Security · Security assessment
Find out where you really stand on cyber security
An independent review of your identities, devices, email, data and backups — with a plain-English report and a prioritised plan.
Sound familiar?
What we hear from customers
What we do
A practical, framework-based review
Identity
MFA coverage, admin accounts, sign-in policies and risky access.
Devices
Patching, device management, endpoint protection and local admin rights.
Phishing protection and email authentication (SPF, DKIM, DMARC).
Data
File sharing, sensitivity labels and data loss prevention.
Backup & recovery
Whether backups are protected, separate and tested.
AI readiness
Oversharing and use of unapproved AI tools before Copilot is rolled out.
Architecture
What we review, layer by layer
Most small and mid-sized businesses run on Microsoft 365, so we assess the controls that matter most there — mapped to the Essential Eight.
Where AI helps
Practical AI, switched on with care
AI changes both the risks and the defences. Our assessment covers both.
Risk
Copilot oversharing
Copilot can surface any file a user already has access to. We check SharePoint and Teams permissions before you roll it out.
Risk
Shadow AI
We identify staff using unapproved AI tools with company data, and recommend a policy and controls.
Defence
AI-powered protection
We check whether Microsoft’s AI-driven protections, such as automatic attack disruption, are licensed and switched on.
How it works
A clear path from start to finish
- Week 1ScopeAgree systems, sites and framework. Read-only access set up.
- Week 1–2ReviewConfiguration reviews and scripted checks; short interviews with key staff.
- Week 2–3AnalyseFindings rated by risk and mapped to the Essential Eight.
- ReadoutReportExecutive briefing and a prioritised, costed roadmap.
What you get
- Executive summary for owners or the board
- Essential Eight maturity baseline
- Risk register
- Prioritised, costed roadmap
- Quick wins you can action immediately
- AI and Copilot readiness findings
FAQ
Common questions
How long does an assessment take?
Typically two to four weeks depending on scope, number of systems and access to key staff.
Will it disrupt our staff?
No. It is mostly read-only configuration review and scripted checks, plus a few short conversations.
What if we have a breach?
Businesses covered by the Privacy Act must assess suspected data breaches and notify the OAIC and affected people when serious harm is likely. Businesses with turnover over $3 million must also report ransomware payments to the Australian Signals Directorate within 72 hours.
Related services
Want an honest answer to “are we secure?”
Book a free consultation and we will scope an assessment.