Cybersecurity became a sales category, and that is part of the problem. The pitch leads with a worst-case breach and lands on a product that happens to prevent it. Telling real risk from a well-built deck is hard, and telling what your business specifically needs is harder when the marketing is written for everyone.
The honest starting point is that you do not know what you do not know. Most businesses have no clear picture of which systems hold sensitive data, who can reach it, or whether a departed employee’s login still works. That picture is worth more than the next tool.
What you can buy here
Assess
Scoped to your business, fixed fee, a written report you keep.
Guide
What to buy and who from. Requirements, shortlist, contract review.
Oversee
Someone else delivers, and you have someone on your side of the table.
Run it
Running it day to day: a fixed-price service for small setups, a partner at scale.
The assessment
I review your systems, access controls and data handling against the Australian Cyber Security Centre’s Essential Eight, or a comparable framework where that fits your situation better. You get a baseline instead of an impression, and a maturity level per control rather than a pass or fail, so you can see the distance between where you are and where you want to be.
Most small businesses do not need Maturity Level 3 across the board. Deciding which controls genuinely warrant the effort is a large part of the value, and it is a decision that gets made badly when a product is attached to it.
The output is a written report in plain language, sequenced. Some fixes are close to free, like removing stale accounts or enabling multi-factor authentication where it is missing. Others are real work. Cheapest and most effective first, with the cost of each set against the risk it removes.
Your obligations, specifically
The Privacy Act 1988 and its Notifiable Data Breaches scheme apply to businesses turning over more than $3 million, and to some smaller businesses regardless of turnover. Health service providers are one example. From 1 July 2026, accountants, lawyers, conveyancers and real estate agents are another, for the information they collect under the anti-money-laundering rules.
The Cyber Security Act 2024 added ransomware payment reporting. If your business turned over more than $3 million last financial year and pays a ransom, it must report the payment within 72 hours. That has applied since 30 May 2025, with enforcement from 1 January 2026. Other parts of the Act are scoped to particular sectors.
I will tell you which parts apply to your business rather than assuming the worst case, because assuming the worst case is how you end up buying controls you are not required to have.
What I run myself, and what goes to a partner
Some of this I run myself, at a fixed price. If an insurer or a large client has sent you a questionnaire, the Cyber Questionnaire Answer gets it answered honestly in one call. If you are a small business on standard cloud tools, the Tech Health Check looks across your whole setup, security included, and ends in a written plan. Both are fixed-price checks on Services I run.
Monitoring is different. I scope and specify it, and a partner runs it. I will tell you what needs watching, why, and what a sensible response time looks like, then help you choose who watches it and hold them to it. A solo consultant cannot personally provide 24/7 monitoring, and should not claim to.
Who this is for
Any business holding customer data, financial information or staff records, which is nearly all of them. It is particularly worth doing if you have never had a formal assessment, if you are unsure whether the Notifiable Data Breaches scheme applies to you, or if a client or insurer has started asking about your security posture as a condition of doing business.
Common questions
We have never had a breach. Do we need this?
Most businesses that get breached did not think they needed it either. The assessment usually surfaces several quick, low-cost fixes, and it is cheap relative to a single incident.
Our insurer sent us a questionnaire we cannot answer. Can you help?
Yes, and this is one of the most common reasons people call. Insurer questionnaires are effectively a security audit with money attached, and answering them accurately matters more than answering them favourably. Under about $3 million in turnover, the fixed-price Cyber Questionnaire Answer on Services I run is usually the right place to start.
Does the Cyber Security Act 2024 apply to a business our size?
The ransomware reporting rule applies if you turned over more than $3 million last financial year. Most of the rest is sector-specific. I will tell you plainly which parts reach you.
We already use a security product. Is that enough?
Sometimes. I assess what you have and tell you honestly whether it is doing the job, rather than treating a replacement as the default recommendation.
How long does an assessment take?
For most small and mid-sized businesses, one to two weeks from kickoff to a written report, depending on how many systems and locations are in scope.
Next step
If you want to get your bearings first, the Essential Eight in plain English explains what each control does and where to begin. Otherwise book a 20-minute technology conversation, and bring the questionnaire if you have one.