Identity & access
Multi-factor authentication everywhere it matters, least-privilege access, and a clean answer to “who can get into what”.
cybersecurity
Cybersecurity for Australian businesses
Insurers, clients and tenders are all asking the same question: how do you protect the data we trust you with? We help businesses of 10 to 250 people answer it with evidence, not assurances — the fundamentals done properly, documented, and kept that way.
Assessed against the ACSC Essential Eight
Plain English, no scare tactics
Founder-led, Sydney-based
why businesses call us
Security usually becomes urgent for one of four reasons
None of them mean you have done something wrong. They mean the outside world now expects evidence.
-
Your insurer sent a questionnaire
Cyber insurance renewals now ask hard questions about MFA, backups and patching. Answering them wrong costs cover; answering them blind costs sleep.
-
A client or tender is asking about your security
Bigger customers increasingly audit their suppliers. We get you to the point where those questions have documented answers.
-
Something almost happened
A phishing email that nearly worked, an account that logged in from somewhere strange. Near-misses are the cheapest lesson you will ever get, if you act on them.
-
Microsoft 365 grew faster than its security
Accounts, sharing links and licences accumulate. We bring identity, access and data sharing back under control.
Book your free security review
Thirty minutes, security-focused, no obligation. You keep the written findings either way.
what we secure
The fundamentals, done properly
Most breaches of businesses this size do not involve exotic attacks. They involve a missing basic. These are the six we make sure are not missing.
Email security
Anti-phishing and spoofing controls, SPF, DKIM and DMARC done properly, and protection for the inboxes that pay invoices.
Endpoints & patching
Every laptop, desktop and server protected, encrypted and patched on a schedule, with visibility of what is falling behind.
Network security
Next-generation firewalls, secure remote access, and guest and business traffic properly separated.
Backup & recovery
Ransomware-resilient backups for devices, servers and Microsoft 365, with restores that are tested rather than assumed.
People & awareness
Practical staff training on the scams that actually target Australian businesses, without the scare tactics.
how an engagement runs
Assess, remediate, then keep the evidence current
-
>_ 01
Assess
We review your environment against the ACSC Essential Eight and the questions insurers and clients actually ask, and give you a written picture of where you stand.
-
>_ 02
Remediate
We close the gaps in priority order — identity and MFA first, then email, endpoints and backups — with a fixed written proposal before any work starts.
-
>_ 03
Maintain & evidence
Controls drift. Under an ongoing partnership we keep patching, monitoring and backups current, and keep the documentation ready for the next questionnaire.
Evidence, not assurances
Everything we implement is documented as we go: what is protected, how, and when it was last verified. When someone asks how you protect their data, you answer from a document, not from memory.
faq
Cybersecurity questions businesses ask us
Small and mid-sized Australian businesses are targeted precisely because attackers assume the controls are weaker. The good news is that most of the risk is closed by fundamentals done properly: multi-factor authentication everywhere, patched systems, secured email, protected endpoints and backups that actually restore. That is where we start.
Yes. We review where you stand against what the questionnaire actually asks, close the gaps that matter, and document what changed, so you can answer with evidence rather than best guesses.
The Essential Eight is the Australian Cyber Security Centre's set of baseline strategies to protect against common attacks. We use it as an assessment framework: we review your environment against it and give you a written picture of where you stand and what to prioritise. For most businesses it is the sensible benchmark, whether or not anyone is formally asking for it.
It depends on the size of your environment and what needs closing. The first step is free: a 30-minute technology review with a security focus, and you keep the written findings. If work is needed, you get a fixed written proposal before anything starts.