Cyber security built around the Privacy Act and the Essential Eight.
Managed endpoint detection and response, phishing protection, multi-factor enforcement, and documented incident response. Built in from the start, not retrofitted.
Security by plan
- MFA and Conditional Access
- Every plan
- 24/7 managed detection and response
- Professional
- Security awareness training
- Professional
- Essential Eight alignment work
- Fortified
Cybercrime against Australian business, in three numbers.
From the Australian Signals Directorate's Annual Cyber Threat Report 2024–25. Costs are the average self-reported cost of cybercrime per report.
- $56,600Average cost per report for a small business, up 14% on the year before
- $97,200Average cost per report for a medium business, up 55% on the year before
- 6 minA cybercrime report is made, on average, every six minutes
Email compromise and business email compromise fraud were the two cybercrimes businesses reported most. Source: ASD Annual Cyber Threat Report 2024–25.
Layer by layer, and which plan covers it.
Each plan includes everything in the one below it. Professional and Fortified require Microsoft 365 Business Premium.
| Layer | What we run | Included from |
|---|---|---|
| Identity | Multi-factor authentication and Conditional Access | Essential |
| Devices | Managed antivirus, monitoring and patching | Essential |
| 24/7 managed detection and response, watched by human analysts | Professional | |
| Email & web | Email security and DNS filtering | Professional |
| Advanced email security: impersonation and payment fraud | Fortified | |
| People | Security awareness training and phishing simulations | Professional |
| Data | Microsoft 365 backup with unlimited retention | Professional |
| Annual disaster recovery test | Fortified | |
| Credentials | Dark web credential monitoring | Fortified |
| Governance | Quarterly security posture review | Professional |
| Essential Eight alignment work, monthly control reporting and a compliance evidence pack | Fortified |
Security you can show your clients, your board, and your insurer.
We don't sell security as an add-on. It is part of how every service is delivered, our controls are documented, and we're happy for them to be scrutinised.
- Named technician accounts, multi-factor enforced, sessions logged
- Least-privilege access: nobody holds more access than their role needs
- Documented offboarding kill-list when anyone leaves our team
- Written incident response with defined severity levels
- Alignment reporting against the Essential Eight on our Fortified plan
IdentityNamed accounts, multi-factor enforced
DeviceMonitored, patched, managed antivirus
DataBacked up, with tested restores
Incident response you can hold us to.
A written process with defined severity levels, response targets and a named contact, agreed before anything happens.
Named contact
A single Australian point of contact owns each incident through to resolution. You are never routed to a queue.
Defined severities
Documented severity levels with response targets written into your agreement, measured against AEST and AEDT.
30-day assessment
Suspected eligible data breaches are assessed within the Privacy Act's notifiable data breach timeframes, with your obligations supported end to end.
72-hour reporting
We support your Cyber Security Act 2024 obligations, including the 72-hour ransomware payment reporting window where it applies.
Essential Eight alignment, and what it means.
We build and measure client environments against the ACSC Essential Eight, and we're careful about what that does and doesn't mean.
Under Fortified: implementation
We build and maintain your environment toward Essential Eight alignment and report monthly on which controls are in place and which are outstanding.
Gap analysis: a position
A formal position against the maturity model is our separate Gap Analysis, which we run on environments we didn't build.
Independent assurance: someone else
If you need independent assurance for an insurer, auditor or tender, that calls for an independent assessor. We'll refer you rather than grade our own work.
Straight answers.
Are you Essential Eight, ISO 27001, or SOC 2 certified?
We build and measure client environments against the ACSC Essential Eight, and we can evidence our own controls. We don't claim certification badges we don't hold, and we'd suggest asking any provider who does to show you the certificate.
Can your engineers read our email?
Administrative access means the capability technically exists. That is true of any IT provider, onshore or offshore, including the one you use today. Protection comes from controls rather than geography: named and logged access, least privilege, binding contracts, and a willingness to show you the audit trail for your environment on request.
What happens in a security incident?
You get a documented incident response process with defined severity levels, response targets, and a named contact. For notifiable incidents, we support your obligations under the Privacy Act and the Cyber Security Act 2024, including mandatory reporting timeframes.
Do we need a particular Microsoft 365 licence?
Professional and Fortified require Microsoft 365 Business Premium. The email security, identity protection, device management and data-loss controls in those plans are delivered through it. Without it, we can't provide what we've promised. If you're on Business Standard or below, we'll cover the upgrade during onboarding, or quote you Essential instead.
Is the Essential Eight work in Fortified the same as an assessment?
No, and we're careful about the difference. Under Fortified we build and maintain your environment toward Essential Eight alignment and report monthly on which controls are in place and which are outstanding. That's implementation work, not a rating of it. A formal position against the maturity model is our separate Gap Analysis, which we run on environments we didn't build. And if you need independent assurance for an insurer, auditor or tender, that calls for an independent assessor. We're your implementer, and we'll refer you rather than grade our own work.
Read before you decide.
How to choose a managed IT provider: 12 questions to ask before you sign
What to ask about scope, response times, access, data and exit terms, and what a good answer sounds like.
Read the guideThe Essential Eight, explained in plain English
The eight strategies, the four maturity levels, who it applies to, and what ASD is changing.
Read the guideDoes Microsoft back up your Microsoft 365 data?
How long deleted email and files really stay recoverable, and where a separate backup takes over.
Read the guideSee your IT clearly. Twenty minutes, no obligation.
A short call to understand your setup, your risks, and whether we're the right fit. You'll leave with at least one useful recommendation, even if you never speak to us again.