Home
Cyber Security Assessment

Free Cyber Security Assessment

Know where your business stands today.

18 quick questions based on the Australian Government's Essential Eight. Get an instant score, the areas that need attention and a report you can download.

18questions4minutesPDFreport

Private. Your answers never leave your browser.

Essential Eight · Patch applications
Are your applications updated quickly when security fixes come out?
Browsers, Microsoft Office, PDF readers, email clients and security software. ASD Maturity Level One expects updates within two weeks, or within 48 hours for internet-facing services when an exploit exists.
Essential Eight · Patch operating systems
Are Windows, macOS and server operating systems kept up to date and still vendor-supported?
Includes servers, workstations and network devices. Unsupported versions (for example Windows 10 after end of support) should be replaced.
Essential Eight · Multi-factor authentication
Is multi-factor authentication (MFA) required for email, Microsoft 365, remote access and other online services?
MFA means a code, app prompt or security key on top of a password.
Essential Eight · Restrict administrative privileges
Do staff use standard accounts day to day, with admin rights kept to a few separate admin accounts?
Admin accounts should not be used for email or web browsing.
Essential Eight · Application control
Is only approved software allowed to run on your computers?
Application control (allowlisting) stops unknown programs and ransomware from running.
Essential Eight · Configure Microsoft Office macros
Are Microsoft Office macros blocked for staff who don't need them, and blocked from internet files?
Macros in Word and Excel files are a common way attackers get in.
Essential Eight · User application hardening
Are web browsers and Office hardened, for example blocking ads, Java and untrusted extensions?
Browsers should not process web ads or Java from the internet, and Internet Explorer 11 should be disabled.
Essential Eight · Regular backups
Are important data and systems backed up regularly, kept separate from your network, and test-restored?
Staff accounts should not be able to change or delete backups.
Protection
Do all computers and servers run managed antivirus or EDR that someone actually monitors?
Endpoint detection and response (EDR) spots suspicious behaviour, not just known viruses.
Protection
Is your email filtered for phishing, spoofing and impersonation (with SPF, DKIM and DMARC set up)?
Email is the most common way attacks start.
Protection
Is your network protected by a business-grade firewall, with guest Wi-Fi kept separate?
Customers and visitors should never share a network with your business computers.
Protection
Are laptops and portable devices encrypted (for example BitLocker or FileVault)?
Encryption protects data if a device is lost or stolen.
People
Do staff complete cyber security awareness or phishing training at least once a year?
People are often the first and last line of defence.
People
Do staff use a password manager and unique passphrases, rather than shared or written-down passwords?
ACSC recommends long, unique passphrases for every account.
People
Are a staff member's accounts and access removed on the day they leave?
Old accounts are an easy way in for attackers.
Response
Do you have a written plan for a cyber incident, including who to call and how to report it?
Incidents can be reported to ASD through ReportCyber at cyber.gov.au.
Response
Do you know your obligations under the Notifiable Data Breaches scheme and how to respond to a data breach?
Many businesses covered by the Privacy Act must notify the OAIC and affected people about eligible breaches.
Response
Do you know where sensitive customer or patient data is stored, and who can access it?
You can't protect data you don't know you have.

After your assessment

What happens next.

Your result is the starting point. Here's how we help you go from score to secure.

Step 01 of 06

Your results

See your score and the areas to discuss straight away, and download your report.

Step 02 of 06

Book a free review

Book online or give us a call. There's no cost and no obligation.

Step 03 of 06

We assess properly

Our team checks your systems against the Essential Eight, remotely or on-site.

Step 04 of 06

Your plan

You get a plain-English report and a prioritised plan that suits your budget.

Step 05 of 06

We close the gaps

We put the right protections in place with minimal disruption to your business.

Step 06 of 06

Stay protected

Ongoing monitoring and regular reviews keep you on track as threats change.

01
Your results
See your score and the areas to discuss straight away, and download your report.
02
Book a free review
Book online or give us a call. There's no cost and no obligation.
03
We assess properly
Our team checks your systems against the Essential Eight, remotely or on-site.
04
Your plan
You get a plain-English report and a prioritised plan that suits your budget.
05
We close the gaps
We put the right protections in place with minimal disruption to your business.
06
Stay protected
Ongoing monitoring and regular reviews keep you on track as threats change.

Prefer to talk?Call our team

Essential Eight explained

An Essential Eight assessment for Australian businesses.

The Essential Eight is the Australian Signals Directorate's baseline for protecting organisations against the most common cyber attacks, including ransomware, phishing and business email compromise. Our free cyber security assessment checks your business against all eight strategies, plus the protection, people and incident response basics recommended by the Australian Cyber Security Centre.

Prevent: stop attacks getting inLimit: reduce the damageRecover: get back up quickly

01
Patch applications
Keep browsers, Office, PDF readers and other software up to date so known weaknesses are closed quickly.
Prevent
02
Patch operating systems
Keep Windows, macOS and servers current, and replace systems that are no longer supported.
Limit
03
Multi-factor authentication
Add a second check at sign-in for email, Microsoft 365, remote access and online services.
Limit
04
Restrict admin privileges
Limit administrator access to the few people and tasks that genuinely need it.
Limit
05
Application control
Allow only approved software to run, stopping unknown programs and ransomware.
Prevent
06
Office macro settings
Block risky Microsoft Office macros, a common way attackers get in.
Prevent
07
User application hardening
Turn off browser and app features that attackers commonly abuse.
Prevent
08
Regular backups
Back up important data and systems, keep copies safe and test that they restore.
Recover

Who it's for

Built for pharmacies, medical centres, allied health clinics, professional offices, retailers and growing businesses. Whether you're a single site in Melbourne or a group across Victoria and Australia, you'll get a clear picture of your cyber security in minutes.

PharmaciesMedical centresAllied healthOfficesRetail

Why it matters

Most successful attacks on small and medium businesses use basic gaps such as missing updates, weak sign-in security or untested backups. Knowing your Essential Eight position helps with cyber insurance, compliance, client requirements and peace of mind.

RansomwarePhishingCyber insuranceCompliance

FAQ

About the assessment.

Questions about the Essential Eight or your result? Our Australian team is happy to help.

Talk to a Security Specialist →

What is the Essential Eight?

The Essential Eight are eight mitigation strategies published by the Australian Signals Directorate (ASD) to help organisations protect against cyber threats: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, Microsoft Office macro settings, user application hardening and regular backups.

Who should take this cyber security assessment?

Any Australian business that wants a quick view of its cyber security. It's designed for pharmacies, medical centres, allied health clinics, professional offices, retailers and growing businesses, with no technical knowledge needed.

How long does the assessment take?

About four minutes. There are 18 plain-English questions, and you get your score, the areas to discuss and a downloadable PDF report straight away.

Is the Essential Eight mandatory for my business?

It is required for many Australian Government entities and is recommended by ASD for all Australian organisations. Many cyber insurers, industry bodies and larger clients also ask about it, so it's a practical baseline for any business.

What are the Essential Eight maturity levels?

ASD defines Maturity Levels Zero to Three. Level One is a strong starting point for most small businesses, Level Two suits organisations more likely to be targeted, and Level Three is for those facing highly capable attackers.

Is this a formal Essential Eight assessment?

No. It's a quick, indicative self-assessment to show where you stand. For a formal assessment against the Essential Eight maturity levels, our team can review your systems for free.

Are my answers stored?

No. The assessment runs entirely in your browser. Nothing is sent to us unless you choose to contact us.

Do you offer Essential Eight assessments in Melbourne and Victoria?

Yes. Our Australian based team provides Essential Eight assessments and cyber security support on-site across Victoria, including Melbourne and Geelong, and remotely Australia-wide.

What should I do with a low score?

Book a free review with our team. We'll explain the results in plain English and help you prioritise the changes that make the biggest difference for your budget.

Know where your business stands today.

Preparing your report

Essential Eight snapshot

By area

Your security heatmap

Let's close the gap together

Are your applications updated quickly when security fixes come out?

Are Windows, macOS and server operating systems kept up to date and still vendor-supported?

Is multi-factor authentication (MFA) required for email, Microsoft 365, remote access and other online services?

Do staff use standard accounts day to day, with admin rights kept to a few separate admin accounts?

Is only approved software allowed to run on your computers?

Are Microsoft Office macros blocked for staff who don't need them, and blocked from internet files?

Are web browsers and Office hardened, for example blocking ads, Java and untrusted extensions?

Are important data and systems backed up regularly, kept separate from your network, and test-restored?

Do all computers and servers run managed antivirus or EDR that someone actually monitors?

Is your email filtered for phishing, spoofing and impersonation (with SPF, DKIM and DMARC set up)?

Is your network protected by a business-grade firewall, with guest Wi-Fi kept separate?

Are laptops and portable devices encrypted (for example BitLocker or FileVault)?

Do staff complete cyber security awareness or phishing training at least once a year?

Do staff use a password manager and unique passphrases, rather than shared or written-down passwords?

Are a staff member's accounts and access removed on the day they leave?

Do you have a written plan for a cyber incident, including who to call and how to report it?

Do you know your obligations under the Notifiable Data Breaches scheme and how to respond to a data breach?

Do you know where sensitive customer or patient data is stored, and who can access it?

What happens next.

Your results

Book a free review

We assess properly

Your plan

We close the gaps

Stay protected

An Essential Eight assessment for Australian businesses.

Patch applications

Patch operating systems

Multi-factor authentication

Restrict admin privileges

Application control

Office macro settings

User application hardening

Regular backups

Who it's for

Why it matters

About the assessment.