RemoteCyber hygiene
Most breaches still get in through the basics. Check yours in five minutes.
Missing MFA, late updates, backups that can be deleted, and accounts nobody closed. Here is what good hygiene looks like, what the latest breach data says, and a 12-point review that shows your gaps in the order to fix them.
Breach data from the Verizon 2026 DBIR, patch timeframes from ASD. Checked 30 October 2026.
- The 12 basics
- 2026 breach data
- Free hygiene review
Reviewed by Blake Bath, General Manager, on 30 October 2026.
What the data says
What the 2026 breach data says about the basics.
From the Verizon 2026 Data Breach Investigations Report, covering more than 22,000 breaches.
Unpatched systems
Exploiting vulnerabilities was the top way in, at 31% of breaches.
- Automatic updates
- Checked weekly
- Old systems replaced
Slow patching
Only 26% of known exploited vulnerabilities were fully fixed, with a median of 43 days.
- 48-hour rule for critical
- Reporting
- Owner named
People
62% of breaches involved a person, through a click, a mistake or a misused account.
- Phishing-resistant MFA
- Reporting culture
- Short training
Suppliers
Third parties were involved in 48% of breaches.
- Supplier list
- Least access
- App consent review
Cyber hygiene review
Run a five-minute cyber hygiene review.
Tick what is true today. Be honest: if you are not sure, leave it unticked. You get your gaps in the order we would close them.
Tick what is true for your business today.
Where you stand
0of 12 basics in place
12 gaps to close.
- MFA on every accountStolen passwords are still one of the most common ways in.
- Admins use passkeys or security keysAdmin accounts can switch off everything else.
- A business password managerReused passwords turn one breach into many.
- Updates install automaticallyVulnerability exploitation is now the top way into breached businesses.
- Nothing past its support dateUnsupported software stops getting fixes.
- Endpoint protection with 24/7 monitoringAn alert nobody reads is not protection.
- Disk encryption on every deviceA lost laptop should be a hardware cost, not a data breach.
- DMARC at reject on your domainStops scammers sending email as your business.
- Backups that are offsite, immutable and testedBackups that cannot be deleted are what beat ransomware.
- Leavers lose access the same dayOld accounts are easy doors.
- You know which suppliers can reach your systemsThird parties were involved in nearly half of breaches in the 2026 DBIR.
- Staff know how to report something oddPeople are involved in most breaches. Fast reports limit the damage.
What good looks like
Good hygiene, area by area.
| Area | Good looks like | Common gap |
|---|---|---|
| Sign-in | MFA everywhere, passkeys for admins, separate admin accounts | Text message codes on admin accounts |
| Passwords | Business password manager, no reuse | Shared spreadsheet of logins |
| Updates | Automatic, checked, critical fixes within 48 hours | Updates deferred for months |
| Devices | Encrypted, managed, monitored 24/7 | Antivirus with nobody watching |
| DMARC at reject, impersonation protection | DMARC stuck at none | |
| Backups | Offsite, immutable, restore-tested | One copy that ransomware can delete |
| People | Leavers removed same day, staff report quickly | Old accounts still active |
| Suppliers | Known list, least access | Unknown apps with access to mail and files |
Updates
How fast updates should go on.
| What | Critical or being exploited | Otherwise |
|---|---|---|
| Online services and internet-facing systems | 48 hours | Two weeks |
| Office software, browsers, email clients, PDF readers | Two weeks | Two weeks |
| Unsupported software | Remove or replace | Remove or replace |
Windows Server 2016 stops getting security updates on 12 January 2027. Check your servers now.
What goes wrong
Why hygiene slips.
- New tools before basicsBuying the next product while MFA is still missing.
- Deployed is not configuredThe tool is installed but the policy that makes it work is off.
- Nobody owns itHygiene drifts without a named person or provider checking it.
- Checked once a yearSettings change every month. Check at least quarterly.
Our view
Measure it, do not assume it.
Most businesses we assess believe they have MFA everywhere and automatic updates. When we check the settings, there is usually an exception: a shared mailbox with a password, an old admin account, or a group of laptops that stopped updating months ago.
Good hygiene is less about tools and more about checking, every month, that what should be on actually is. That is what we report on for our clients.
The order
Getting the basics right in five steps.
- Step 1Review
Check settings, not assumptions.
- Step 2Fix sign-in first
MFA everywhere, passkeys for admins.
- Step 3Fix updates and devices
Automatic, encrypted, monitored.
- Step 4Fix email and backups
DMARC at reject, immutable tested backups.
- Step 5Check monthly
A short report that shows nothing has slipped.
Related guides
Hygiene is the baseline. Here is each piece in depth.
Sign-in, endpoints, email, backups and the framework that ties them together.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about cyber hygiene.
What is cyber hygiene?
The everyday basics that make a business hard to break into: MFA on every account, updates applied quickly, endpoint protection that someone watches, backups that cannot be deleted, and people who report things. Most breaches still come through gaps in these basics, not advanced techniques.
What is a cyber hygiene review?
A check of those basics against what is actually configured, not what people think is configured. The check on this page is a quick self-review. A proper review looks at the settings in Microsoft 365, your devices and your backups, and produces a list of gaps in priority order.
How fast should updates be applied?
The Essential Eight at Maturity Level One sets 48 hours for online services when a vulnerability is critical or being exploited, and two weeks otherwise. Office software and browsers are two weeks. Automate it, then check it actually happened.
Is antivirus enough?
Not on its own. Endpoint detection and response watches behaviour as well as known threats, and 24/7 monitoring means someone acts on what it finds outside business hours.
Does Microsoft 365 need a separate backup?
Microsoft keeps deleted items for limited periods, then they are gone. A separate backup, or Microsoft 365 Backup, protects against deletion by a hacked account, a departing staff member or a mistake found months later.
How does this relate to the Essential Eight?
Most of these basics are part of the Essential Eight or support it. Getting them in place is the practical path to Maturity Level One, which is what many insurers and clients now ask about.
Next step
Want a proper hygiene review?
We check the actual settings in your Microsoft 365, devices, email and backups, and give you a scored list of gaps with a cost to close each one.
Keep reading
Reviewed by Blake Bath, General Manager, on 30 October 2026. Breach statistics from the Verizon 2026 DBIR (data from November 2024 to October 2025). Patch timeframes from ASD. Checked 30 October 2026. Verizon, Data Breach Investigations Report; Positive Technologies, Verizon DBIR 2026 summary; ASD Blueprint, Essential Eight patch applications; ASD, Essential Eight maturity model; Microsoft Lifecycle, Ending support in 2027