CYBER SECURITY RESOURCES
Free guides and articles to help your business stay one step ahead.
Tools
Hands-on checks to see where your cyber security stands today.
Guides & References
Practical reading to help you understand the cyber security landscape. No email required.
Essential Eight Explained
A 5-minute plain-English overview of the ACSC framework — what it is, why it matters, and what each maturity level involves.
What is the Essential Eight?
The Essential Eight is a set of cyber security strategies developed by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre (ACSC). It identifies eight specific things an organisation can do to make a cyber attack significantly harder to pull off — and significantly easier to detect and recover from when one happens.
It's not a comprehensive cyber security program on its own. Think of it more like a set of foundations. If you have all eight in place at a reasonable level, you've addressed the controls that prevent or limit the most common attacks Australian organisations face today. If you don't, you're vulnerable to attack patterns that have been well understood for years.
Why does it matter?
The ACSC's Annual Cyber Threat Report 2024–25 recorded over 1,200 cyber security incidents responded to by ASD — an 11% increase on the previous year. Cybercrime reports came in at one every six minutes, and the average self-reported cost of cybercrime to a small business rose 14% to $56,600. Twenty-two per cent of SME owners said their business was impacted by cybercrime in 2024.
The Essential Eight wasn't designed in a vacuum. It targets the techniques attackers actually use against Australian businesses — credential theft, phishing, ransomware, exploitation of unpatched software, and so on. The controls aren't theoretical; they're what defenders have learned works.
The framework is also increasingly visible outside of government. Cyber insurers reference it in underwriting questionnaires. Enterprise customers ask about it in supplier security reviews. Government tenders sometimes require it. For an SMB, being able to point to Essential Eight implementation is becoming part of how you prove you take cyber security seriously.
What are the eight strategies?
The eight strategies fall into three broad categories — preventing attacks reaching you, limiting the damage if they do, and being able to recover. They are:
- Application control — only allowing approved software to run on your computers
- Patch applications — keeping your business software updated to fix known security flaws
- Configure Microsoft Office macro settings — restricting the way Office documents can run code
- User application hardening — locking down web browsers, email clients, and similar to remove risky features
- Restrict administrative privileges — making sure most staff can't make system-level changes
- Patch operating systems — keeping Windows, macOS, and other OS software updated
- Multi-factor authentication — requiring more than just a password to log in
- Regular backups — keeping protected, tested copies of your important data
What are maturity levels?
The Essential Eight Maturity Model defines three levels of implementation maturity, plus a baseline of Maturity Level Zero (which means significant weaknesses exist).
- Maturity Level One (ML1) — addresses opportunistic attackers using widely available techniques. Suitable for most small and medium-sized businesses as a baseline.
- Maturity Level Two (ML2) — addresses more capable attackers willing to invest more time and effort. Appropriate for organisations holding sensitive data or with higher-value targets.
- Maturity Level Three (ML3) — addresses sophisticated, well-resourced adversaries (including state-sponsored actors). Typically only required for critical infrastructure or organisations with very high-value information.
For most Australian small and medium businesses, ML1 is the right starting point. It's a meaningful level of protection against the threats most likely to affect you, and it's an achievable goal even with limited internal IT resources.
What does implementing it actually involve?
The honest answer: it depends on where you're starting from. An organisation already using Microsoft 365 with default security settings has some of the controls partially in place. An organisation running an ageing on-premise server with shared admin accounts has further to go.
For most SMBs implementing ML1, the work falls into three buckets: changes to settings and policies in tools you already use, some new tooling (typically MFA across the board, possibly endpoint protection, possibly backup solutions), and ongoing operational practices like applying updates within set timeframes and reviewing user access regularly.
It's not a one-off project. Cyber security maturity is something you achieve and then maintain. The Essential Eight framework gives you the structure to do that.
Cyber Insurance Readiness
The focus areas Australian cyber insurers care about today — so you can anticipate what they'll want to see before the renewal lands.
Why your application has gotten harder
Cyber insurance is one of the fastest-growing lines of business insurance in Australia — the local market reached AUD 467 million in premiums in 2025 and is projected to grow several times over by 2034. But while demand has risen, so has insurer rigour. The days when you could tick a few boxes and be issued a policy are well and truly over.
Between 2020 and 2023, ransomware claims hit insurers hard. Many lost money on cyber lines for the first time. The response has been a tightening of underwriting standards across the entire market. Insurers now verify claimed controls — through external scans, evidence requests, and post-claim audits. Missing or misrepresented controls can mean denied applications, denied claims, premium increases, or non-renewal.
Coalition's industry data shows 94% of organisations hit by ransomware had attackers target their backups specifically. Verizon's 2025 Data Breach Investigations Report found 75% of system-intrusion breaches involved ransomware. These realities directly shape what insurers now want to see from applicants.
The focus areas insurers care about
Every insurer's questionnaire is slightly different, but underwriting conversations today consistently return to a small number of focus areas. Understanding these areas helps you anticipate the conversation, organise your evidence, and avoid surprises at renewal time.
Identity and access
Who can access what, and how is that access protected? This is consistently the first area insurers probe — because the majority of cyber incidents begin with a stolen or compromised credential. Expect questions about login controls, how accounts are protected, how access is granted and removed, and how privileged accounts differ from regular ones.
Endpoint and network protection
What's installed on the devices in your business, and what's watching network traffic? Insurers want to see protection that goes beyond traditional antivirus — specifically, something that can detect and respond to suspicious behaviour rather than just block known bad files. They'll also ask about remote access: how staff connect when working away from the office.
Data resilience and recovery
If your systems were encrypted tomorrow morning, what would it take to get back up and running? This area covers backup practices, how backups are protected from attackers, whether restoring from backup has been tested, and how long a full recovery would take.
Vulnerability management
Software vendors release security patches when flaws are discovered. Attackers reverse-engineer those patches to find and exploit unpatched systems. Insurers want to know how your business keeps up — what gets patched, how quickly, and whether anyone is checking for known vulnerabilities.
People and process
Staff are both the first line of defence and the most frequent vector for attacks. Insurers look at awareness training (how often, covering what), documented policies, and whether there's a written plan for what to do when something goes wrong.
Data handling and privacy
What personal information do you hold, and how is it protected? This area overlaps with Australian privacy obligations — the Notifiable Data Breaches scheme and the Privacy Act more broadly. Insurers assess both the technical protection of sensitive data and the legal framework around it.
Honesty matters more than ever
One important principle runs through the entire application process: any control you claim to have, you must actually have. Insurers now verify claims, and a discrepancy between what you said on the application and what the post-incident audit finds can void your coverage entirely. If you don't have something, say so. The application form becomes a declaration, and a misrepresented declaration can mean a denied claim at the worst possible moment.
What to do before applying or renewing
Don't wait for the broker's email. Map your current state against the focus areas above and identify where you have strong evidence versus where you'd struggle to answer confidently. Most SMBs find they have at least two or three blind spots. Addressing those before submission usually leads to better terms, lower premiums, and far fewer awkward conversations with the underwriter.
Cyber Security Topics to Discuss With Your IT Provider
The areas worth raising with your IT provider or MSP — to help you understand whether cyber security is genuinely being managed in your business.
Why this matters
Most Australian small and medium businesses outsource IT to an external provider — sometimes a managed service provider (MSP), sometimes a one-person consultant, sometimes a friend who's good with computers. That arrangement works well for everyday IT — keeping computers running, fixing printer problems, setting up email accounts.
But cyber security is a different discipline from general IT support. A provider can be excellent at helping with a slow laptop and entirely silent on whether your business has the right protections in place. The two skill sets overlap, but they're not the same thing — and assuming "my IT person handles security" can leave significant gaps.
The areas below aren't about catching your provider out. They're topics worth raising in a structured conversation, so both of you have a clear picture of where cyber security sits in your arrangement — what's covered, what isn't, and what might need to change.
Areas worth discussing
How user accounts are protected
Most cyber incidents start with a compromised user account. Ask how accounts in your business are protected against unauthorised access, what happens when someone tries to log in from an unexpected place, and whether all staff accounts are protected the same way or whether exceptions exist. It's worth understanding whether the protections in place today would actually stop a credential theft attack.
How your backups work
Backups are the safety net for ransomware, accidental deletion, hardware failure, and a range of other scenarios. Discuss where backups are stored, how they're protected from being encrypted alongside your live data, how often they're tested, and how long it would take to restore from them. The details matter — a backup that hasn't been tested is a hope, not a plan.
How updates and patches are managed
The gap between a security patch being released and attackers exploiting unpatched systems has shrunk to days in some cases. Ask how updates get applied in your business — what the defined approach is, which systems are prioritised, how quickly critical security patches get deployed, and how exceptions or delays are handled.
What monitoring is in place
If something suspicious was happening on your network at 11pm on a Saturday — an unusual login from overseas, a process encrypting files, an outbound connection to a known malicious server — would anyone notice? Discuss what kind of monitoring exists, what alerts get raised, who responds to them, and what the response time looks like outside business hours.
Who has administrator access
Administrator accounts can install software, change settings, and access other people's data. Compromising one is much more damaging than compromising a regular account. It's worth reviewing who currently has elevated access in your systems, whether that access is still needed, and how admin accounts are kept separate from day-to-day user accounts.
What happens if something goes wrong
When ransomware hits, or a staff member gets phished, or a data breach is suspected, the first few hours matter. Ask what the plan is for those moments — who gets called, in what order, who makes which decisions, and what role your provider plays versus what falls to you. If the answer is some version of "we'll figure it out if it happens," that's a conversation to keep having.
How staff are equipped to recognise threats
Phishing, social engineering, and similar attacks target people, not systems. Staff who can recognise a suspicious email are a meaningful line of defence. Discuss what awareness training exists in your business, how often staff encounter it, and whether the topics stay current with the techniques attackers are actually using.
What records and logs exist
If a breach is suspected, the first thing investigators ask for is logs — who logged in, from where, when, and what they did. Without logs, an investigation can't determine what happened. Worth understanding what's being captured in your environment, how long it's retained, and whether it would support an investigation if one were needed.
How your provider's own security affects you
Your IT provider has administrative access to your systems by design. That's how remote support works. It also means the provider's own security posture matters to you. It's fair to ask how the provider protects the tools and credentials used to manage your environment, and what happens if the provider itself experiences an incident.
Using the answers
Don't expect every answer to be perfect. Few arrangements have all of these locked down. The point of the conversation is not to catch your provider out — it's to surface where the gaps are so they can be addressed. A good provider will welcome the discussion and use it as a basis for talking through what's possible. A defensive or evasive response to these topics is itself useful information.
The deeper question underneath all of this: is cyber security being actively managed in your business, or is it being quietly assumed by everyone but not actually owned by anyone? The conversation helps you find out.
Cyber Security Glossary for Business Owners
Plain-English definitions of the terms business owners encounter — without the technical jargon.
Cyber security is filled with acronyms and technical language. Most of it is shorthand for ideas that aren't actually complicated, but the language can make conversations with IT providers, insurers, and consultants feel impenetrable. This glossary covers the terms that come up most often in business discussions.
- ACSC
- The Australian Cyber Security Centre, part of the Australian Signals Directorate (ASD). The Australian Government's lead agency for cyber security advice. Publishes the Essential Eight framework and the Annual Cyber Threat Report. Operates the 1300 CYBER1 hotline for reporting incidents.
- BEC (Business Email Compromise)
- An attack where someone takes over a staff member's email account — usually through stolen credentials or a phishing attack — then uses it to send fraudulent invoices, redirect payments, or trick colleagues into transferring money. One of the most common and costly attacks against Australian SMBs.
- Brute force attack
- An attack that tries large numbers of passwords against an account, hoping to find the right one. Modern brute-force attacks are automated and can try millions of combinations per minute. Strong passwords and account lockout policies are the standard defences.
- Cloud
- Software and storage that runs on someone else's servers, accessed over the internet. Microsoft 365, Google Workspace, Dropbox, and Xero are all cloud services. The cloud isn't inherently more or less secure than running things yourself — it depends on configuration.
- Credential theft
- The theft of usernames and passwords. Credentials are typically stolen via phishing, malware that captures keystrokes, or by buying them from criminal marketplaces (where credentials from past breaches are sold). The single most common starting point for cyber attacks against businesses.
- Data breach
- An incident where information is accessed, taken, or disclosed without authorisation. In Australia, certain types of data breaches must be notified to the Office of the Australian Information Commissioner (OAIC) and to affected individuals under the Notifiable Data Breaches scheme.
- EDR (Endpoint Detection and Response)
- A modern replacement for traditional antivirus. Where antivirus checks files against a list of known threats, EDR watches for suspicious behaviour — like a process trying to encrypt large numbers of files, or an unusual outbound network connection — and can automatically isolate a device when something looks wrong.
- Endpoint
- Any device that connects to your network — laptops, desktops, servers, phones, tablets. "Endpoint security" means protecting these devices, since each one is a potential entry point for an attacker.
- Essential Eight
- A set of eight cyber security strategies published by the ACSC, designed to make cyber attacks significantly harder against Australian organisations. Has three maturity levels (ML1, ML2, ML3) representing increasing levels of sophistication. ML1 is the typical baseline for SMBs.
- Firewall
- A system that controls what network traffic is allowed in and out of your business. Modern firewalls include capabilities far beyond simple traffic filtering — application awareness, intrusion prevention, and deep packet inspection. Most SMBs have a firewall built into their internet router; larger SMBs deploy dedicated firewalls.
- IAM (Identity and Access Management)
- The systems and processes for managing who can access what in your business. Includes account creation, password rules, MFA enforcement, role-based access, and account deactivation when staff leave. Microsoft Entra ID and Google Workspace are common SMB IAM platforms.
- IR (Incident Response)
- The process of dealing with a cyber security incident — detecting it, containing it, removing the cause, recovering systems, and learning from what happened. A documented incident response plan describes who does what, in what order, when something goes wrong.
- Maturity level
- A rating that reflects how robustly a control is implemented. The Essential Eight Maturity Model uses Levels Zero through Three, where Zero indicates significant weakness and Three indicates protection against sophisticated, well-resourced attackers.
- MDR (Managed Detection and Response)
- A service where an external provider monitors your systems for threats around the clock. Combines technology (similar to EDR) with human analysts who investigate and respond to alerts. A common option for SMBs that don't have the staff to do this internally.
- MFA (Multi-Factor Authentication)
- Logging in with more than one piece of evidence — usually a password (something you know) plus a code from your phone (something you have). Sometimes called two-factor authentication or 2FA. The single most effective control against credential theft, which is why insurers, government, and security frameworks all require it.
- MSP (Managed Service Provider)
- An external IT company that manages your IT systems on an ongoing basis — fixing problems, applying updates, helping with new equipment, etc. An MSSP (Managed Security Service Provider) is similar but focused specifically on cyber security. Many SMBs use an MSP for general IT and either expect them to also handle security or engage an MSSP separately.
- NDB (Notifiable Data Breaches scheme)
- The Australian legal requirement to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. Applies to most organisations covered by the Privacy Act, including any business with annual turnover above $3 million and certain smaller organisations (e.g., health service providers).
- OAIC
- The Office of the Australian Information Commissioner. The regulator responsible for the Privacy Act and the Notifiable Data Breaches scheme. Where Australian data breaches are reported.
- Patch / patching
- An update released by a software vendor to fix a security vulnerability or bug. "Patching" is the process of applying these updates. Unpatched software is one of the most common ways attackers gain entry — vendors fix vulnerabilities, attackers reverse-engineer the fixes, then attack systems that haven't been updated yet.
- Phishing
- An email, text message, or other communication designed to trick the recipient into clicking a malicious link, opening a malicious attachment, or handing over credentials. "Spear phishing" targets specific individuals; "whaling" targets executives. The starting point for most attacks against businesses.
- Privileged account
- An account with elevated permissions — typically administrator or system-level access. Compromising a privileged account is much more damaging than compromising a regular user account, because the attacker can change settings, install software, and access other people's data. Should be limited, separated from regular accounts, and protected with stronger controls.
- Ransomware
- Malicious software that encrypts your files and demands payment to decrypt them. Modern ransomware also typically copies data before encrypting it, so attackers can threaten to publish stolen data if you don't pay (called "double extortion"). Verizon's 2025 DBIR found 75% of system-intrusion breaches involve ransomware.
- SaaS (Software as a Service)
- Software delivered over the internet rather than installed on your own computers. Microsoft 365, Xero, Salesforce, and Slack are all SaaS. Convenient, but means your data lives in someone else's system — which has implications for backup, access management, and incident response.
- SIEM (Security Information and Event Management)
- A system that collects logs from across your IT environment, looks for suspicious patterns, and generates alerts. Typically deployed by larger organisations or via a managed service for SMBs. The "central nervous system" for security monitoring.
- Social engineering
- The non-technical part of attacks — tricking people rather than computers. Phishing is one form; others include pretexting (calling and pretending to be someone trusted), baiting (leaving infected USB sticks where someone will pick them up), and tailgating (following someone into a secured area). Reminds us that the human element matters as much as the technical.
- SSO (Single Sign-On)
- A system where one set of credentials lets a user access multiple applications, instead of having a different login for each. Improves security (one strong password and MFA, rather than many weak ones) and improves user experience. Microsoft Entra ID and Google Workspace both provide SSO capabilities.
- VPN (Virtual Private Network)
- A way to extend your business network securely over the internet, so a remote staff member can access internal systems as if they were in the office. Commonly used for remote work. VPNs are themselves a target for attackers — VPN credentials should always be protected with MFA.
- Vulnerability
- A flaw in software or a system that can be exploited. Vulnerabilities are usually disclosed publicly when a patch is released, which is why prompt patching matters — attackers are watching the same disclosure feeds you are.
- Zero day
- A vulnerability that's actively being exploited before the vendor has released a patch. Called "zero day" because there have been zero days for the vendor to fix it. Less common than mainstream vulnerabilities but harder to defend against.
From the Blog
What is the Essential 8 and Why Does It Matter for Your Business?
The Australian Signals Directorate's Essential 8 framework is the gold standard for SMB cyber protection. Here's what it means for you.
5 Signs an Email Is a Phishing Scam (And What to Do About It)
Phishing remains the #1 way attackers get into small business systems. Learn the red flags your team needs to know.
Why Multi-Factor Authentication Is the Single Best Thing You Can Do Today
If you only implement one security control this year, make it MFA. Here's exactly how to roll it out across your business.
WANT A PERSONALISED ASSESSMENT?
A free consult gives you tailored advice specific to your business.