WHY NOW

Attacks are faster, smarter and aimed at small businesses

This year has seen a sharp rise in attacks and breaches, both among Australian businesses and around the world. Criminals now use AI to write convincing scam emails, break into accounts and move fast once they’re in. Small businesses use the same tools as large ones, including Microsoft 365, cloud storage, laptops and phones, so they face the same risks with far fewer people watching.

Insurers have noticed too. They increasingly favour 24/7 security monitoring, and some now require it. One study found insurance claims from businesses with 24/7 security monitoring were typically 97.5% lower than from those relying on antivirus alone.*

That’s why we’ve moved every client to one security platform with a 24/7 security operations team, priced per person, with no lock-in contract.

WHAT’S WATCHED 24/7

Everything below is watched around the clock, with a security operations team ready to step in

Your devices

Computers and laptops protected by managed antivirus (SentinelOne), with ransomware rollback to undo the damage if the worst happens.

Your email

Advanced email security (Check Point) stops phishing, fake invoices and harmful links before anyone can click.

Your Microsoft 365 logins

A hacked account, such as a sign-in from overseas, is spotted and rapidly locked before damage is done.

Your shared files

OneDrive and SharePoint files shared outside your business are flagged, so sensitive information doesn’t leak.

On top of that, every client also gets

  • Stolen password alerts if a staff password turns up on the dark web after a data breach
  • Security awareness training and practice phishing emails that adapt to each person’s risk
  • Website and domain checks for weak spots visible from the internet
  • Automatic fixes for common security gaps
  • Security business reviews: a plain-English report on your security score, threats stopped and staff training results, on demand or every month or quarter
  • Microsoft 365 backup of email, OneDrive, SharePoint and Teams
  • Device management: updates, patching, health checks and remote support

B-Secure Plus adds active threat hunting, forensic investigation after an incident (which helps with a Privacy Act breach assessment or an insurance claim), email encryption and data-loss protection. We recommend it for financial, medical, legal and real estate businesses.

One system instead of many

Attacks rarely stay in one place. A scam email leads to a stolen login, which leads to a hacked laptop. When email security, device protection and training run on separate systems, each sees only part of the picture. Ours all sit on one screen, so we can follow an attack from start to finish and act faster.

Microsoft 365 security settings, managed

Microsoft 365 holds your email, files and logins, and it’s where most attacks start. Microsoft changes its security settings regularly, so an account set up once and left quickly falls behind. For $50 a month per business, we manage yours continuously with a dedicated tool, keeping it locked down, switching on new protections as Microsoft releases them, and lifting your Microsoft Secure Score.

B-Secure from $81.45 per user per month with up to 2 computers each, or B-Secure Plus from $91.45 with up to 3. Email-only users from $36.45. Backup included, no lock-in contract, all prices ex GST.

* Sophos-commissioned survey by Vanson Bourne (2024) of 282 cyber insurance claims; median claim values for businesses using managed detection and response compared with endpoint protection only.

CYBERSECURITY PRINCIPLES

Protect your critical systems and sensitive information from digital attacks.

The cyber security principles provide an approach to building and managing an effective cybersecurity program. It’s a set of five functions that, when implemented together, provide strategic guidance to improve information security and manage risk. These five functions are: Identify, Protect, Detect, Respond and Recover.

Identify

The identify function is about identifying your assets (physical & software), the value to the business, the resources that support critical function, their level of risk, what criminals might want to steal and how they might do it.

It’s also about identifying legal & regulatory requirements & where gaps in your security could be exploited. Our website and domain checks and security business reviews make these gaps visible.

Protect

Once you know what needs protecting and what the threats are, you need to put security controls in place to protect those assets.

The protect function is about creating the right security controls to protect your data, systems and networks: managed antivirus, email security, Microsoft 365 security settings, IT maintenance, staff training, identity management & access control.

Detect

The detect function is about monitoring what’s going on across your devices, email and accounts at all times, so threats are detected as soon as possible.

Our 24/7 security operations team watches your devices, email and Microsoft 365 logins around the clock, with stolen login protection and dark web alerts for leaked passwords.

Respond

The respond function is about reacting quickly to a security incident or breach, to contain the impact. That means isolating an infected device, locking a hacked account and resetting its access, and communicating clearly with your customers, staff and other stakeholders.

On B-Secure Plus, forensic investigation shows exactly what was accessed, which helps with a Privacy Act breach assessment or an insurance claim.

Recover

The recover function is about restoring your business data and operations to a secure state after an incident. That may involve ransomware rollback on affected devices, restoring email and files from Microsoft 365 backup, changing passwords and patching any vulnerabilities that were exploited.

Recovery is about getting back up and running as soon as possible. It also includes reviews & implementing improvements.

5 key points on cyber threats & cyber attacks for small businesses

  • Plan & Checklist. Have a checklist and plan in place, so everyone knows what to do.

  • Expect an attack. Plan as if it will happen. Most attacks start with a scam email or a stolen login, and attackers move fast once they’re in.

  • Watch around the clock. Attacks don’t keep business hours. A 24/7 security operations team means someone is ready to step in at 2am on a Sunday.

  • Education. Security awareness training and practice phishing emails teach your staff what to look for and what to do in the event of an attack.

  • The Cost. Most cyber events mean days or weeks of disruption. The financial losses for a small business can be far greater than you think.

Cyber Security & Business Continuity Checklists

The goal here is to identify potential risks and common threats so you’re not an easy target of a cyber attack. We need to secure your important files, business information, intellectual property, financial information and customer information from the latest threats.

Apart from financial losses to criminals & reputational damage, privacy penalties for serious breaches can be significant. Let’s keep your business secure and running with these simple steps.

Hardware & computer systems security

  • Warranty & Support All devices (phones, printers, computers) are currently in warranty and under support by manufacturers.
  • Legacy Hardware – There is no legacy hardware in use.
  • Hardware drivers & bios checked quarterly, if they aren’t already done in auto updates
  • Bitlocker Drive Encryption – On – If your computer is lost or stolen, your hard drive data can’t be viewed/extracted without the security key. It can also be remotely wiped. Bitlocker keys securely stored.
  • Trusted Platform Module – TPM Security Chip is used with Windows 11.
  • All devices with company/client data should be secured & backed up daily
  • External hard drive & USB devices locked out
Hardware And Computer System Security
hardware and computer system security

Software Security

  • Updates – Operating systems, software and apps are automatically updated twice per week.
  • Managed antivirus – Cloud managed, business grade protection with ransomware rollback, watched 24/7 by a security operations team
  • Legacy Software – There is no legacy software in use.
  • Internet Banking monitored
  • Advise Clients, Suppliers & Partners that you will contact them and verbally confirm any change in bank details or requests for money.
  • Microsoft 365 Multi Factor Authentication is switched on for all users
  • Microsoft 365 security settings – managed continuously, with new protections switched on as Microsoft releases them.
  • Microsoft Access Security Check – Quarterly review of staff access and permissions.
  • Microsoft 365 Backup – Email, Teams, SharePoint and OneDrive backed up several times a day.
  • Email Security – Anti-phishing, malware & ransomware protection, account takeover protection, and (on B-Secure Plus) email encryption and data-loss protection.

Onsite & Office Security

  • Security Cameras
  • Keycard door access
  • Server/Network cabinet – Locked
  • Firewall – Software or hardware-based firewall in the modem. This should be updated to a monitored hardware firewall.
  • Data Access Control – Staff limited to only the areas, files and folders they need.
  • Computer Security – Lock computer when not in use (Windows Key + L Key)
Onsite And Office Security

Offsite – Work From Home, Mobile Devices

  • Work Phones, Mobile Devices, Portable Devices & Home Computers – Should have monitoring, management & security software installed if they are connected to any Microsoft Service or remotely accessing the office network.
  • Network Security Don’t use public Wi fi without a VPN
  • Computer Security Lock computer when not in use (Windows Key + L Key)
  • Don’t let your children use your work devices
  • Don’t download illegally

Staff Training & Education

Security awareness training and simulated phishing – ongoing short training and practice phishing emails that adapt to each person’s risk.

This training raises awareness about the importance of cybersecurity among your team and helps everyone protect your business from ransomware, phishing scams, business email compromise and other attacks, including new scams as they appear.

Cyber Attack & Data Breach Response Plan

A Cyber Attack & Data Breach Response Plan is a document outlining how you will respond in the event of a data breach. It outlines what constitutes a cybersecurity and information security incident, who is involved in the plan and their contact information, and steps to take in a breach and follow-up actions.

General Cybersecurity Advice & Checks

  • If your device is lost or stolen, contact IT support immediately
  • Lock computer when not in use (Windows Key + L Key)
  • If you are unsure about an email, phone call, text message or social media message, forward/contact IT support.
  • Don’t use public Wi fi without a VPN
  • Use 2FA/MFA wherever it’s available.
  • Don’t use default passwords
  • Use a password manager whenever available & don’t re-use the same password. Use strong passwords. Change the default password of your printers and modems.
  • Keep personal and business passwords completely separate
  • Passwords are not shared and are changed if inadvertently shared
  • Cyber Insurance – If any of your systems are able to have 2FA set up, you have a breach and you weren’t using 2FA, your insurance may not pay out. ALL 2FA able systems MUST be used.
  • Password protect any document sent with personally identifiable information
  • Personally identifiable information is not contained in the body of an email
  • Client emails requesting changes to nominated bank accounts, withdrawals, contributions and transfer are verbally verified with the client
  • All clients are informed that they will never receive an unsolicited email requesting a money transfer or personal information without a previous and relatable communication. This can be done through the email disclosure wording
  • Emails that contain client data are not forwarded from your business email account to your personal email account
  • Suspicious emails are deleted without being opened or forwarded to your IT Team
  • Wipe, format or destroy hard drives of leased or old equipment when being returned/disposed of
  • All devices are secured when not in use (eg screensavers, lock away) and report any loss or suspicion of loss immediately to your manager
  • Threatened, suspected or actual cyber incidents and/or data breaches are reported to the IT Team
  • An IT asset register is maintained for all devices issued by the company
  • Include cyber security and data privacy modules in your new staff inductions

For more information on Cyber Security, read more on the Layered Approach to Cybersecurity in our blog, see our security pricing, and please feel free to book an appointment for a discussion or discovery session.

Your Cyber Security journey starts here!

Book A Cyber Security Appointment