Local IT for Lake Macquarie, Newcastle, the Central Coast & the Hunter
Mon–Fri, 9am–5pm
Get remote support now
Local IT for Lake Macquarie, Newcastle, the Central Coast & the Hunter
Keep it safe
Cyber Security
The handful of controls that stop most real attacks, sized for a small business. We switch them on, watch them, and explain in plain English when something needs your attention.
Keep it safe
Cyber Security
The handful of controls that stop most real attacks, sized for a small business. We switch them on, watch them, and explain in plain English when something needs your attention.
Keep it safe
Cyber Security
The handful of controls that stop most real attacks, sized for a small business. We switch them on, watch them, and explain in plain English when something needs your attention.
The problem
How most small business breaches start
Most businesses this size aren’t picked on purpose. Logins get harvested in bulk through fake sign-in pages and passwords reused from other sites, and the list gets worked through later. A mailbox without MFA is the easy way in. What follows looks like your bookkeeper signing in.
Which is why antivirus on its own keeps missing it. Nothing breaks, nothing pops up, and the first sign is usually a supplier ringing about an invoice with the wrong bank details on it. By then it’s a payment to chase and a notification obligation to work out.
The problem
How most small business breaches start
Most businesses this size aren’t picked on purpose. Logins get harvested in bulk through fake sign-in pages and passwords reused from other sites, and the list gets worked through later. A mailbox without MFA is the easy way in. What follows looks like your bookkeeper signing in.
Which is why antivirus on its own keeps missing it. Nothing breaks, nothing pops up, and the first sign is usually a supplier ringing about an invoice with the wrong bank details on it. By then it’s a payment to chase and a notification obligation to work out.
The problem
How most small business breaches start
Most businesses this size aren’t picked on purpose. Logins get harvested in bulk through fake sign-in pages and passwords reused from other sites, and the list gets worked through later. A mailbox without MFA is the easy way in. What follows looks like your bookkeeper signing in.
Which is why antivirus on its own keeps missing it. Nothing breaks, nothing pops up, and the first sign is usually a supplier ringing about an invoice with the wrong bank details on it. By then it’s a payment to chase and a notification obligation to work out.
What’s included
Layered protection, in case one layer fails
Built for a small team, without an enterprise console someone has to watch all day.
Multi-factor authentication
Required on every account
Managed endpoint protection
Alerts go straight to our team
Email threat filtering
We chase the false positives
Phishing simulations
Staff aren’t named in reports
Staff security training
Short sessions through the year
Password manager rollout
Includes getting the sticky notes gone
Admin rights separation
You keep a separate admin login for emergencies
Leaver access removal
Same day you tell us
Exposed credential alerts
We monitor the breach dumps
Essential Eight baseline
Scored honestly, not a certification
What’s included
Layered protection, in case one layer fails
Built for a small team, without an enterprise console someone has to watch all day.
Multi-factor authentication
Required on every account
Managed endpoint protection
Alerts go straight to our team
Email threat filtering
We chase the false positives
Phishing simulations
Staff aren’t named in reports
Staff security training
Short sessions through the year
Password manager rollout
Includes getting the sticky notes gone
Admin rights separation
You keep a separate admin login for emergencies
Leaver access removal
Same day you tell us
Exposed credential alerts
We monitor the breach dumps
Essential Eight baseline
Scored honestly, not a certification
What’s included
Layered protection, in case one layer fails
Built for a small team, without an enterprise console someone has to watch all day.
Multi-factor authentication
Required on every account
Managed endpoint protection
Alerts go straight to our team
Email threat filtering
We chase the false positives
Phishing simulations
Staff aren’t named in reports
Staff security training
Short sessions through the year
Password manager rollout
Includes getting the sticky notes gone
Admin rights separation
You keep a separate admin login for emergencies
Leaver access removal
Same day you tell us
Exposed credential alerts
We monitor the breach dumps
Essential Eight baseline
Scored honestly, not a certification
How it starts
What happens in the first month
Order matters. The quiet fixes go in before anything staff will feel.
01
Look, don’t touch
Before we change anything, we check who holds admin rights, which accounts lack MFA, what breach dumps already hold, and which former staff can still sign in. There is nearly always one. You get the findings scored against the Essential Eight, in plain English.
02
Quiet wins first
MFA enforced, leaver accounts closed, admin rights separated from daily logins. These remove most of the real risk and staff barely notice any of it. We do them before anything that asks people to change how they work.
03
The friction week
Password manager rollout and the first training session. This is the part people feel, so it comes with warning, a floor walk and someone to ring. Expect some muttering. It passes faster when we’re upfront that things are changing.
04
Then the watching
Monitoring settles into the background. Endpoint alerts come to us, credential alerts arrive as they surface, and phishing simulations run at random intervals. We re-run the Essential Eight score quarterly, because it slips as new starters arrive and exceptions get left in place.
How it starts
What happens in the first month
Order matters. The quiet fixes go in before anything staff will feel.
01
Look, don’t touch
Before we change anything, we check who holds admin rights, which accounts lack MFA, what breach dumps already hold, and which former staff can still sign in. There is nearly always one. You get the findings scored against the Essential Eight, in plain English.
02
Quiet wins first
MFA enforced, leaver accounts closed, admin rights separated from daily logins. These remove most of the real risk and staff barely notice any of it. We do them before anything that asks people to change how they work.
03
The friction week
Password manager rollout and the first training session. This is the part people feel, so it comes with warning, a floor walk and someone to ring. Expect some muttering. It passes faster when we’re upfront that things are changing.
04
Then the watching
Monitoring settles into the background. Endpoint alerts come to us, credential alerts arrive as they surface, and phishing simulations run at random intervals. We re-run the Essential Eight score quarterly, because it slips as new starters arrive and exceptions get left in place.
How it starts
What happens in the first month
Order matters. The quiet fixes go in before anything staff will feel.
01
Look, don’t touch
Before we change anything, we check who holds admin rights, which accounts lack MFA, what breach dumps already hold, and which former staff can still sign in. There is nearly always one. You get the findings scored against the Essential Eight, in plain English.
02
Quiet wins first
MFA enforced, leaver accounts closed, admin rights separated from daily logins. These remove most of the real risk and staff barely notice any of it. We do them before anything that asks people to change how they work.
03
The friction week
Password manager rollout and the first training session. This is the part people feel, so it comes with warning, a floor walk and someone to ring. Expect some muttering. It passes faster when we’re upfront that things are changing.
04
Then the watching
Monitoring settles into the background. Endpoint alerts come to us, credential alerts arrive as they surface, and phishing simulations run at random intervals. We re-run the Essential Eight score quarterly, because it slips as new starters arrive and exceptions get left in place.
Often paired with
Backup and Recovery
Every ransomware plan ends at the backups. Isolated copies and tested restores are what let you recover.
Learn more →
Managed IT
Security settings drift without upkeep. Managed IT keeps them checked and current.
Learn more →
Networking Services
Access control stops at the front door if guest Wi-Fi shares a flat network with your servers.
Learn more →
Often paired with
Backup and Recovery
Every ransomware plan ends at the backups. Isolated copies and tested restores are what let you recover.
Learn more →
Managed IT
Security settings drift without upkeep. Managed IT keeps them checked and current.
Learn more →
Networking Services
Access control stops at the front door if guest Wi-Fi shares a flat network with your servers.
Learn more →
Often paired with
Backup and Recovery
Every ransomware plan ends at the backups. Isolated copies and tested restores are what let you recover.
Learn more →
Managed IT
Security settings drift without upkeep. Managed IT keeps them checked and current.
Learn more →
Networking Services
Access control stops at the front door if guest Wi-Fi shares a flat network with your servers.
Learn more →
What does it cost?
It depends on headcount and on what you already own. A fair amount of this is licensing you may be paying for and not using. Microsoft 365 Business Premium, for one, covers several of these controls out of the box. Email and account security comes through Cloud Protect, from $20 per user a month, and we show the workings before you sign anything.
Will this make everything harder for my staff?
A bit, at first. MFA adds a tap, the password manager takes a week of muttering, and a few people lose local admin rights. After that it settles, and most days staff don’t notice it. Where a control gets in the way of the work, we change the control. If the safe way isn’t the easy way, people route around it.
What happens if we get breached anyway?
Something will get through eventually. Nobody can honestly promise otherwise. We contain it, work out what was reached, reset credentials and get you working again, then write up what happened in plain English. We aren’t an insurer, so recovery time is billed. If the Notifiable Data Breaches scheme applies, the report is yours to make, and we help you make it.
What don’t you cover?
We are not auditors, insurers or lawyers. Formal certification work, such as ISO 27001, IRAP or anything a tender wants signed off, sits outside what we do. So does penetration testing, though we can bring in someone who does it. Custom line-of-business software stays the vendor’s to fix. We will raise it with them, but we can’t patch code we don’t own.
Do we have to move our IT support to you as well?
Not necessarily. Our security work sits on Essentials, which keeps each computer monitored, patched and protected, and you can add Cloud Protect for email and accounts. Any support you need from us is then billed by the hour, so your day-to-day IT can stay where it is. We need enough access to do the job properly. A 3-month minimum, then month to month, and no lock-in on the initial security review. If someone else manages the network, we will tell you plainly what we need from them.
What does it cost?
It depends on headcount and on what you already own. A fair amount of this is licensing you may be paying for and not using. Microsoft 365 Business Premium, for one, covers several of these controls out of the box. Email and account security comes through Cloud Protect, from $20 per user a month, and we show the workings before you sign anything.
Will this make everything harder for my staff?
A bit, at first. MFA adds a tap, the password manager takes a week of muttering, and a few people lose local admin rights. After that it settles, and most days staff don’t notice it. Where a control gets in the way of the work, we change the control. If the safe way isn’t the easy way, people route around it.
What happens if we get breached anyway?
Something will get through eventually. Nobody can honestly promise otherwise. We contain it, work out what was reached, reset credentials and get you working again, then write up what happened in plain English. We aren’t an insurer, so recovery time is billed. If the Notifiable Data Breaches scheme applies, the report is yours to make, and we help you make it.
What don’t you cover?
We are not auditors, insurers or lawyers. Formal certification work, such as ISO 27001, IRAP or anything a tender wants signed off, sits outside what we do. So does penetration testing, though we can bring in someone who does it. Custom line-of-business software stays the vendor’s to fix. We will raise it with them, but we can’t patch code we don’t own.
Do we have to move our IT support to you as well?
Not necessarily. Our security work sits on Essentials, which keeps each computer monitored, patched and protected, and you can add Cloud Protect for email and accounts. Any support you need from us is then billed by the hour, so your day-to-day IT can stay where it is. We need enough access to do the job properly. A 3-month minimum, then month to month, and no lock-in on the initial security review. If someone else manages the network, we will tell you plainly what we need from them.
What does it cost?
It depends on headcount and on what you already own. A fair amount of this is licensing you may be paying for and not using. Microsoft 365 Business Premium, for one, covers several of these controls out of the box. Email and account security comes through Cloud Protect, from $20 per user a month, and we show the workings before you sign anything.
Will this make everything harder for my staff?
A bit, at first. MFA adds a tap, the password manager takes a week of muttering, and a few people lose local admin rights. After that it settles, and most days staff don’t notice it. Where a control gets in the way of the work, we change the control. If the safe way isn’t the easy way, people route around it.
What happens if we get breached anyway?
Something will get through eventually. Nobody can honestly promise otherwise. We contain it, work out what was reached, reset credentials and get you working again, then write up what happened in plain English. We aren’t an insurer, so recovery time is billed. If the Notifiable Data Breaches scheme applies, the report is yours to make, and we help you make it.
What don’t you cover?
We are not auditors, insurers or lawyers. Formal certification work, such as ISO 27001, IRAP or anything a tender wants signed off, sits outside what we do. So does penetration testing, though we can bring in someone who does it. Custom line-of-business software stays the vendor’s to fix. We will raise it with them, but we can’t patch code we don’t own.
Do we have to move our IT support to you as well?
Not necessarily. Our security work sits on Essentials, which keeps each computer monitored, patched and protected, and you can add Cloud Protect for email and accounts. Any support you need from us is then billed by the hour, so your day-to-day IT can stay where it is. We need enough access to do the job properly. A 3-month minimum, then month to month, and no lock-in on the initial security review. If someone else manages the network, we will tell you plainly what we need from them.
Get a quote for cyber security
Thirty minutes, onsite or remote. You keep the written summary whether or not you go ahead.
Get a quote for cyber security
Thirty minutes, onsite or remote. You keep the written summary whether or not you go ahead.
Get a quote for cyber security
Thirty minutes, onsite or remote. You keep the written summary whether or not you go ahead.