Small business cybersecurity for teams in the US and Australia: single sign-on with MFA, a shared password vault, alerts when something looks wrong, and the evidence an auditor or insurer will ask for — set up calmly and kept current.
“Our passwords are in a shared sheet.”
One leaked file and every account is open. Staff who left still know half of them.
“An audit is coming and we have nothing written down.”
Essential Eight, HIPAA, SOC 2 — they all ask for evidence, not intentions.
“Would we even know if we'd been hacked?”
Without logs and alerts, the first sign is usually a customer or a ransom note.
We build the controls, train the team in minutes not days, and keep the evidence for you.
A short review of accounts, devices, backups and who can access what — the honest baseline.
We map your gaps to the framework you care about — Essential Eight, HIPAA or SOC 2 — and fix the riskiest first.
SSO and MFA, a password vault, patching, threat detection and logging — rolled out with a two-minute staff video.
Quarterly reviews, offboarding checks and an evidence folder that stays current, so audits are a formality.
Small business cybersecurity in practical pieces — start with one, add the rest as you grow.
Project 01
A self-hosted password manager for the team, single sign-on and MFA on every app — with a staff video and an offboarding checklist.
Project 02
Reach Essential Eight Maturity Level One with the controls in place and an evidence dashboard that collects proof automatically.
Project 03
HIPAA security safeguards for clinics: risk checklist, access controls, logging and tested backups. We build controls; we don't give legal advice.
Project 04
SOC 2 readiness for small SaaS teams: policies, controls and automated evidence, so the audit is about checking, not scrambling.
Project 05
API keys and passwords removed from code and documents, moved into a secrets manager and rotated.
Project 06
Threat detection tuned for a small office: logins, malware and odd traffic flagged, with a monthly plain-English report.
Project 07
AI-assisted scanning plus human verification of every finding, inside a written scope you approve — with a clear fix list.
Good evidence comes from good controls. We set up the controls so the evidence collects itself.
People get the access they need and lose it when they leave — automatically, through single sign-on.
Logs, configs and test results land in one folder, dated, ready for an auditor or insurer.
We build and document controls. Certification is your auditor's job, and legal advice is your lawyer's.
Our insurer sent a security questionnaire and I can't answer half of it.
Send it over. We'll mark what you already do, what's missing, and the order to fix it — most of it in a couple of weeks.
My staff will hate MFA.
They'll log in once a day with single sign-on and a phone tap. We'll send them a two-minute video so nobody gets stuck.
An example of a typical first call.
About 1 week
Baseline review mapped to your framework, with a prioritised fix list.
Best before an audit or insurance renewal.
2–8 weeks
Controls rolled out, staff trained, evidence folder set up.
Best when you need to reach a standard.
Quarterly
Access review, patch check, evidence refresh, short report.
Best for staying compliant year-round.
We'll reply within one business day with what you already have and what's missing.