The short answer: A proper cybersecurity audit for a small Australian business usually costs $300-$800 as a one-off. My comprehensive review starts at $350 - right in the range most businesses expect to pay.

But price alone tells you very little. What matters is what's actually in the audit and whether you can act on it. Here's how to tell good value from a box-ticking exercise.

What's included in a typical IT security audit?

A quality audit is more than a scanning tool. Expect:

  • Discovery call (60 minutes) - Understanding your business setup, systems and workflows.
  • Technical review - Assessment of Microsoft 365, Google Workspace, email configuration, devices and backups.
  • Vulnerability scan - Light-touch check for exposed services and public data leaks.
  • Written report - Plain-English findings with a prioritised list of fixes you can actually act on.

Average Australian pricing by provider type

| Provider type | Typical cost | What you get | | --- | --- | --- | | Boutique specialist (like Jordan Gall) | $300-$450 one-off | Personalised, plain-English report with actionable steps | | MSP offering audits | $500-$1,200 | Often bundled with an ongoing support contract | | Big 4 consulting firms | $3,000-$15,000+ | Heavy compliance documentation (often overkill for small business) | | DIY tools only | $0-$200 | Automated scans with no human interpretation |

What to look for in a good audit

The cheapest option isn't always the best value. A proper audit should deliver:

  • Plain-English language - Reports that read like advice, not compliance documents full of acronyms.
  • Prioritised recommendations - Tackle the gaps that matter most to your business first.
  • No vendor lock-in - Advice on what's right for you, not what pays a commission.
  • Australian context - An understanding of local threats and frameworks like the Essential Eight.

The cost of doing nothing

The ACSC estimates the average cost of a cyber-attack on an Australian small business at $46,000. A $350 audit that finds vulnerabilities before they're exploited is less than 1% of that potential loss.

How my Audit & Consult service works

My Audit & Consult offering gives small businesses exactly what they need:

  • 60-minute discovery call to understand your setup.
  • Walkthrough of Microsoft 365, Google Workspace, email, devices and backups.
  • Light-touch scan of exposed services and public data.
  • Plain-English written report with a prioritised fix list.

All for $350 one-off, no obligation. Based in Kingscliff, I serve businesses across the Tweed Shire, Northern Rivers and Australia-wide.

<div class="cta-panel mt-lg"><h2>// Ready to see where you stand?</h2><h3>Take the 2-minute Risk Check</h3><p>Get an instant risk score and personalised next steps - no email required.</p><div class="cta-actions"><a class="btn btn-primary" href="/assessment.html">Start the Risk Check →</a></div></div>

If you'd like a proper audit with real human review, get in touch. I'm based in Kingscliff and work with businesses across Australia.

Key takeaways

1. Expect to pay $300-$800 for a genuine small-business audit. 2. Value beats price - a plain-English, prioritised report is worth more than a raw scan. 3. Avoid vendor lock-in - good advice is impartial. 4. Local context matters - Essential Eight and Australian threats should shape the findings.