Practical cyber security for Australian organisations holding real data
Most breaches we are asked to investigate did not require a sophisticated attacker. They required an unpatched component, a shared password and nobody watching. Fixing that is unglamorous and it is most of the value.
What is cyber security?
Cyber Security is the assessment, hardening and monitoring work that reduces the chance of a breach and limits the damage when one happens. It covers penetration testing, Essential Eight controls, web application firewall configuration and incident response planning. It suits Australian organisations holding personal information covered by the Privacy Act 1988.
Get a fixed written quote- Typical timeline
- 3 to 8 weeks for assessment and initial uplift
- What drives cost
- Scales with the attack surface: how many applications and environments are in scope, whether testing is authenticated and role-based.
- Best for
- Organisations holding personal, health or financial information
- You own
- The full report, the evidence, the remediation plan and the runbooks
- Built with
- Penetration testing, Essential Eight mapping, WAF, incident response planning
Your handover
What the Notifiable Data Breaches scheme changes for you
Under the Privacy Act 1988, organisations covered by the Act must assess suspected eligible data breaches and notify the Office of the Australian Information Commissioner and affected individuals when serious harm is likely. The practical effect is that a breach stops being a private technical problem you can quietly clean up. It becomes a disclosure obligation on a clock, made while you are still working out what happened.
- 01Penetration test report with reproduction steps
- 02Findings ranked by exploitability and business impact
- 03Essential Eight maturity assessment and gap list
- 04Prioritised remediation plan with effort estimates
- 05Web application firewall configured and tuned
- 06Multi factor authentication and access review completed
- Logging and evidence retention configured
- Written incident response plan with named roles
- Tabletop exercise and retest of closed findings
The rest of the answer
That reframes what preparation means. The question is no longer only how do we stop this, it is also can we determine what was accessed, by whom, and when. Organisations without adequate logging often cannot answer that, which forces them to assume the worst and notify more broadly than the incident may have warranted. Retaining useful logs, knowing where personal information actually sits across your systems, and having a written assessment process are cheap before an incident and impossible to arrange during one. We treat that evidentiary capability as part of the security work rather than a compliance afterthought.
A firewall is not a substitute for the underlying fixes, and we are careful not to present it as one.
Hardening the web layer without breaking the site
Most of the exposure for a typical Australian business sits on its public web presence and the accounts that administer it. Hardening that layer is well understood work and the value is disproportionate to the effort. A web application firewall filters the automated traffic probing for known vulnerabilities, rate limits login attempts and blocks the obvious injection patterns, which removes an enormous volume of low effort attacks before they reach the application.
More on hardening the web layer without breaking the site
A firewall is not a substitute for the underlying fixes, and we are careful not to present it as one. Alongside it we enforce multi factor authentication on every administrative account, remove accounts belonging to former staff and old contractors, move secrets out of configuration files into a managed store, set security headers and a content security policy that is actually restrictive rather than nominally present, and separate production credentials from staging. Where the application is running on a stack somebody else provisioned, this work usually happens alongside managed hosting because the fixes span both layers. For sites still running outdated components, patching discipline through ongoing maintenance is the control that keeps the gains.
How the engagement runs
How a penetration test actually runs
A penetration test is a scoped, authorised attempt to compromise a system, performed by people trying the things an attacker would try. It is not a vulnerability scan, though a scan is usually part of it. The difference is judgement: a scanner reports that a component is out of date, whereas a tester chains three minor findings into an actual account takeover and shows you the path.
- 01ScopingAgree targets, exclusions, testing windows, credentials and emergency contacts in writing
- 02ReconnaissanceMap the attack surface, including subdomains, APIs and forgotten staging environments
- 03Automated scanningEstablish the baseline of known vulnerable components and misconfigurations
- 04Manual testingAuthentication, authorisation, session handling, input validation, file upload and business logic flaws
- 05Exploitation and chainingDemonstrate real impact rather than theoretical risk, safely and reversibly
- 06ReportingFindings ranked by exploitability and business impact, each with reproduction steps and a specific fix
- 07Remediation support and retestWe verify the fixes and reissue the report with findings closed
Two decisions on your side that keep the project moving
Scope is agreed in writing before anything begins, including which systems are in play, what is explicitly out of bounds, whether testing is authenticated, and who to call if something breaks. We test against production only with your consent and a rollback plan, otherwise against an environment that mirrors it. Findings are rated by exploitability and business impact rather than by scanner severity, because a critical rating on a component nobody can reach matters less than a medium rated flaw on your login page.
Choose the right level
The Essential Eight, translated for organisations that are not banks
The Australian Cyber Security Centre's Essential Eight is the most useful baseline available to Australian organisations, partly because it is prescriptive and partly because it is short. It is also written in a register that makes it easy to dismiss as something for government departments. It is not. The mitigations map onto ordinary business decisions and most organisations are already doing three or four of them without calling it that.
Mitigation
01
Patch applications
What it means in practice
Browsers, plugins, CMS components and libraries kept current
Common gap we find
Web stack patched, staff laptops and third party tools forgotten
02
Patch operating systems
What it means in practice
Servers and workstations on supported, updated versions
Common gap we find
One legacy server nobody will touch because something depends on it
03
Multi factor authentication
What it means in practice
A second factor on email, admin panels and remote access
Common gap we find
Enabled for staff, not for contractors or service accounts
04
Restrict administrative privileges
What it means in practice
Admin rights granted by need and reviewed regularly
Common gap we find
Everyone is an administrator because it was easier at setup
05
Application control
What it means in practice
Only approved software can execute on managed devices
Common gap we find
Rarely attempted by smaller organisations, and often reasonably so
06
Regular backups
What it means in practice
Backed up, isolated from production and restore tested
Common gap we find
Backups exist, restores have never been rehearsed
How we work this out during scoping
We assess your current state against each mitigation, place you honestly on the maturity levels, and then argue about sequence rather than aspiration. Aiming for maturity level three across the board is the wrong goal for a fifteen person business. Getting patching, multi factor authentication and tested backups genuinely solid is worth more than a partial implementation of all eight, because those three address the overwhelming majority of what actually happens to Australian SMEs.
Incident response, written before you need it
The worst time to work out who decides whether to take the site offline is at nine on a Saturday morning with customer data possibly exposed. An incident response plan exists to make the first two hours procedural, because those two hours determine both the technical damage and how the event reads later to a regulator, an insurer and your customers.
The plan we write is short and specific to your organisation
The plan we write is short and specific to your organisation. It names who leads, who can authorise disconnecting a system, who speaks to customers and who speaks to the regulator. It lists the evidence to preserve before anyone starts fixing things, because rebuilding a compromised server destroys the ability to determine what was taken. It contains the assessment process for deciding whether a breach is notifiable and the timeframes involved. Then we rehearse it as a tabletop exercise, which is where people discover that the person nominated to authorise the shutdown is on leave and nobody has a backup. Organisations in healthcare and financial services usually need a more formal version of this because of sector obligations, and we scope accordingly.
When a penetration test is the wrong first purchase
If you already know your CMS is two years out of date, half your team shares one login and nobody has tested a backup, a penetration test will tell you what you know at considerable expense. Spend that money on remediation and test afterwards, when the report will find things you could not have guessed. We regularly talk clients out of testing for exactly this reason, and it costs us revenue in the short term.
The rest of the answer
There is also a category of buyer who needs a certificate rather than a security improvement, usually because a customer's procurement process demands one. That is a legitimate commercial need and we will help, but we will be clear about what the document does and does not represent. Conversely, if the driver is architecture, access control and where data lives across a distributed system, the more useful engagement is infrastructure design work. And if you are still deciding what your obligations even are and what to invest in over the next year, that is a strategy conversation, which sits in digital consulting rather than here. Providers delivering services under the NDIS often start there, since their participant data obligations shape everything that follows.
How we scope it
Four ways to scope your Cyber Security project
We do not publish package prices, because the same brief can be a short build or a long one. These are the shapes the work usually takes. Tell us which one sounds like you and you will get a fixed written quote that spells out exactly what it covers.
Cyber Security Setup
Set up correctly, handed over documented
Fixed written quote, agreed before work starts
- Penetration test report with reproduction steps
- Findings ranked by exploitability and business impact
- Essential Eight maturity assessment and gap list
Cyber Security Managed
Managed for you, with monitoring and a person to call
Fixed written quote, agreed before work starts
- Everything in Cyber Security Setup
- Prioritised remediation plan with effort estimates
- Web application firewall configured and tuned
- Multi factor authentication and access review completed
Managed plus
High availability, hardening and a tested restore
Fixed written quote, agreed before work starts
- Everything in Cyber Security Managed
- Logging and evidence retention configured
- Written incident response plan with named roles
- Tabletop exercise and retest of closed findings
Cyber Security Ongoing
Patching, backups and response, every month
Rolling monthly, quoted in writing
- Patching, backups and a restore that has been tested
- Monitoring with a response time written into the agreement
- Security review and dependency updates on a schedule
- Rolling, cancel with 30 days notice
These are shapes, not menus. Most quotes end up somewhere between two of them, and we will say so when the honest answer is the smallest one. Describe the problem and we will tell you which it is.
Questions buyers usually ask
Frequently asked questions
How long does a security engagement take?
An assessment and initial uplift typically runs 3 to 8 weeks. Scoping and reconnaissance take the first week, active testing one to two weeks depending on the size of the attack surface, reporting about a week, and remediation support the remainder. Retesting happens after you have fixed things, which is often a month or two later. Larger environments with multiple applications extend the testing phase most.
What does a penetration test cost?
It scales with the attack surface: how many applications and environments are in scope, whether testing is authenticated and role-based, whether APIs and mobile clients are included, and whether you want a retest after remediation. Compliance driven engagements with formal reporting requirements sit higher. We scope it properly on a call and send a fixed written quote before any work begins.
What do we receive that we can show a client or an auditor?
A full technical report with methodology, scope, findings and evidence, plus an executive summary written for a non technical reader. After remediation and retest we reissue it showing which findings are closed. You own all of it outright and can share it with customers, insurers or auditors. We do not withhold detail or keep evidence on our side.
We are a small business. Is this overkill for us?
It depends entirely on what you hold, not on your headcount. A twelve person medical practice holding patient records has a higher obligation than a fifty person business selling industrial fittings. If you hold health information, financial details or a substantial customer database, the Notifiable Data Breaches scheme applies to you the same way it applies to anyone else. We scope proportionately and will say when a full test is unnecessary.
What happens if you find something serious mid test?
We stop and tell you immediately rather than waiting for the report. Critical findings, particularly anything indicating an existing compromise, are escalated by phone the same day with interim advice on containment. If we find evidence that a breach has already occurred, we shift into response mode and help you preserve the evidence you will need for the assessment process.
Do you also monitor for attacks on an ongoing basis?
We configure logging, alerting and firewall rules so suspicious activity surfaces, and we can review that as part of an ongoing agreement. What we do not run is a full security operations centre with 24 hour analyst coverage. For organisations that genuinely need that, we will say so and help you select a specialist provider rather than pretending our scope stretches that far.
Related services
Start with an honest assessment of where you stand
Tell us what you hold, what it runs on and what is prompting the question. We reply within one business day and quote any testing in writing before it starts.