Most businesses know they have exposure somewhere, and very few know where. That is not negligence. It is that the whole category is sold on fear and the marketing is aimed at everyone, so it is almost impossible to tell real risk from a pitch.
The honest starting point is that you cannot fix what you have not measured.
When people come to me for this
Often it is a letter rather than an incident. An insurer sends a questionnaire you cannot confidently answer. A larger client makes security a condition of the contract. Sometimes it is a near miss, an invoice that nearly got paid to the wrong account, and the realisation that nobody knows whether it could happen again.
Occasionally it is just the quiet knowledge that a former employee’s login probably still works.
What you can buy
Assess
Scoped to your business, fixed fee, a written report you keep.
Guide
What to buy and who from. Requirements, shortlist, contract review.
Oversee
Someone else delivers, and you have someone on your side of the table.
What actually happens
I assess your environment against the Australian Cyber Security Centre’s Essential Eight, or an equivalent framework where that fits better, so you get a baseline rather than an impression. You get the result in plain language, not a spreadsheet of severity scores with no context.
Then we sequence it. Some fixes are close to free, like removing stale accounts or turning on multi-factor authentication where it is missing. Others take real work, like changing how sensitive data is stored. The cheap ones that remove the most risk go first, and I am specific about what each one costs against what it actually prevents.
Where the Privacy Act 1988, the Notifiable Data Breaches scheme, or the Cyber Security Act 2024 apply to you, I will tell you plainly which parts apply and which do not, rather than assuming the worst case because it sells better.
Some of the ongoing work I run myself, when it fits a fixed-price service. For a small business on standard cloud tools, that can be email with two-factor login, or one of the fixed-price checks. Those are on Services I run. Past that, a partner runs it and I stay on your side. Monitoring is the usual example: I will tell you what needs watching and why, help you choose who watches it, and hold them to it.
Blocking mail that pretends to come from you is work I quote rather than list. First I find every service that sends mail as your business and set each one up properly, then I watch the reports for some weeks before anything is blocked. The work depends on how many services send as you, so you get a fixed price once I know that.
Where to start
- Cybersecurity assessment Cybersecurity became a sales category, and that is part of the problem. An honest baseline against the Essential Eight, and a plain answer on what the law requires of you.
- Backup and recovery A backup that has never been restored is a hypothesis, not a plan. Including the Microsoft 365 gap most businesses do not know they have.
If you want to get your bearings first, the Essential Eight in plain English explains what each control does and where a small business should begin.
Otherwise book a 20-minute technology conversation. If an insurer or client has sent you a questionnaire, bring it.