All guides
Managed cybersecurity pricing for Australian SMBs: per user, per endpoint and log-volume models, MDR, SOC, vCISO, pen tests, IR retainers, Essential Eight and 2026 rules.
Prices, cost drivers and 2026 rules
- Cyber Security Act 2024: ransomware payment reporting, the $3m threshold and SOCI Act duties
Who must report a ransomware or cyber extortion payment within 72 hours, how the $3m turnover test works, what the report contains, enforcement in 2026 and SOCI Act incident reporting.
- Essential Eight uplift cost: assessing maturity and budgeting the move to Maturity Level Two
What the ASD Essential Eight strategies and maturity levels are, how assessments and uplift projects are priced, an illustrative 40-person budget and the upkeep costs.
- Managed cybersecurity service pricing in Australia: models, cost drivers and 2026 rules
How Australian MSSP, MDR, SOC, vCISO, pen-test and Essential Eight services are priced, what drives the cost, illustrative ranges and the 2026 rules to check.
- Managed endpoint, email security and firewall pricing for small businesses
What managed EDR and patching, email security and managed firewall services include, how per-device and per-mailbox pricing works, and an 18-person example.
- MDR and SOC-as-a-service pricing: per endpoint, per user and per GB of logs
How managed detection and response and SOC-as-a-service are priced in Australia, what log-volume tiers mean, and an illustrative costing for a 60-endpoint business.
- Penetration testing cost in Australia: how scope, tester days and retests set the price
How pen-test quotes are built from tester days, what external, internal, web app and cloud tests cover, an illustrative scoping example and how to compare quotes fairly.
- Privacy Act APP 11 and the Notifiable Data Breaches scheme: what they mean for your security spend
When the Privacy Act applies to an Australian small business, what APP 11 requires, the 30-day breach assessment, who to notify, penalties and what to ask your provider.
- vCISO pricing in Australia: retainers, day rates and what a virtual CISO delivers
How virtual CISO services are priced (monthly retainers, day rates, fixed programs), typical deliverables, an illustrative 12-month budget and how to avoid paying for reports.
Worked costings and choosing a provider
- How to choose a managed security provider: a best-fit method for Australian SMBs
A step-by-step method to scope, shortlist, question, normalise and score managed security providers so you find the best fit rather than the loudest marketing.
- In-house versus managed security: an honest cost comparison for Australian SMBs
Compare the cost of running security in-house with a managed service, including 24/7 roster arithmetic, tooling and on-costs, an illustrative payback calculation and hybrid options.
- Incident-response retainer pricing: prepaid hours, response times and unused hours
How cyber incident-response retainers are priced in Australia, zero-fee versus prepaid models, an illustrative incident costing, insurer panel issues and contract points.
- Managed security cost worked example: a 25-person office over three years
A line-by-line illustrative costing of MDR, firewall, pen testing and an IR retainer for a 25-person Australian office, with renewal uplift, growth, GST and a cheaper alternative.
- Managed security provider due diligence: assurance, data location, staff and exit
How to check a managed security provider before you sign: reading ISO 27001, SOC 2 and IRAP claims, data location, privileged access, subcontractors, insurance, references and exit.
- Managed security renewal increases: uplifts, expiring discounts and log-volume steps
Worked examples of how renewal uplifts, added users, expiring first-year discounts and log tiers raise a managed security bill, and how to negotiate caps and notice periods.
- Managed security SLAs and contracts: response times, service credits and unfair terms
The SLA definitions, contract clauses and questions that decide what a managed security provider must actually do, plus service credits and Australian unfair contract terms rules.
- USD-priced security services: exchange-rate buffers, card fees and GST for Australian buyers
How to budget a security platform or MDR service billed in US dollars, how GST works on imported digital services and local resellers, and how to set an FX buffer.
Failures, incidents and official sources
- \"24/7\" security monitoring: overnight gaps, holiday shutdowns and alert fatigue
How to test whether a managed security service really watches and acts around the clock, why alert fatigue causes missed attacks, and the questions and drills that expose gaps.
- Cyber insurance and managed security: what policies cover, proposal forms and panel rules
A plain guide to cyber insurance for Australian SMBs: typical covers and exclusions, how managed security answers proposal-form questions, panel firms, excesses and disputes.
- Official cyber security sources and free help for Australian businesses
Where Australian businesses find official cyber guidance, report incidents and get free help: ASD's ACSC, OAIC, Home Affairs, IDCARE, business.gov.au, Scamwatch and dispute bodies.
- Penetration test authorisation: Criminal Code Part 10.7 and the letter you need before testing
Why pen testing needs written authorisation under Australia's computer offence laws, who can authorise it, third-party and cloud systems, and what the authorisation letter should contain.
- Ransomware incident: the first 72 hours, who to call and which clocks start
A practical timeline for an Australian business hit by ransomware: containment, the ACSC hotline, insurer notice, the Privacy Act 30-day assessment and 72-hour ransomware payment reporting.
- Why managed security arrangements fail: ten patterns and the clause or test that prevents each
The common ways managed cyber security disappoints Australian businesses, from scope gaps and unmonitored weekends to untested backups and retainers that are only discounts.