Website and hosting review
CMS, plugins, TLS, admin exposure, and common misconfigurations that turn a brochure site into an entry point.
Cyber security audit
Cyber security audits Melbourne businesses can act on
A plain-English security audit of your websites, email, cloud accounts, and devices. Ranked findings, fixed quotes for remediation, and citations to ASD guidance. Built for Australian SMBs, not enterprise theatre.
Audit scope
What we actually inspect
We look at the surfaces attackers hit first on small Australian businesses. Every finding is ranked by likelihood and impact, with a clear fix and a price before remediation starts.
Email and identity
Mailbox MFA, forwarding rules, password hygiene signals, and SPF, DKIM, and DMARC alignment for domains attackers spoof.
Cloud accounts and SaaS
Microsoft 365 or Google Workspace permissions, shared drives, and dormant admin accounts that still hold the keys.
Devices and access
Endpoints, remote access, and privilege patterns that decide whether one phished laptop becomes a business-wide incident.
Backup and recovery reality check
Whether backups exist, whether they are tested, and whether ransomware would leave you negotiating instead of restoring.
Remediation path
Fixed-price hardening items from the report, Essential Eight uplift when maturity is the goal, and optional monitoring after the cleanup.
Fit
Who this is for
SMBs without a security owner
You run on email, cloud apps, and a website, but nobody owns security day to day. You need an honest baseline and a ranked fix list, not a 200-page binder.
Teams asked for evidence by insurers or clients
Renewals and supplier questionnaires ask what you have reviewed. An audit report with dated findings is evidence you can hand over.
Not a fit for penetration-test theatre alone
If you only want a red-team logo for the board and no remediation budget, we are the wrong partner. Our audits exist to drive fixes.
Industries
Where we show up most
Professional services
Law, accounting, consulting, and agencies holding client files in email and cloud drives that attackers assume are soft targets.
Trades and field services
Job apps, invoicing, and customer records on phones and laptops. MFA, backups, and device hygiene without slowing crews.
Retail and ecommerce
Stores, payment flows, and customer databases where a breach costs trust as well as money. Website and DNS/email hardening included.
Outcomes
What you walk away with
Plain-English ranked findings
Every issue explained without jargon walls, ordered by real business risk, with a recommended fix you can approve item by item.
ASD-aware, SMB-scaled
Findings map to practical Essential Eight themes (MFA, patching, backups, admin hygiene) without pretending you have an enterprise SOC.
Anonymised outcomes we see repeatedly
Typical SMB audits surface missing MFA on admin mailboxes, untested backups, open WordPress plugins, and SPF/DKIM/DMARC gaps. We fix what we find when you ask us to.
How it works
A process without black boxes
Discovery
A free Discovery Session to map systems, owners, and what “done” looks like for insurers or clients.
Audit
Structured review of sites, email, cloud, and devices with evidence captured as we go.
Report
Plain-English findings ranked by risk, with recommended fixes and fixed quotes for remediation.
Harden
Optional follow-on work: MFA, patching, backups, website hardening, and staff awareness.
Know what is exposed before the next scare
Book a free Discovery Session. We will scope your environment and send a fixed quote before any work starts.
Book a free Discovery SessionTransparent pricing
We don’t hide our pricing
No gated brochures, no “request a quote” games. These are the real starting prices.
Most popular
SMB Security Audit
From $1,500 + GST
One-off assessment
- Websites, email, cloud, and device review
- Ranked plain-English findings report
- Remediation quotes itemised from the report
- Essential Eight theme mapping where relevant
Audit + priority hardening
From $3,500 + GST
Audit plus top fixes
- Full SMB Security Audit
- Priority MFA, backup, and email DNS fixes
- Website hardening for one primary site
- 30-day follow-up check-in
Ongoing monitoring
Scoped monthly
After the cleanup
- Malware scanning and backup verification
- Patch and account hygiene tracking
- Quarterly review calls
- Incident triage guidance
Questions
Straight answers
How much does a cyber security audit cost in Melbourne?
A one-off small-business security audit typically starts from $1,500 + GST. Hardening work is quoted as fixed items from the report. Ongoing monitoring is scoped monthly to your systems.
What is included in a cyber security audit?
A structured review of websites, email, cloud accounts, and devices: what an attacker would try first, ranked by real risk, reported in plain English with remediation options.
Is this a penetration test?
It is a practical SMB security audit focused on exposure and controls you can fix. Full red-team penetration testing is a different engagement and only useful once basics are in place.
How does this relate to Essential Eight?
Audit findings often map to Essential Eight themes such as MFA, patching, backups, and admin privileges. For a full maturity assessment and adoption roadmap, see our Essential Eight Adoption Melbourne service.
Do you cite official Australian guidance?
Yes. We align recommendations with ACSC / ASD published guidance, including the Essential Eight, and we link official sources on this page so you can verify the baseline yourself.
Will the report name our clients or staff publicly?
No. Reports are confidential to your organisation. Public case studies on this site use anonymised industry outcomes only where NDAs apply.
Can you fix what you find?
Yes. Most clients ask us to implement the priority items as fixed-price follow-on work. You approve each item before we start.
How long does an audit take?
Most SMB audits complete within one to two weeks after Discovery, depending on access to systems and stakeholders.
Official guidance
Authoritative sources
Essential Eight (ASD / ACSC)Official baseline of eight mitigation strategies that prevent most commodity cyber attacks.Essential Eight Maturity ModelML0 through ML3 requirements used when audits feed into maturity adoption programmes.ACSC small business cyber securityPractical guidance for Australian SMBs on reducing cyber risk.
Next step
Get a ranked list of what to fix first.
Book a free Discovery Session. We will scope your environment and send a fixed quote before any work starts.