In those circumstances, preparing and validating the data can represent a meaningful part of the overall implementation.

The same applies to integrations and automation. Connecting two systems using an existing native integration may require relatively little work, whereas a bespoke API integration or custom function needs to be designed, developed, tested and maintained. These differences are why implementation costs are generally better estimated from the requirements than from the number of CRM users.

Can you implement Zoho CRM yourself?

Yes. For businesses with relatively simple requirements, implementing Zoho CRM internally can be a perfectly sensible option.

A small team moving from spreadsheets to a straightforward sales pipeline may only need to configure the standard modules, add some fields, create its pipeline and import existing customer data. If somebody within the business has the time and interest to learn Zoho, paying a consultant to do all of that may not provide enough additional value to justify the cost.

Consultancy becomes more useful as the consequences of design decisions increase. If several teams will depend on the CRM, existing data needs to be migrated carefully, other systems need to be connected or important business processes are going to be automated, experience with the platform can save a considerable amount of trial and error.

There is also an internal cost to a DIY implementation that is easy to overlook. If a director or senior employee spends 60 hours learning the platform, preparing data, building workflows and resolving problems, the implementation hasn't really been free. The cost has simply been absorbed by the business rather than appearing on a supplier invoice.

The decision therefore isn't simply between paying for consultancy and implementing Zoho CRM for free. It is a question of whether the time saved, risks avoided and quality of the resulting system justify bringing in specialist support.

So, what should you budget?

For a small business with straightforward requirements, £1,000 to £3,000 plus licences is a sensible starting point. An established SME looking for a CRM designed properly around its processes is more likely to fall somewhere around £3,000 to £8,000, while projects involving substantial data migration, integrations, custom development or several business processes can reasonably reach £8,000 to £15,000 or more.

These figures should be treated as indicative rather than as fixed packages. The most reliable way to establish an implementation budget is to define what the CRM needs to achieve, understand the condition of the existing data and identify which systems and processes need to be connected or automated.

That process may reveal that a sophisticated implementation is justified, but it may equally show that the business only needs a well-configured pipeline, a sensible data structure and a clean import of its existing customer information. The objective should be to build the CRM the business needs rather than making the implementation more complicated than necessary.

At Ostratto, we scope Zoho CRM projects around those requirements rather than trying to fit every business into the same implementation package. If you're considering Zoho CRM, we can help you understand what would actually need to be implemented and provide a scope based on that, before you commit to a larger project.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

Google Workspace Studio gets new security controls: what SMEs need to know

Tue, 25 Aug 2026 09:44:00 +0000

AI at work is moving beyond drafting an email or summarising a meeting. The next step is software that can send a message, update a file, move information between systems or trigger a process for you.

That can remove useful amounts of admin. It also changes the risk. A poor answer from an assistant is inconvenient; a poorly governed automation can share the wrong information, change a record or keep running after the process around it has changed.

On 17 August, Google announced new security and governance controls for Workspace Studio, its no-code tool for building agentic workflows within Google Workspace. The important business question is no longer only “What can we automate?” It is “How do we automate without losing control?”

What is changing?

Workspace Studio originally focused more on helping a user with a task, such as drafting an email. Google is now introducing more cross-user collaboration actions, alongside controls for identity, access, auditing, human approval and data protection.

For newly created flows, Google says the automation will run with the user’s identity but receive only the privileges needed for the flow. It can also receive a unique, auditable identity, so an administrator can distinguish the flow from its owner when reviewing activity.

That is a useful improvement, but it does not repair untidy access permissions. Google’s administration guidance says a newly created flow can, by default, read, modify and share the same Workspace data its creator can access. If that person can see too much, the automation may still inherit a wider data footprint than the process needs.

Administrators are also getting an Agent access management view. It can show new Studio flows, pause their access to Google data or restrict particular access scopes. Audit events can include the flow identifier and owner context, while additional settings can disable certain steps, Gemini data access or webhook integrations.

Human approval is part of the control model

Not every automated action should complete without a person checking it. Google now allows administrators to require approval when a flow affects people outside the organisation, such as adding content to an externally shared file or messaging an external group.

That is a sensible default around customer communications, personal information, contractual commitments and anything involving money or access rights. The flow can prepare the next action, but accountability stays with a person before information leaves the organisation.

The approval control is supported on Business Starter, Business Standard and Business Plus, as well as specified Enterprise and Education editions. More advanced data loss prevention controls for Studio and Gemini have a narrower edition list, including specified Frontline, Enterprise, Education and Enterprise Essentials plans. Do not assume every security control arrives with every Workspace subscription.

The rollout has important limits

Google began rolling out the administration settings to Rapid and Scheduled Release domains on 17 August. Rapid Release end-user features started on 20 August, while broader Scheduled Release end-user features are due to begin on 1 September. Identity attribution is still labelled beta; its Scheduled Release rollout is due to start on 24 August.

Availability will therefore vary by tenant and release track. More importantly, the first wave of least-privileged identity, identity attribution, richer audit context and Agent access management applies to newly created flows. Google says support for existing flows will come later.

That creates a practical review point. An organisation with older flows should not assume the new dashboard and identity model cover them simply because the administration controls appear in the console.

What should SMEs do now?

Start with one bounded process. Choose a repetitive task with clear rules, a visible outcome and an easy way to reverse mistakes. Creating a standard project folder and notifying the delivery team is a better pilot than allowing an agent to decide what happens across an entire customer journey.
Map data and permissions first. Record what the flow needs to read, what it can change, who owns it and what it must never access. Review the creator’s underlying Drive, Gmail and group permissions before relying on the phrase “least privilege”.
Keep approval around consequential actions. Require a person before external sharing, payments, personal-data handling, access changes or contractual communication. Automation should remove friction, not accountability.
Separate new and existing flows. Build an inventory with owner, purpose, data access, release date and review date. Confirm which flows appear in Agent access management and which still operate under the older model.
Review flows like user accounts. Recheck them when an owner changes role, a process changes or the data becomes more sensitive. Pause or retire flows that no longer have a clear business owner.

For an example of how centrally managed, auditable Google Workspace can support everyday operations, see our case study with a global B2B marketing business.

Our view

This is more consequential than another AI writing feature. As we discussed in our practical AI predictions for small businesses, the value of agents will come from helping real work move forward, but the more an agent can do, the more identity, permissions, logging and human approval matter.

Google’s controls are a useful step towards that balance. They provide better visibility and a more credible way to limit action, but the rollout is not complete, older flows are not yet fully covered and advanced data protection remains edition-specific. Doing nothing for a week or two is reasonable if your tenant, ownership model or permissions are not ready.

For most SMEs, the right move is a small, measurable pilot with clear boundaries. Automate one high-friction process, watch what the flow can access and keep a person responsible for the result.

If you are exploring Google Workspace automation, Ostratto can help you map the workflow, permissions and controls before you switch it on. Talk to us about Google Workspace.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

What's BIMI - and should your business be using it?

Fri, 23 Jan 2026 14:14:50 +0000

Email security has come a long way in recent years. Most businesses are now familiar with SPF, DKIM and DMARC as the foundations of protecting their domain from spoofing and phishing. But there’s a newer standard gaining attention: BIMI.

BIMI promises better brand recognition, improved trust, and a visual stamp of authenticity in your customers’ inboxes. Sounds great… but is it actually realistic for small businesses right now?

Let’s break it down.

What is BIMI?

BIMI (Brand Indicators for Message Identification) allows your organisation’s logo to appear next to emails you send in supported inboxes (such as Gmail and Yahoo).

Instead of just seeing a sender name or generic initial, recipients can see your verified brand logo alongside your email. This helps users quickly recognise legitimate messages and reduces the risk of phishing.

In short:

Stronger brand visibility
Increased trust with recipients
Clearer separation from spoofed or fraudulent emails

But BIMI isn’t just a logo upload. It’s tightly linked to email authentication and security standards.

Without BIMI

With BIMI

The Prerequisites for BIMI

Before BIMI is even an option, your email domain must meet strict security requirements:

So far, all reasonable… until we get to the biggest barrier.

1. DMARC enforcement

Your domain must have DMARC set to p="quarantine" or p="reject.

This means:

SPF and DKIM must be correctly configured
You must be confident that legitimate mail won’t be blocked
Any unauthorised senders are actively rejected or quarantined

You can read more about DMARC here.

2. A compliant BIMI logo

Your logo must be:

In SVG Tiny 1.2 format
Square and properly optimised
Hosted securely and publicly accessible

This isn’t a standard SVG export and often requires specialist design or conversion work.

3. A BIMI DNS record

A DNS record is added to your domain that:

Points to your logo
References your Verified Mark Certificate (VMC)

So far, all reasonable… until we get to the biggest barrier.

The Blocker: Verified Mark Certificates (VMCs)

To display a BIMI logo in major inboxes like Gmail, you need a Verified Mark Certificate.

A VMC:

Proves you own the logo
Confirms you have the legal right to use it
Is issued by a recognised Certificate Authority (such as DigiCert)

Why this is a problem for small businesses

VMCs come with two major costs:

Trademark registration - Your logo must be a registered trademark. This alone can cost hundreds to thousands of pounds and take months to complete.
Annual certificate fees - VMCs typically cost £800–£1,500+ per year, depending on the provider.

For large brands, this is a reasonable investment.

For most small businesses, it simply isn’t.

Is BIMI worth it right now?

For enterprise organisations and well-known brands, BIMI makes sense:

They already have trademarks
The cost is marginal relative to marketing budgets
Brand impersonation is a serious risk

For small and growing businesses, the reality is different.

While BIMI is technically impressive, it’s currently:

Expensive to implement
Dependent on trademark ownership
Limited in inbox support
Hard to justify compared to other security improvements

Right now, BIMI is more of a “nice to have” than a necessity for most SMEs.

What should small businesses focus on instead?

If your goal is email trust and security, your effort is usually better spent on:

Properly configured SPF, DKIM and DMARC
Gradually moving DMARC to enforcement (quarantine → reject)
Monitoring DMARC reports to prevent legitimate mail issues
Reducing spoofing and phishing risks at the domain level

These steps deliver real security benefits without the high costs attached to BIMI.

Our View

BIMI is a great idea, but it’s not yet accessible for most small businesses.

As the ecosystem matures and costs come down, we expect BIMI to become far more achievable. Until then, getting your email authentication right is the most effective way to protect your brand and your customers.

If you’re unsure where your domain stands - or want help tightening up your email security - we can help you get there, without unnecessary complexity or expense.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

What Is ZTNA? A Simple Guide for Small and Medium Businesses

Sun, 05 Oct 2025 12:33:00 +0000

Cybersecurity used to be simple: if you were inside the office network, you were trusted. If you were outside, you weren’t. That approach no longer works. Staff now work from home, use personal devices, and rely on cloud apps rather than office servers. Hackers have also grown more sophisticated, often exploiting stolen passwords or unsecured endpoints.

This shift has led to the rise of Zero Trust Network Access (ZTNA) - a modern security model that assumes no user or device should be trusted by default, whether they’re inside or outside the company network.

What Exactly Is ZTNA?

ZTNA replaces the old “castle-and-moat” idea of cybersecurity with identity-based access. Instead of giving users broad access to your network once they log in (like with a traditional VPN), ZTNA applies strict, dynamic rules:

Never trust, always verify – Every login attempt and every device is continuously checked.
Least privilege access – Users only get access to the specific apps or resources they need, nothing more.
Context-aware decisions – Access can depend on factors like device security, location, or time of day.

In short, ZTNA makes sure the right person, on the right device, gets the right level of access - and nothing slips through the cracks.

How ZTNA Works in Practice

Unlike VPNs, which give users access to the whole network, ZTNA is more precise, reducing the risk of attackers moving around if they do break in.

A staff member tries to log into a company system (say, Zoho CRM).

ZTNA verifies their identity (username, MFA) and checks the device they’re using.

If everything matches company policy, ZTNA grants access to just that application.

If something looks unusual - such as logging in from an unknown device or country - access may be denied or additional checks required.

	ZTNA	VPN
Security Approach	Follows “zero trust” - no one is trusted by default.	Creates a secure tunnel for the entire network. Trusted once inside.
Access Control	Limits access to only the specific resources required.	Grants full access to the network once connected.
User Experience	Web-based, easier setup, and usually provides smoother access.	Requires software installation; may slow down internet speeds.
Scalability	Easier to scale, especially in cloud environments.	Can face performance issues with more users.
Location of Access	Focuses on granting access to specific apps/services.	Provides access to the entire internal network remotely.

Benefits of ZTNA for SME's

Adopting Zero Trust Network Access doesn’t just modernise your security - it brings practical advantages for smaller organisations. By moving away from broad, “all-or-nothing” network access, ZTNA helps SMEs work more securely, efficiently, and flexibly, especially in today’s cloud-driven and remote-working environments.

Stronger Security

Reduces the risk of stolen credentials being used to gain broad network access. Limits “lateral movement” - attackers can’t roam freely once inside.

Better Remote Experience

Staff connect directly to the apps they need, without slow VPN tunnels back to the office.

Simpler IT Management

Centralised control means you can enforce consistent policies for office staff, remote workers, and contractors.

Supports Compliance

Helps demonstrate strong access controls, which is key for GDPR and industry audits.

Scales Easily

Adding new users, apps, or locations doesn’t require new hardware - it’s cloud-delivered.

How SMEs Can Get Started with ZTNA

Audit your current access model – Who is accessing what systems, from where, and on which devices?
Start small – Pilot ZTNA on one cloud app or a subset of users first.
Enforce multi-factor authentication (MFA) – This is a foundation for ZTNA.
Choose the right vendor – Look for solutions with UK/EU data centres, simple integrations with your tools (Zoho, Google Workspace, Microsoft 365), and SME-friendly pricing.
Work with a trusted partner – If you don’t have in-house expertise, a consultancy can help you design policies and roll out ZTNA smoothly.

ZTNA represents a major shift in cybersecurity - from trusting by default to verifying everything. For SMEs, it offers a practical way to protect remote workers, secure cloud apps, and stay ahead of modern threats without adding huge complexity.

In short: ZTNA helps ensure only the right people, using the right devices, can access your business systems. And in a world where breaches often start with a single stolen password, that’s a huge step forward.

What's SASE? The Future of Secure Networking for SMEs

Thu, 25 Sep 2025 11:23:27 +0000

The way businesses work has changed. With more staff working remotely, cloud apps replacing on-premise servers, and cyber threats growing more complex, traditional IT security models are struggling to keep up. This is where SASE (pronounced “sassy”) comes in.

SASE stands for Secure Access Service Edge, and it’s being called the future of networking and security. But what exactly is it - and what does it mean for small and medium-sized businesses?

Breaking Down SASE: The Basics

At its core, SASE is about combining network security and connectivity into one cloud-delivered service. Traditionally, businesses would:

Connect users to a central office network (via VPNs or firewalls).
Route internet and app traffic back through that office for security checks.

This worked when everyone sat in the same office. But with cloud apps (like Zoho, Microsoft 365, or Google Workspace) and hybrid work, this model slows everything down and leaves gaps in protection.

SASE flips the model:

Security is delivered from the cloud edge, not your office.
Users connect securely to the nearest SASE “point of presence” (POP), wherever they are.
The service combines network performance and security features in one.

The Core Components of SASE

A true SASE platform usually bundles together:

SD-WAN (Software-Defined Wide Area Network) - Improves connectivity by routing traffic intelligently over multiple internet paths (rather than relying on a single VPN tunnel).
Secure Web Gateway (SWG) - Filters web traffic, blocking malicious sites and enforcing browsing policies.
Cloud Access Security Broker (CASB) - Provides visibility and control over cloud apps (e.g. who’s accessing Zoho CRM from where, and what they’re doing).
Zero Trust Network Access (ZTNA) - Replaces old VPNs with identity-based access. Users only get access to what they need, and nothing more.
Firewall-as-a-Service (FWaaS) - Cloud-based firewalls to protect against unauthorised access and threats.

Why SASE Matters for SMEs

Large enterprises were the first adopters, but SMEs stand to benefit greatly because:

Simplified IT - Instead of juggling separate VPNs, firewalls, and security tools, SASE consolidates them into one cloud service.
Scalable - Adding new staff, locations, or devices is easier. No need to buy more hardware firewalls for every site.
Better experience for remote workers - Staff connect directly to the nearest SASE node for faster, safer access to apps.
Cost control - A single subscription model can replace multiple expensive IT systems and maintenance costs.
Future-proofing - Cybersecurity regulations and customer expectations are rising; SASE helps SMEs show they take data protection seriously.

Real-World Example

Imagine your business has:

An office in Bristol
A handful of remote staff around the UK
Teams using Zoho, Google Workspace, and Microsoft Teams daily

With SASE

Everyone connects to the nearest secure cloud edge.
All traffic is encrypted, scanned, and routed optimally.
Security policies are applied consistently, whether someone is at home, in the office, or on the road.

Without SASE

Remote users connect to the office via VPN, slowing everything down.
Security tools may be inconsistent across devices.

Challenges to Consider

While SASE offers a modern approach to networking and security, it’s not entirely a “switch it on and forget it” solution. For SMEs, the promise of simplified management, cost savings, and stronger protection is attractive - but it comes with practical hurdles. SMEs should be aware of:

Vendor Choice

Different providers bundle features differently. Some focus more on SD-WAN, others on security.

Migration Planning

Moving from traditional firewalls/VPNs to SASE takes careful rollout.

Connectivity Reliance

As SASE is cloud-delivered, you need reliable internet to benefit fully.

SASE is still maturing, but adoption is accelerating. Gartner predicts that by 2028, the majority of businesses will have a SASE strategy in place. For SMEs, the decision often comes down to timing:

If you’re planning a network refresh, moving to more remote/hybrid working, or want to simplify your IT stack, now is a good time to evaluate SASE.
If your current security tools are working and budgets are tight, start by exploring Zero Trust and cloud-delivered firewalls - key stepping stones toward SASE.

SASE is more than another tech acronym. It’s a shift in how businesses connect and protect their people, apps, and data in a cloud-first world. For SMEs, it offers a way to get enterprise-grade security and performance without the enterprise-grade cost or complexity.

In short: SASE brings together networking and security in the cloud, making your business more secure, more flexible, and better prepared for the future of work.

Exploring SASE as an option for your environment? We'd love to help!

DMARC: What's going on?

Wed, 26 Feb 2025 10:54:36 +0000

Email security is a critical component of any organisation's cybersecurity strategy. Yet, despite its importance, many businesses have been slow to adopt DMARC (Domain-based Message Authentication, Reporting & Conformance). DMARC helps prevent email spoofing, phishing, and other cyber threats, but its implementation has lagged behind.

In this article, we'll explore why DMARC adoption has been slow and provide a step-by-step guide on how to set it up for your domain.

What is DMARC?

DMARC is an email authentication protocol designed to protect domains from being used for email spoofing and phishing attacks. It works by ensuring that emails sent from your domain are properly authenticated using SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

A DMARC policy tells receiving mail servers what to do when an email fails authentication—whether to monitor (no action), quarantine (send to spam), or reject (block outright) unauthorised emails.

How DMARC Works

SPF and DKIM Check: The recipient's mail server checks if the email passes SPF and DKIM authentication.
DMARC Policy Evaluation: Based on the configured DMARC policy (none, quarantine, or reject), the server determines what to do with the email.
Reports Sent: The recipient’s mail server sends DMARC reports back to the domain owner, providing insights into email activity and unauthorised email attempts.

Why Has DMARC Adoption Been Slow?

Despite its benefits, DMARC adoption has been sluggish. Here’s why:

Complexity of Implementation - Setting up DMARC requires proper configuration of SPF and DKIM records, which can be confusing for businesses without dedicated IT teams.
Risk of Email Deliverability Issues - If DMARC is misconfigured, legitimate emails could be rejected or marked as spam, disrupting communication. This risk makes many hesitant to enforce strict policies.
Lack of Awareness - Many businesses don’t realise that their domains can be exploited for email spoofing. Without awareness of the risks, there’s little urgency to adopt DMARC.
Perceived as a ‘Big Business’ Solution - Some SMEs believe DMARC is only necessary for large enterprises, not realising that any domain can be targeted by email fraud.
The "Set It and Forget It" Mindset - Some companies implement DMARC at the none policy level for reporting purposes but never move to stricter enforcement (quarantine or reject).

How to Set Up DMARC for Your Domain

To implement DMARC, you need access to your domain’s DNS settings. Here’s how to do it step by step.

Step 1: Set Up SPF (Sender Policy Framework)

SPF helps verify that emails sent from your domain come from authorised mail servers.

1. Log into your DNS provider (e.g., Ostratto Hosting, GoDaddy, 123Reg.
2. Locate the DNS settings for your domain.
3. Add a TXT record with the following format:

v=spf1 include:mailprovider.com -all

Replace mailprovider.com with your email service provider (e.g., Google Workspace, Microsoft 365).
The "-all" means that emails not listed in SPF should be rejected.

4. Save the record and allow time for propagation.

Step 2: Set Up DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to emails, verifying their authenticity.

1. In your email provider’s admin panel, look for DKIM settings.

2. Enable DKIM and generate a public key.

3. Add a TXT record in your DNS settings using the provided values.

4. Save the record and enable DKIM signing.

Step 3: Configure DMARC

Once SPF and DKIM are in place, set up DMARC to define how unauthorised emails should be handled.

1. In your DNS settings, add a new TXT record for _dmarc.yourdomain.com.

2. Use the following format:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain.com; pct=100;

p=none: This starts DMARC in monitoring mode (change to quarantine or reject later).
rua: Email address to receive aggregate reports.
ruf: Email address to receive forensic reports.
pct=100: Applies the policy to 100% of emails.

3. Save the record and wait for propagation.

Step 4: Monitor Reports & Adjust Policy

1. Use DMARC report analysis tools like DMARC Analyzer, Agari, or Postmark to interpret reports.

2. If all legitimate email sources pass DMARC, update the policy:

p=quarantine or p=reject

3. Continue monitoring to ensure no critical emails are affected.

Final Thoughts

DMARC is a crucial tool for preventing email spoofing and phishing attacks, yet its adoption remains slow due to its perceived complexity and risk of email deliverability issues. However, with careful setup and monitoring, businesses can implement DMARC effectively without disrupting legitimate email flow.

If you're still unsure about setting up DMARC for your domain, or would like this to be taken care of - we're just a message away.

Cybersecurity Essentials for Small Businesses: What You Need to Know in 2025

Tue, 11 Feb 2025 09:57:40 +0000

Cyber threats are evolving faster than ever, and small businesses are no exception. With cybercriminals targeting vulnerabilities in businesses of all sizes, a solid cybersecurity strategy is no longer a 'nice-to-have'—it’s a necessity.

From ransomware to phishing scams, the risks are real. But with the right approach, you can protect your data, your customers, and your business. Let’s break down what you need to know.

Cyber Threats to Watch in 2025

Small businesses often assume hackers only go after large corporations, but that’s far from the truth. In fact, smaller businesses can be even more vulnerable due to weaker security measures. Here are some of the biggest threats this year:

Ransomware Attacks – Cybercriminals lock you out of your files and demand payment to restore them.
Phishing & Social Engineering – Deceptive emails and messages trick employees into sharing sensitive information.
Zero-Day Exploits – Hackers take advantage of software vulnerabilities before they’re patched.
Supply Chain Attacks – Weak security in third-party vendors can expose your business to breaches.
AI-Powered Cybercrime – Hackers are using AI to automate attacks, making them harder to detect.

How to Strengthen Your Cyber Defenses

The good news? You don’t need an enterprise-sized budget to boost your cybersecurity. A few key measures can go a long way in keeping your business secure.

1. Multi-Factor Authentication (MFA)

Passwords alone aren’t enough. Enabling MFA on all critical accounts adds an extra layer of protection, making it much harder for attackers to gain access.

2. Train Your Team

Your employees are your first line of defense. Regular cybersecurity training helps them recognize threats like phishing emails and suspicious activity before damage is done.

3. Secure Your Devices

From laptops to mobile phones, every device connected to your network is a potential entry point. Use Sophos Intercept X for advanced endpoint protection and mobile device management (MDM) to control data access.

4. Backup Everything

Cyberattacks can be devastating, but if you have regular, automated cloud backups, you can recover quickly. Follow the 3-2-1 backup rule: three copies of data, two different storage mediums, and one offsite backup.

5. Adopt a Zero Trust Approach

Never assume trust. Implement Zero Trust security by verifying every access request and applying the principle of least privilege—only giving employees access to what they absolutely need.

6. Keep Your Software Up to Date

Hackers exploit outdated software. Enable automatic updates to keep your systems patched and secure.

7. Secure Your Cloud Applications

Cloud-based tools are convenient, but they need to be secured. Enable encryption, use a password manager like Zoho Vault, and restrict unnecessary access.

Smart Cybersecurity Tools for Small Businesses

You don’t need a dedicated IT team to stay secure. The right tools can do a lot of the heavy lifting:

Sophos Intercept X

The #1 endpoint protection using advanced forms of machine learning to protect against both known and unknown malware.

View Product

Sophos Central

Single cloud management solution for all your Sophos technologies: endpoint, server, mobile, firewall, ZTNA, and much more.

View Product

Sophos Mobile

The leading next-gen secure Unified Endpoint Management (UEM) solution for traditional and mobile endpoints.

View Product

NordLayer

Easily transition your business connectivity to SASE, implement Zero Trust, and leave outdated legacy security solutions behind.

View Product

What to Do If You’re Hacked

Even with precautions, breaches can still happen. If you suspect an attack:

Isolate the affected systems to prevent further spread.
Assess the damage and determine what data was compromised.
Restore from your latest backup to get back online quickly.
Report the incident to the necessary authorities and notify affected customers.
Strengthen your defenses to prevent it from happening again.

Cybersecurity isn’t just for big corporations—it’s a crucial investment for businesses of all sizes. By implementing these best practices, you’ll be in a much stronger position to protect your business in 2025 and beyond.