A clear score
Where you stand today, measured against Microsoft Secure Score and the ACSC Essential Eight, and how it changes over time.
84%
of Australian businesses experienced a cyber-incident in the past year.
Source: Cyber Wardens, 2026
43%
of all cyber-attacks target small businesses.
Source: Verizon, 2025 Data Breach Investigations Report
Why do I need a cyber professional if I have an IT provider?
Same reason you have an accountant and an auditor. One does the work. The other independently checks it's right. Neither is a criticism of the other.
🧑🔧 Your IT provider
Keeps the lights on. Fixes the laptop, sets up the new starter, sorts the printer, renews the licences. Essential, and usually busy.
🛡️ A cybersecurity professional
Checks the locks. Confirms security settings are on and staying on, finds the gaps before an attacker does, and reports to you in plain English.
| IT provider | Cybersecurity professional | |
|---|---|---|
| Main job | Keep your technology running: fix problems, set up staff and devices, manage licences. | Make sure your technology is secure, stays secure, and that you can prove it. |
| Measured on | Tickets closed, uptime, response times. | Risk reduced, gaps found and closed, security score over time. |
| When you hear from them | When something breaks or needs setting up. | Regularly, with a report, even when nothing's broken. |
| Their view of your setup | They built it, so they know it well, but they're checking their own work. | An independent second opinion with no reason to mark their own homework. |
| Who they work for | You, but their priority is keeping things working smoothly. | You, with security as the only priority, including holding suppliers to a standard. |
You can delegate the work, not the responsibility. If client data leaks, your clients, your insurer and potentially the regulator will be talking to you, not your IT provider. An independent check is how you know, rather than hope.
The bare essentials
The small business cyber checklist
25 things every small business should have in place. Tick off what you're confident is done. If you're not sure, leave it unticked; that's usually the first gap worth closing. Your ticks stay in this browser only.
0 of 25
Identity & access
Who can get in, and how.
Devices
Every laptop and phone that touches business data.
Email, domain & data
Where most attacks start.
Resilience
What happens when something goes wrong.
Suppliers & oversight
The people you rely on.
10 questions to ask your IT provider
Not trick questions. A good provider will be glad you asked. Vague, defensive or "don't worry about it" answers tell you something too.
- Who has admin access to our systems, and how is it protected?Expect a list of named accounts with MFA, not "we all use the admin login".
- If you disappeared tomorrow, could we get into everything?The business should hold break-glass admin access to every system.
- Is MFA enforced for every user, and how do you know?Enforced through policy and reported on, not "we asked people to set it up".
- How quickly are security updates applied to our devices?Ideally within 14 days for most updates, and faster for critical ones. Ask for the report.
- What's our Microsoft Secure Score, and what's stopping it going higher?A real number and a reason, not a shrug.
- How are our emails and files backed up, and when did you last test a restore?Separate from Microsoft or Google, with a date for the last test.
- Who monitors security alerts, and what happens out of hours?Alerts that nobody reads don't protect anyone.
- Are SPF, DKIM and DMARC set up on our domain, and what's the DMARC policy?Ideally quarantine or reject, not left on "none" indefinitely.
- Is security in our contract, or just support?Many support agreements cover fixing things, not securing them. Know which you have.
- Would you welcome an independent review of our setup?A good provider says yes. Their work should stand up to a second opinion.
What an independent review gives you
Security settings drift. New staff, new apps, a setting switched off to fix something and never switched back on. A regular review catches it before an attacker does.
A prioritised fix list
The most important gaps first, in plain English, with who should do each one. Your IT provider can do the fixes if you prefer.
Proof for others
Evidence you can show your insurer, clients, lenders or a tender panel when they ask how you protect their data.
Keep learning
GuideThe Last Cybersecurity Guide Your Business Will Ever Need
Beginner's guideWhat technology do I need to run a business?
BaselineThe ACSC Essential Eight, explained
ThreatsWhat is business email compromise?
Microsoft 365What is Microsoft Secure Score?
PasswordsThe password manager every small business should use
Common questions
Isn't my IT provider already doing security?
Often some of it. But fixing laptops and keeping systems running is a different job from making sure they're configured securely and staying that way. Ask them the ten questions on this page and see how they answer.
Will you replace my IT provider?
No. I work alongside your existing provider. You keep the people who know your setup, and gain someone whose only job is making sure it's secure.
We're only a small business. Do we really need this?
Small businesses are targeted precisely because they usually don't have anyone checking. The essentials on this page are inexpensive, and most are already included in what you pay for Microsoft 365.
How often should our setup be reviewed?
At least once a year. If you hold sensitive client information such as financial, health, legal or identity documents, monthly reporting is better.
What does an independent review involve?
A plain-English look at your email, accounts, devices, backups and suppliers, with a measurable score and a prioritised fix list. No obligation to do the fixes through me.
What if we've already been hacked?
Call or message me straight away, and see the urgent help page. Don't wait.
Has your business already been hacked?
Dodgy emails going out, locked files, or a suspicious login. Don't wait.
Get urgent help →