Managed IT · Adelaide, SA

Security sized for a small business.

You are not being targeted by a nation state. You are being targeted by automated attacks and by someone impersonating your email to your own customers. The defences that stop both are well understood, mostly included in software you already own, and usually switched off.

Tell us what you need Call 0429 773 265

Essential Eight aligned Mostly uses what you already pay for Plain-English findings

What actually happens

Three ways small Adelaide businesses actually get hurt.

Business email compromise

Someone gets into a mailbox, watches quietly, then sends your customer an invoice with their bank details on it. Your customer pays. The money is gone and the relationship is damaged.

Ransomware through a laptop

One click on one attachment, and files across the network are encrypted. Whether this is a bad week or a business-ending event comes down entirely to whether the backups work.

Credential stuffing

A password reused from a service that was breached years ago. Nothing gets hacked in any dramatic sense — someone simply logs in as your staff member.

None of these require a sophisticated attacker. All three are substantially prevented by multi-factor authentication, mail authentication and tested backups.

Where we start

The assessment, then the list.

We look at your environment against the Australian Cyber Security Centre's Essential Eight — the mitigations the ACSC identifies as most effective — and produce a plain-English report of where you stand and what to do about it, in priority order with effort and cost against each item.

You keep the report whether or not you engage us to fix anything. It is useful on its own, and increasingly it is the thing your insurer or a larger client will ask you for.

Application control and patching status
Microsoft Office macro settings
User application hardening
Administrative privilege review
Operating system patch currency
Multi-factor authentication coverage
Backup regime and whether restores have been tested
Email authentication and phishing resistance

The essentials

The controls that do most of the work.

Multi-factor authentication

The single highest-value control there is. Enforced across email, remote access and anything holding customer data — not optional, not just for admins.

Email and phishing protection

SPF, DKIM and DMARC so nobody can convincingly impersonate your domain, plus anti-impersonation rules on inbound mail.

Device protection

Endpoint protection, disk encryption and the ability to wipe a lost laptop remotely. A stolen unencrypted laptop is a data breach.

Patching

Operating systems, browsers and applications kept current on a schedule, because most successful attacks use vulnerabilities that were fixed months earlier.

Backup and recovery

Offsite, versioned, and restore-tested. A backup nobody has ever restored from is a hope, not a control.

Access control

Staff with the access they need and not more. Admin rights reviewed. Departing staff removed the same day.

Staff awareness

A short, practical session on what the current scams actually look like. Your team is the control that catches what the software misses.

Incident response plan

Who to call, what to shut down, who has to be notified and in what order. Written down before you need it, not during.

Obligations

If something does go wrong, you may have to report it.

Under the Notifiable Data Breaches scheme, an eligible breach of personal information has to be reported to the OAIC and to the individuals affected. Working out whether a breach is eligible — while the incident is still live — is a bad time to be reading the legislation for the first time.

Part of the response plan is knowing in advance what data you hold, where it lives, and what your obligations would be. We are not lawyers, and for anything genuinely contentious you should take legal advice, but we can make sure the technical facts are recorded properly.

Questions

Before you ask us.

We are too small to be a target. Why bother?

Almost none of this is targeted. Attacks are automated and indiscriminate — they scan for exposed services and reused passwords, and they do not check your revenue first. Small businesses are hit more often precisely because the basic controls are usually missing.

How much does this cost?

The assessment is a fixed piece of work. The remediation depends on what it finds, but a large share of it is usually enabling features you are already paying for inside Microsoft 365, which costs time rather than new licences. You will get the list with costs against it before anything is committed.

Will multi-factor authentication annoy my staff?

Set up badly, yes. Set up properly, most people approve a prompt on their phone once every few weeks on their usual device. We configure it so trusted devices are not challenged constantly, which is the difference between staff accepting it and staff looking for workarounds.

Do we need cyber insurance?

That is a conversation for your broker, but be aware that most policies now require specific controls — MFA and tested backups in particular — and a claim can be declined if they were not in place. The assessment tells you where you stand against those requirements.

What does Essential Eight mean?

It is a set of eight mitigation strategies published by the Australian Cyber Security Centre, with maturity levels from zero to three. Most small businesses sit at zero or one. Getting to a solid maturity level one covers the overwhelming majority of real-world risk.

Can you help if we have already been breached?

Yes. Call us. The first priority is containment and preserving evidence, and the worst thing to do is start deleting things or paying anyone before you know the scope.

Related services

Tell us what you need.

You do not need to know what to call it. Describe the problem in your own words and we will tell you what it takes to fix — and what it costs — before you commit to anything.