For the first six years Millrace was Dinah and a laptop, doing certification work and the occasional penetration test. The thing that changed it was an incident in early 2018 at a Sowerby Bridge manufacturer who had been a certification client for two years: a compromised mailbox, a forged supplier bank change, and £41,000 out of the door on a Thursday. The certificate had been renewed six weeks earlier. Everything in the scheme had been done correctly, and none of it helped, because nobody was watching and nobody had ever asked the finance team what they would do if a supplier emailed asking to change bank details. Rowan joined that summer to build the monitoring side, Imran in 2021 to hold the incident work, and Callum in 2023 to take on assessment and training. What has not changed is the shape: one room, four people, no salespeople, and every client able to name the engineer who looks after them.

Callum Frayne is an IASME-certified Cyber Essentials assessor and runs our training. He joined in 2023 from a further education college, which is an unusual route into this trade and exactly why we wanted him: the hardest part of security in a small business is not the technology, it is getting thirty busy people to care for the ninety seconds it takes to check a sender address. Callum runs our phishing simulations and, crucially, the follow-up — a thirty-minute session booked into the calendar of anyone who clicks, rather than an automated email telling them off. Clicks across our client base fell from 31% to 9% in the first year of doing it that way, and the people who click twice are, without exception, people who never got a conversation the first time.

Linden Mill sits at the bottom of Linden Road, five minutes from Hebden Bridge station and about twenty-five from Halifax. Most of our clients are within an hour: Hebden Bridge, Todmorden, Sowerby Bridge, Halifax, Keighley, Skipton and a growing number in Leeds. The monitoring, testing and certification work is all remote, so geography is genuinely no barrier — but being local is not nothing, and we will not pretend otherwise. When the Sowerby Bridge incident happened, Dinah was in their office in forty minutes with a notebook, and the difference between that and a video call at nine the next morning was the difference between one fraudulent payment and three. We bank in the valley, our accountant is on Market Street, and if we let you down there is a fair chance you will see us in the Co-op that evening.