For accounting, financial advice, architecture and engineering practices that hold client data worth stealing. Essential Eight ML1 as the delivered baseline, ML2+ where regulators require it, the full Microsoft Security stack deployed properly, Australian-hosted, and all of it visible in Evisent Live. Normally part of Managed IT, and available standalone if you want to keep your current IT provider.
Start with the free domain security check: can someone send email pretending to be you? Answered in seconds, no email required.
Breached right now? Incident response, for clients and non-clients →
We do not run a grab-bag security toolkit. We run a Microsoft-aligned security stack with nine years of operating depth, inside your own Microsoft 365 tenant. The same controls are what you show a licensee, insurer or auditor when they ask how client data is protected.
Endpoint detection & response, M365 phishing & malware protection, attack surface reduction across all client environments.
Cloud-native SIEM correlating signals across identity, endpoint, M365 and Azure. Available where the use case justifies it, typically regulated clients with material supervisory exposure. We run it for ourselves and for selected clients; not included in the standard $185/user/month bundle.
Sensitivity labels and DLP rules that catch TFNs, ID documents and bank details before they leave, plus controls on staff pasting client data into consumer AI tools, backed by our free AI usage policy template.
Conditional access, device compliance, endpoint hardening, mobile device management. Windows and macOS endpoints both fully supported.
The Australian Cyber Security Centre's Essential Eight is the de facto baseline for any regulated or regulated-adjacent Australian business. Maturity Level 1 is our delivered baseline across the client base; clients with APRA, ASIC, or government-tender obligations sit at ML2+ on a defensible, evidenced roadmap.
Approved-application whitelisting via Defender + Intune.
Critical patches within 48h; rest within 2 weeks.
Macros blocked from the internet; signed-only where needed.
Browser, M365, PDF reader hardened to ASD baselines.
Just-in-time admin via Entra PIM; privileged access workstations.
Critical patches within 48h; all systems within 2 weeks.
MFA mandatory for all users; phishing-resistant where licence permits.
Immutable backups; tested recovery quarterly; 30-day retention minimum.
ESSENTIAL EIGHT MATURITY LEVEL 3 ATTESTATION IS PART OF THE 2026 CERTIFICATIONS ROADMAP · SEE OUR ROADMAP DOCUMENT FOR DETAIL
The list below is the standard managed-security envelope we run for every client, all visible in Evisent Live. It's inclusive, not a "starter tier" with optional add-ons. Some clients add specialist services (penetration testing, third-party SOC integration, advanced threat hunting) but the base envelope is fixed.
Microsoft Defender XDR running continuously, with same-day triage for high-severity alerts and same-business-hour response for critical events. Sentinel SIEM available as an add-on for clients with deeper monitoring needs.
Microsoft Defender for Endpoint deployed and tuned. EDR signals correlated with M365 + identity data for higher-fidelity detection.
Entra ID Conditional Access policies, MFA enforcement, risky sign-in detection, privileged access management via PIM.
Continuous vulnerability scanning of endpoints and cloud assets; patch deployment within Essential Eight tolerances; quarterly executive report.
Phishing simulations and education modules, reported per user and per department. Builds the "human firewall" most security platforms can't.
Microsoft Defender for Office 365 with advanced threat protection. Phishing, BEC, malware filtering; safe links and safe attachments.
Four snapshots a day with unlimited retention, for Microsoft 365, endpoints and Azure workloads. Tested recovery quarterly. RPO and RTO documented per workload.
Documented IR plan, runbooks per scenario, executive briefings during incidents, post-incident review and learning capture. Not a client and breached now? We clean up breaches too.
Practices deal with overlapping obligations from more than one regulator. We publish what each one means in practice, because we operate against them in delivery. Pick your profession to read the detail.
ACSC baseline, every client
OAIC + ADM rules, 10 Dec 2026
Tranche 2, live 1 Jul 2026
Tax practitioner duties
Cyber resilience for licensees
Architects and engineers
Legal professional duties
Operational risk
The baseline stops most attacks. A few are aimed squarely at practices: fake bank-change requests, client instructions from compromised mailboxes, TFNs sitting in old email, project files walking out the door. Each has a fixed-price Practice Automation product that installs in your own tenant.
Stop payment-redirection fraud.
Emails asking to change bank or refund details are flagged, with a call-back to a number already on file assigned and logged, so your team verifies before paying.
Every withdrawal request flagged for a call-back.
Requests to withdraw, roll over or redirect funds are flagged, and a call-back to a number already on file is assigned and logged.
Find the TFNs you didn’t know you had.
We scan email and OneDrive for tax file numbers and ID documents, report exposure by mailbox, and warn staff before the next one is sent.
Verified evidence, not self-attestation.
We complete your cyber insurance renewal questionnaire or licensee attestation from your Evisent Live evidence and attach the pack. How it works
Know when project files walk out the door.
Alerts on mass downloads and external sharing in Microsoft 365, a departing-staff checklist and a monthly sharing report per project.
Five per profession, plus a bundle.
Published prices, a fixed quote in writing before any work, and 10% off setup for Evisent managed clients.
At 4:20 AM a compromised Microsoft 365 account sent 607 phishing emails to 560 recipients in 48 minutes. We contained it the same morning, before the office opened. Here is the full timeline.
Read the incident write-up →Most clients take cyber security as part of our Managed IT service: the same team running both, one contract, one monthly fee. For clients who want to keep their existing IT provider but upgrade their security, we run a standalone managed-security engagement with the same operating standard.
We don't claim certifications we don't hold. "Aligned to" means we map our delivery against the framework. "Certified to" only appears when an external audit has confirmed it.
We look at how client data moves through your practice, where the gaps are, and what it would take to close them. Prefer to see your own score first? A Live Audit is 30 days of Evisent Live on your tenant, then a findings meeting: $990 ex GST, no cost if it finds nothing significant, and credited if you move to Managed IT.
No pitch and no slide deck. Tell him what you are trying to work out and he will tell you whether we are the right fit for it, or who is.
Business hours, Melbourne. If it goes to voicemail, leave a number and he will call back.