Security services

The IT security a small business actually needs, layer by layer.

Security is not one product. It is a few layers that each stop a different kind of attack, plus someone watching. Here are the eight that matter for a small Australian business, what each one protects against, what to ask a provider, and a quick check of what you have today.

Attack data from ASD's Annual Cyber Threat Report 2024-25.

See our security services Check your coverage 07 3114 2808

Eight layers
Mapped to real attacks
Coverage check

Reviewed by Blake Bath, General Manager, on 30 October 2026.

A security engineer shows an interiors studio director something on a tablet beside a table of material samples and plans. — **What it costs when it fails**ASD's average reported cybercrime cost: A$56,600 for a small business, A$97,200 for a medium one.

The layers

Eight layers, and what each stops.

Each closes a different door. Missing one leaves that door open.

Identity

MFA, Conditional Access, admin separation and joiner and leaver steps.

Stops stolen passwords
Phishing-resistant for admins
Leavers removed

Security coverage check

Which layers do you have today?

Tick what is in place. The gaps are the doors still open.

Tick each layer that is properly in place today.

Identity: MFA everywhere, admins on passkeysPlus Conditional Access and clean joiner and leaver steps.
Endpoints: EDR on every deviceLaptops, desktops, servers and Macs, with tamper protection.
Email: filtering and DMARC at rejectSo fewer scams arrive and nobody can send as your domain.
Network: managed firewall and safe remote accessNo remote desktop open to the internet.
Backup: a copy attackers cannot delete, testedIncluding Microsoft 365 or Google data.
Monitoring: someone watching 24/7An MDR service or your own team, nights included.
People: short training and a payment ruleBank detail changes confirmed by phone.
Response: an incident plan you have practisedWho to call, in what order, and how to talk if email is down.

Where you stand

0of 8 layers in place

8 gaps to close.

Identity: MFA everywhere, admins on passkeysEmail takeover is the most reported cybercrime against Australian businesses.
Endpoints: EDR on every deviceAntivirus misses attacks that use normal tools.
Email: filtering and DMARC at rejectMost attacks start with an email.
Network: managed firewall and safe remote accessExposed services are a common way in.
Backup: a copy attackers cannot delete, testedIt decides whether ransomware is a bad week or worse.
Monitoring: someone watching 24/7Alerts nobody reads do not stop anything.
People: short training and a payment rulePayment fraud by email was 15% of business cybercrime reports.
Response: an incident plan you have practisedThe first hour decides how bad it gets.

Fill the gaps

What happens

What the layers are up against.

Reported by businesses	Share of reports	Layers that stop it
Email compromise, no money lost	19%	Identity, email, monitoring
Business email compromise with money lost	15%	People, email, identity
Identity fraud	11%	Identity, people

From ASD's Annual Cyber Threat Report 2024-25 business factsheet.

Before you choose

Questions to ask any security provider.

Which of the eight layers do you cover?And which are left to you or another supplier.
Who watches alerts at night?Named analysts, not an on-call phone.
What can you do without calling us?Isolate devices, disable accounts, in writing.
How do you show it is working?Regular reports, restore tests and Essential Eight progress.
Who owns the admin accounts?They should belong to your business.

How we do it

Security built into the plan, not sold as extras.

Every one of our managed plans carries the same security stack: endpoint protection, 24/7 managed detection and response, identity threat detection, an email security gateway and email authentication, immutable cloud backup, vulnerability scanning, dark web monitoring, awareness training with phishing simulations, and a managed password manager. The plans differ in how support is paid for, not in how well you are protected.

Whoever you choose, map their services against the eight layers. The gaps are where the risk sits.

Getting there

Building your security in five steps.

Step 1Assess
Which layers you have, and how well they work.
Step 2Fix the urgent
MFA, backups and anything exposed.
Step 3Fill the layers
Endpoints, email, network and monitoring.
Step 4Align to a framework
Essential Eight, and SMB1001 if you want a certificate.
Step 5Review
Regularly, as staff and systems change.

Go deeper

Each layer has its own guide. Start with the weakest.

Detail on the layers that matter most.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about IT security services.

What are IT security services?

The tools and people that protect a business's accounts, devices, email, network and data, and respond when something goes wrong. For a small business they usually come as part of a managed IT plan, or from a specialist alongside your IT provider.

What does a small business actually need?

MFA on every account, protection on every device, email filtering, a backup attackers cannot delete, and someone watching alerts. Those cover the attacks Australian businesses report most: email takeover, payment fraud and ransomware.

How much do security services cost?

With us, security is built into our managed plans rather than sold separately, and every plan has the same security stack, including 24/7 managed detection and response. Our published typical prices are A$150, A$250 or A$400 per person a month ex GST. The plans differ in how support is paid for. Confirm what any provider includes before comparing.

Which framework should our security follow?

The Essential Eight is the Australian baseline. SMB1001 gives you a certificate to show customers and insurers. Both line up with the layers on this page.

Next step