Cyber Security Services
for Australian Businesses
We help secure the devices, email, accounts and data of small and medium businesses, monitor them 24/7 and act when something looks wrong. These are the kinds of controls the ASD Essentials and SMB1001 cover.
- SMB1001 Gold achieved
- 24/7 monitoring
- No lock-in contracts
Average reported cost of a cybercrime to an Australian small business in 2024-25 (ASD).
Achieved through CyberCert
Monitoring of devices, email and accounts
Typical response to security incidents, business hours
Businesses supported
Security we set up, watch and act on
We set up each control, monitor it and respond to its alerts as part of your managed service.
Endpoint protection and EDR
Managed antivirus plus endpoint detection and response (EDR) on every computer. Alerts come to our team, not your staff, and we investigate and act on them.
Sign-in and identity protection
We watch sign-ins to Microsoft 365 and Google Workspace, flag unusual logins and lock down compromised accounts. Sign-ins from overseas are blocked on Microsoft 365 unless you need them, and detected and blocked on Google Workspace.
Email security and anti-spoofing
Spam and phishing filtering, plus SPF, DKIM and DMARC set up and monitored, so criminals find it much harder to send email pretending to be you. Check your domain free.
Admin rights removed
Staff don’t run as administrators. When someone needs new software, they request it and we approve it during business hours, which helps block a lot of malware before it can run.
Patching and vulnerability scanning
Operating systems and apps are patched on a schedule, and regular scans find known weaknesses. Critical fixes go on first, the rest after hours.
Security awareness training
Short online training and simulated phishing emails for your team, with completion tracked to show who needs a refresher.
The service also covers dark web monitoring for leaked passwords, web filtering, and backup monitoring with test restores. See data backup and recovery.
Security only, or security and support? Core IT Security gives you this protection, with support billed only when you use it. Fully Managed IT adds day-to-day IT support for one fixed monthly fee. Watch the 45-second comparison
Where small businesses get caught out
Australians reported a cybercrime to the Australian Signals Directorate (ASD) every six minutes in 2024-25. Email compromise and business email compromise fraud were the most common crimes reported by businesses.
Attackers don’t need to be clever when a password has no multi-factor authentication behind it, or when nobody is watching who signs in to your email. Many small businesses have antivirus and little else.
You don’t need an enterprise security team. You need multi-factor authentication, EDR, patching and tested backups, set up properly and watched every day. We do that work.
- A staff member clicks a convincing fake invoice or login page
- An email account is taken over and used to redirect payments
- A stolen password with no multi-factor authentication behind it
- A laptop or app with a known weakness nobody has patched
- Backups nobody has tested until the day they are needed
Not sure how exposed you are?
Our free cyber security assessment checks your devices, email, accounts and backups, then gives you a clear report on what to fix first. It’s free and there’s no obligation.
Antivirus on its own versus managed security
Antivirus catches known threats. Many attacks on small businesses now start with a stolen login or a convincing email, which antivirus often doesn’t see.
Catches known viruses
Spots unusual behaviour on devices, including new threats
Alerts pop up on staff screens
Alerts go to our team, who investigate and act
No view of email or account sign-ins
Microsoft 365 and Google Workspace sign-ins monitored
Everyone is an administrator
Admin rights removed, software installs approved by us
Backups assumed to work
Backups monitored and test-restored
Nobody to call during an incident
A team that contains it and helps you meet reporting obligations
ASD Essentials, Essential Eight, SMB1001 certification
ASD launched the ASD Essentials in October 2026. It is superseding the Essential Eight, both apply during the transition, and ASD hasn’t set an end date. ASD Essentials for cloud fits businesses entirely on Microsoft 365 or Google Workspace with no servers, and ASD Essentials for enterprise IT fits servers, on-premises or hybrid. The controls we run are the kinds the Essentials covers. If you still report against the Essential Eight, we assess your maturity level for it.
SMB1001 is an international cyber security standard built for small and medium businesses, with certification through CyberCert. We achieved Gold ourselves, and as a CyberCert Partner we help clients get certified at Bronze, Silver or Gold, doing the technical work and preparing the evidence. Not sure where you stand? The free SMB1001 readiness check takes a few minutes.
- Evidence for cyber insurance applications and renewals
- Straight answers to client and tender security questionnaires
- A clear plan, highest risk first, instead of random fixes
- A recognised certificate if you choose SMB1001
How we secure your business
We start with the most urgent gaps.
Security assessment
We review your devices, email, accounts, admin rights, patching, cloud settings and backups, and show you where the gaps are.
Fix and deploy
We close the urgent gaps first, then roll out our security tools and settings.
Monitor and respond
Your systems are monitored 24/7 and alerts are escalated to our team. If something looks wrong, we investigate, contain it and tell you what happened, without the jargon.
Review and improve
We review your security, keep up with the ASD Essentials and SMB1001, add controls as threats change and keep your team trained.
Businesses we protect
- Businesses on Microsoft 365 or Google Workspace with no security monitoring
- Anyone asked by an insurer to improve their cyber security
- Businesses working towards SMB1001 or still reporting on the Essential Eight
- Healthcare, legal, finance and construction firms holding sensitive data
- Businesses that have had a phishing or email compromise scare
- Directors who need to prove to clients that security is taken seriously
Already have an IT provider?
We can work alongside them as your security layer, or look after IT and security together as part of managed IT services.
Already been hit?
Call us on 1300 619 750. We contain the incident, restore what we can and help you work through the Notifiable Data Breaches scheme if it applies.
We hold ourselves to the same standard
SEQ IT achieved SMB1001 Gold, an international cyber security standard for small and medium businesses, through CyberCert. We’re also a CyberCert Partner, so the controls we put in place for you are the same ones we run ourselves.
SMB1001 Gold
Partner
Partner and Cloud Solution Provider (CSP)
Google Cloud Partner
A hijacked mailbox, shut down
The problem. A staff member at a tax practice typed their Microsoft 365 password into a fake sign-in page, and an attacker used it to get into their mailbox.
What we did. Our first job was to cut the attacker off. We blocked sign-in on the account, reset the password and removed the existing MFA methods, so the attacker couldn’t keep or reuse any they had added. We revoked every active session, which signs the account out everywhere at once, and removed the devices the attacker had registered against it.
We then checked the mailbox for hidden inbox rules and forwarding, which attackers use to hide replies and copy mail out, and reviewed the sign-in logs to see what was accessed.
The result. With fresh credentials and MFA set up again, the staff member was back in their mailbox, and the attacker had no way back in.
Client name withheld to protect their privacy.
Cyber security: common questions
We already have antivirus. Is that enough?
No. Antivirus catches known threats but misses many modern attacks, which start with a stolen login, a fake invoice or a new piece of malware. We add endpoint detection and response (EDR), sign-in monitoring for your email and cloud accounts, and a team that acts on the alerts.
What's the difference between an MSP and an MSSP?
A managed service provider (MSP) looks after your IT. A managed security service provider (MSSP) focuses on security, usually from its own security operations centre (SOC). We’re an MSP with security built in: our managed plans include 24/7 threat monitoring by our security partner’s operations centre, staffed by human analysts, and our team follows up on anything they find. You deal with one team for both your IT and your security.
Do we need the ASD Essentials or the Essential Eight?
The Essential Eight is being superseded by the ASD Essentials, and both apply during the transition (ASD hasn’t set an end date). If you hold client, financial or personal information, the controls they describe are a sensible baseline. If a client, contract or regulator still asks for an Essential Eight maturity level, we assess it for you, as a transitional measure rather than a score for your overall security.
What is SMB1001 and do we need it?
SMB1001 is an international cyber security standard designed for small and medium businesses, with tiers from Bronze upwards. Certification gives clients, insurers and tender panels a recognised certificate, issued through CyberCert, showing your security meets the standard. We take businesses through certification at Bronze, Silver and Gold.
What happens if we get breached?
For managed clients, we start as soon as we know: we investigate, work to contain the threat, lock down affected accounts and restore from backup where needed. We then explain what happened and help you assess whether you need to notify under the Notifiable Data Breaches scheme.
Can you help with our cyber insurance?
Yes. The controls we put in place, such as multi-factor authentication, EDR, patching, email security and tested backups, are the ones insurers ask about. We help you answer the questionnaire accurately and provide evidence. See cyber insurance readiness.
Does this replace our IT support?
It can sit alongside your current IT provider as a separate security layer. Or, if you want one team for everything, security is built into our managed IT services as standard.
How much does cyber security cost?
It depends on your number of users and how complex your setup is. As a guide, Core IT Security is $125 to $157 per user per month inc GST (minimum 5 users), with support billed as you use it, and Fully Managed IT, which includes day-to-day support, is $220 to $250 per user per month inc GST. The first assessment is free, and you then get a fixed monthly price with no lock-in contract.
What don't your cyber security services cover?
Our cyber security services cover your devices, accounts, email and data. They don’t cover website or web application security, or physical security such as alarms, CCTV and building access. No security service can prevent every incident. Our services reduce the likelihood and impact of one.
More ways we protect your business
Security works best as a set of controls that back each other up.
Cyber security in Brisbane
Onsite and remote security support across Greater Brisbane.
Essential Eight
The move to the ASD Essentials, and Essential Eight assessments.
SMB1001 certification
Bronze to Gold, with a CyberCert Partner.
Cyber insurance readiness
Answer the questionnaire honestly and close the gaps.
Business continuity planning
A tested plan for when something goes wrong.
Cyber security on the Gold Coast
Onsite help and 24/7 monitoring, Coomera to Coolangatta.
What is MFA?
How multi-factor authentication works, and which methods to use.
Find out where your business is exposed
Tell us about your business and we’ll review your current security, point out the gaps and tell you what it would take to close them. No obligation.
- What we found, without the jargon
- What to fix first, and why
- A fixed monthly price if you want us to manage it
Prefer to talk? Call 1300 619 750, Monday to Friday. Or book a free cyber security assessment.
Tell us what you need and we’ll get back to you.