CYBERSECURITY SERVICES
Know exactly where you stand
We review your systems, accounts, devices and backups against the Essential Eight, the security baseline published by the Australian Signals Directorate. You get a plain English report showing where you sit today, what is actually exposed, and a fix list ordered by what matters most rather than what is easiest to sell you.
- Assessment against all eight Essential Eight strategies, with a maturity rating for each
- Review of user accounts, administrator access and multi-factor authentication
- Patching, backup and recovery checks, including whether backups actually restore
- A walkthrough session where we take you through the findings
Any business that has never had an independent security review, or that has been asked to prove its security position by an insurer, a tender panel or a larger customer.
Find it before somebody else does
Authorised testing of your website, application or network. We look for the ways in, confirm by hand which ones are genuinely exploitable rather than just flagged by a scanner, and rate each finding so your team knows what to fix this week and what can wait.
- External and internal network vulnerability assessment
- Web application testing against the OWASP Top Ten
- Manual verification of findings, so you are not handed raw scanner output
- Every finding rated by severity, with evidence and clear steps to reproduce it
- A free retest once your team has made the fixes
Businesses with a public facing website, portal or application. Also anyone who has been asked for a test report as a condition of a contract, tender or insurance policy.
Your website is your front door
We harden the website you already run. Certificates, security headers, plugin and platform patching, administrator access, firewall rules and backups. This is the same work we do on the sites we build and host ourselves, offered to sites we did not build.
- Certificate and encryption configuration, and security header setup
- Platform, theme and plugin patching, plus a cleanup of old administrator accounts
- Web application firewall put in place and tuned
- Backups configured, and a restore actually tested rather than assumed
Anyone running WordPress, a custom site, a booking system or a client login area, particularly where the site collects customer details or takes payment.
The settings nobody revisited after setup
Email, files and cloud hosting are where most businesses actually keep their data, and they are usually configured once and never looked at again. We review your Microsoft 365 tenancy and your cloud environment against a hardening baseline, then make the changes with you rather than handing over a list.
- Review of administrator accounts, dormant users, guest access and old sign-in methods
- Multi-factor authentication rolled out properly, not just switched on
- Access rules designed around how your team actually works
- Logging and backup checked so there is a record if something goes wrong
Any business running Microsoft 365 for email and files, or hosting an application in the cloud
Stop the invoice that is not yours
Invoice fraud works because an attacker can send email that looks like it came from your domain. We configure the three email authentication records that stop that, check every system that sends mail on your behalf, and tighten the finance process that the fraud actually targets.
- Sender Policy Framework, DomainKeys Identified Mail and domain-based authentication configured and enforced
- An audit of every service sending email as your domain, including ones nobody remembers setting up
- Mailbox rule and forwarding audit, a common sign of an account already compromised
- A simple payment verification process for your finance team
Every business that sends invoices or pays them. Also required for certification under SMB1001 from the Silver tier upwards, which is increasingly asked for in supplier questionnaires.
Train the people the attackers actually target
Short, practical training for your staff, followed by simulated phishing emails sent to your own team. Results are reported by department rather than by individual, so the point stays improvement rather than blame, and you can show the trend across the year.
- A live or recorded session on phishing, invoice fraud and password practice
- Simulated phishing campaigns on an agreed schedule
- Reporting on how many clicked, how many reported it, and how that changes over time
- A clear internal process so staff know who to tell when something looks wrong
Any business with staff handling email, invoices, payroll or customer records. Particularly where a fake invoice or payment redirection has already been seen.
Someone actually reading the logs
We set up monitoring across your servers, computers and network, tune it so the alerts mean something, and report on what it saw. The goal is not another dashboard. It is that a real intrusion produces an alert that somebody reads and acts on.
- Monitoring platform deployed and your systems connected to it
- Alerts tuned so you are not buried in noise
- A monthly report on what was seen and what was done about it
- A written escalation plan agreed before anything goes live
Businesses that have already closed the basics and now need to know when something goes wrong. Monitoring is reviewed during Australian business hours, with escalation contacts agreed in advance.
Security support that fits
the way you work
Choose the engagement model that fits your business, from a defined project to ongoing security support.
Fixed Scope Project
Fixed Scope Project
One service, scoped and priced up front, delivered and documented. Clear start, clear finish, no ongoing commitment.
This is how most clients begin.Ongoing Retainer
Ongoing Retainer
A monthly engagement covering monitoring, patching, phishing campaigns and reporting, with a re-check each quarter.
Security drifts as your systems change, and this is what keeps it from drifting.Security Support On Call
Security Support On Call
An agreed number of days each month, acting as the security function for a business too small to hire one.
Useful when questionnaires, tenders and client requests keep arriving.How We Work
Discovery call
Thirty minutes on what you run and what you are being asked for. We tell you at the end which of these services applies and which do not.
Scope and permission
What we look at, when, and who to call is agreed in writing before anything starts. Nothing is tested without your written authorisation.
The work
Assessment, testing or build, run to the agreed scope. Anything that could cause disruption is discussed with you first.
Findings
A report in two halves: a summary a director can read and detail an engineer can act on. Anything critical is called through the moment we confirm it, not held for the report.
Fix and retest
We help close the findings, then check the fixes worked. Ongoing support is optional and always priced separately.
Setting Clear Boundaries for Better Collaboration
We are not your IT provider
Helpdesk, devices and networks stay with whoever looks after them today. We work alongside them, and the fix list usually goes straight to them.
We do not monitor around the clock
Monitoring is reviewed during Australian business hours. If you need coverage twenty four hours a day we will tell you and point you to someone who offers it.
We do not certify you
We do the preparation and the gap work. The certificate itself is issued by the certifying body, not by us. Be careful with anyone who says otherwise
We do not handle live breaches
We are not an incident response or forensics firm. If you are in the middle of an incident, call us and we will help you contain it.
Start with the question you have been asked and cannot answer.
30 minutes, no cost, and a straight answer either way.