A cyber security audit in plain English
We check the systems attackers go after first, score them against the Essential Eight and tell you what to fix in order of risk. It starts with a scoping call, and you decide what happens next.
Not sure where you stand? Take the five minute scorecard, or check your email security in seconds.
★★★★★ 4.9 on Google from 60+ reviews
- 150+Organisations protected by Austin SecureShield
- ISO27001 and 9001 certified, audited externally
- 300+Client organisations that trust us with their IT
- 98.3%Client satisfaction from 1,800+ ratings
Trusted by 300+ organisations, including
The moments an audit pays for itself
The OAIC received 1,205 data breach notifications in 2025, the most since mandatory reporting began in 2018, and 59% came from malicious or criminal attacks. Most businesses ask for an audit after one of these moments.
Your insurance renewal asks questions you cannot answer
Proposal forms ask about MFA, backups, patching and incident response. A guess on the form is a risk if you ever need to claim.
FixAnswers checked against your real settings, with the evidence to back each one.
A client has sent a security questionnaire
Larger clients now check their suppliers. The questionnaire lands with a deadline and nobody is sure how to answer it.
FixA report you can use to answer it and a short list of what to fix before you reply.
Staff have come and gone
Old accounts, shared passwords and forgotten admin rights build up quietly, especially after a busy year of hiring.
FixA review of every account with access and a list of the ones that should not exist.
Nobody is sure the backups would restore
Backups run every night, but nobody can say when a restore was last tested or whether an attacker could delete them.
FixA check of what is backed up, where it goes, how long it is kept and when it was last restored.
Tell us who is asking about your security. A technical consultant will scope it with you and send a fixed quote. Or take the scorecard to see where you stand first.
Six areas, each scored against the Essential Eight
We look where attacks on small and medium businesses usually start. Scoring against the Essential Eight gives the result a meaning your insurer and clients recognise.
Microsoft 365 and identity
MFA coverage, conditional access, admin roles, mailbox rules and sharing settings, checked against the Microsoft 365 CIS baselines.
Devices and patching
Which laptops, desktops and servers are encrypted, patched, still supported and protected by endpoint detection.
Email
Phishing filtering and SPF, DKIM and DMARC records, plus how easily someone could send mail that looks like yours.
Backups and recovery
What is backed up, how long it is kept, whether an attacker could delete it and when a restore was last tested.
What faces the internet
An external scan with ConnectSecure for open services, old firmware and known vulnerabilities on your public addresses.
Policies and people
Joiner and leaver processes, admin habits, security training and whether an incident response plan exists.
Want to know what each Essential Eight strategy means and how to reach the next level? See Essential Eight.
A report you can act on straight away
No long scan dump. You get three things, written for the person who signs off the budget and the person who does the work.
A score you can share
Your result against each Essential Eight strategy, in a summary a director can read quickly and an insurer or client will recognise.
Executive summary
A risk register
Each finding rated by likelihood and impact, with what it affects and what it would take to fix.
Findings ranked by risk
A plan in order of risk
Quick wins first, then the larger pieces of work, with a fixed quote if you want us to do them.
No obligation to use us
Which review do you need?
Three services that sound alike and answer different questions. If you are not sure, start with the audit.
| Compare | Cyber security auditThis page | IT health checkWhole IT environment | Penetration testSimulated attack |
|---|---|---|---|
| The question it answers | Where are our security risks and what do we fix first? | Is our IT reliable, supported and costing the right amount? | Can a skilled attacker get in and how far could they go? |
| How it works | A review of settings, accounts, devices, backups and policies, plus an external scan | A review of servers, network, devices, licensing and support | A specialist testing partner tries to break in under agreed rules |
| What you get | An Essential Eight score, risk register and plan | A report on your IT with priorities and costs | Technical findings, fixes and a retest |
| Best when | You are unsure where you stand, or an insurer or client is asking | You are reviewing providers, costs or ageing systems | Your controls are in place and someone asks for proof they hold |
Swipe the table sideways to see every column.
Need a broader look at servers, network and support costs as well as security? See IT health checks.
Four steps, very little of your time
Most of the work happens in the background. Your team keeps working and nothing is changed without your approval.
- 01
Scoping call
We agree what is in scope, who we talk to and how access is granted and removed.
- 02
Data collection
We review settings and accounts, run the external scan and talk to whoever looks after your IT today.
- 03
Findings walkthrough
We take you through what we found and answer questions before anything is finalised.
- 04
Report and fixed quote
You get the score, the risk register and the plan. If you want us to do the work, the quote is fixed.
A top 50 MSP in Australia, three years running
Rated by our clients on Cloudtango, and audited every year on security, quality and cyber controls.
Top 50MSPs in Australia
- 2024
- 2025
- 2026
Ranked on client satisfaction and service depth.
Read our 25 client reviews on Cloudtango
ISO 27001
Information securityHow we handle your data, passwords and access, audited every year.
How we protect your data
ISO 9001
Quality managementDocumented processes, so every engineer works to the same standard.
How we work
SMB1001 Gold
Cyber security, Level 3The 27 control cyber standard we take clients through, held ourselves.
Check our certificate- Professional services
Palisades
Intune, conditional access, Defender, BitLocker, Secure Score and governance documents, aligned to Essential Eight ML1. The work met a prospective client's security requirements and won the partnership.
- Energy
InterContinental Energy
Reached Essential Eight ML1, on our assessment, using the Microsoft 365 Business Premium licences they already had.
- Our own standard
Held to the same standard
We are certified to ISO/IEC 27001 and ISO 9001 and audited externally by Compass Assurance Services, so your data is handled under the controls we check you against.
- Client stories
All client stories
Sixteen stories with the numbers.
Cyber security audit questions
What people ask before they start. Anything else, call 1300 787 429.
Related services and reading
How long does an audit take and will it disrupt staff?
Most of the work happens in the background. Staff time is usually one conversation with whoever looks after IT and a short one with a director. We agree the timeline at the scoping call, and nothing in your environment is changed during the audit.
What does a cyber security audit cost?
The first security assessment is free. If you need a deeper audit, for example across several sites or with a formal report for a client, we give you a fixed quote before we start. Ongoing protection is priced on our SecureShield plans page.
What access do you need and who sees our data?
Usually read only access to Microsoft 365 and your device management, plus permission to scan your public addresses. We agree how access is granted and removed before we start. Findings are shared only with the people you nominate.
How is an audit different from a penetration test?
An audit reviews how your systems are set up across the whole business. A penetration test has a specialist try to break in and shows how far they get. Pen testing is a separate engagement, and it is most useful once the audit findings are fixed.
We have an internal IT person. Is this a judgement on them?
No. Security settings drift in every business, whoever runs IT. An audit gives your IT person an independent view and a costed plan they can take to the directors, and we can work alongside them on the fixes.
Do we have to use Austin to fix the findings?
No. The report is yours and is written so your own team or current provider can act on it. If you want us to do the work, we quote it at a fixed price first.
Find out where
you really stand.
Tell us what your insurer, clients or board are asking for. A technical consultant will scope the audit with you and send a fixed quote before any work starts.
- A reply within two business hoursA technical consultant reads every enquiry and comes back to you.
- Proven in 90No onboarding fee, 14 days to fix anything you raise and nothing owing if you leave in the first 90 days. How it works
Or email sales@austintechnology.com.au