Managed IT you don't have to think about. People who do.

When something breaks, your team rings and we fix it. No per-incident fee, no hourly rate, no clock running. Because calling costs nothing, people mention the small things early — which is usually why they never become the big things. Anything stopping work jumps the queue.

Software to install, access to a shared mailbox, a file pulled back from last week, a phone set up for work email. All of it covered, with nothing extra to approve. Your team asks and it gets done — the IT department you'd otherwise be hiring for, without the salaries or the leave roster.

A new starter needs an account, a mailbox, the right groups, a laptop enrolled and Company Portal on their phone — ready for their first morning. Leaving is as much work again: device wiped, mailbox handed on, access gone that day. A fixed $86.50 each, so a business that isn’t hiring isn’t paying for one that is.

The service desk fixes what breaks. Your account manager looks after where things are heading. One named person who knows your business, so when you ring with a half-formed idea you're not explaining your setup from scratch. They bring the scorecard and say what's worth doing next.

Ring us, email us, or start a chat from your desktop. Whichever you pick, it is the same Adelaide team and the same ticket — so you never repeat yourself because you came in the wrong door. No portal to learn, no reference number to quote before anyone will help.

Documenting your environment, taking over licences and vendor relationships, rolling out our tools, and running both providers side by side until cutover. Every one of your people is set up as part of it, with no per-person charge however many there are. Priced on team size — waived entirely on 24 months, half on 12.

A conversation about the business and where technology is taking it, not a report on ticket counts. Held when there is something worth deciding — a lease ending, a site opening, a system reaching its limit — rather than on a fixed calendar. Up to quarterly, by arrangement.

Most faults are fixed remotely in minutes, with nobody waiting on a drive across town. When a job genuinely needs hands on the hardware — a switch to replace, a new site to set up, a server that will not come back — we come out, included, with no call-out fee.

A laptop that won't boot doesn't need you in the car either. We collect it, work on it on our own bench and bring it back — the running around and the labour are on us. A hardware fault goes to warranty where it's covered, or we quote the parts before anything is spent.

6am to 8pm weekdays and 9 to 5 on weekends — 86 hours a week, not 40. When something major takes out multiple people we are there at no extra cost; outside that, extended hours are billable, so you are never paying standby for cover you do not use.

Staff email requests into a shared Autotask service desk. You triage and close them, or escalate them to us for second, third or fourth-line support.

When you're on holiday or off sick, we take over the whole ticket queue and help the staff directly until you're back, so nothing waits.

Server performance, disk space, internet quality, backup status — hundreds of things checked constantly, with the trends tracked rather than just the moment. If a disk will be full in a fortnight it gets dealt with this week, out of hours. Most of what we fix, you never hear about.

Microsoft is blunt about this: your data is your responsibility, not theirs. Deleted mail is gone after 30 days, and ransomware doesn’t wait. Veeam copies your whole Microsoft 365 — mail, OneDrive, SharePoint, Teams — daily, to somewhere outside Microsoft’s systems, so a problem inside your tenant cannot reach the backup.

Your servers in Azure and AWS backed up with the platforms’ own tools, into vaults locked so a recovery point cannot be deleted, shortened or stopped — not by an attacker who takes your cloud account, and not by us. An independent copy outside the platform is available as an add-on.

A backup nobody has restored from is a hope, not a plan. We test restores as part of a disaster-recovery exercise, bringing data, applications and settings back to a single point in time. Staff cannot reach each other’s backups or delete any of them. Maturity Level 1 asks for the test.

An Eaton UPS on the equipment that matters, so a flicker or a short outage does not take the office down or corrupt what was half-written. If the power stays off, servers shut themselves down cleanly rather than simply stopping — the difference between starting up again and calling someone.

Ransomware goes for the backups first. Every administrator account except the dedicated backup administrators is blocked from reaching, changing or deleting anyone else’s backups — so an attacker who takes over an admin account still cannot destroy the copy you would restore from. Maturity Level 2 requires it.

Nobody reaches their own backups, administrators included, and even the backup administrators cannot change or delete a backup while it sits inside its retention period. The copy you restore from is beyond the reach of anyone who could be compromised — which is the entire point of keeping it.

Empower your team to print securely from any device, anywhere, without vulnerable on-site print servers. Includes automated print queue deployment, mobile tap-to-release for strict document security, and comprehensive analytics to track usage and reduce waste. Simple, secure, scalable cloud printing designed for the modern workplace.

The licence sits inside the plan, not on a separate bill to chase, and it is the same Business Premium on every tier we sell. What you get from us is the suite with its security actually switched on and configured — the part most businesses pay for and never use.

Word, Excel, PowerPoint and Outlook installed properly on the machine, not a stripped-back browser substitute. They keep working when the internet doesn't, which matters on a site, in a basement, or anywhere the mobile signal gives up. Five devices each, so the laptop and the home desktop are both covered.

Email at your own domain, with 100GB each — Microsoft doubled it in 2026 and it is included here at no extra cost. Enough that nobody deletes messages to make room, which matters where email is the record of a job: contracts, drawings, advice, the history of a matter. Shared addresses are included.

A terabyte each, backed up and versioned quietly as people work. The file somebody saved over at four o'clock on Friday can be put back to how it was that morning, by them, without a phone call to us or a day lost waiting on a restore.

Chat, calls, meetings and screen sharing in one place, with the conversation and the files sitting together instead of scattered across inboxes. Set up around how your business is organised rather than left to grow wild, so a new starter can find the right channel without asking who owns what.

Shared document libraries where permissions are set once and hold. Who can see what stops depending on who happened to be on the email, and the current version stops being whichever copy sits on somebody's desktop. One place to look, and one answer when you look there.

Appointment booking clients can use themselves, task boards your team can actually see, and forms that collect answers properly instead of by reply-all. Small tools most businesses end up buying separately and paying for twice — they are already in the licence you hold, so we switch them on.

Billions of passwords from breached websites change hands every year, and people reuse passwords between work and everything else. We watch those markets for anything tied to your business, so if a staff password turns up you hear it from us — and change it — before somebody gets around to trying it.

Your Microsoft 365 only opens on computers and phones we know. A laptop nobody has enrolled, or a personal phone outside Company Portal, simply does not get in — even with the right password and the right code. A stolen password is not enough, and neither is a stolen phone number.

Not a code texted to a phone, which can be talked out of somebody or lifted by swapping their SIM. Sign-ins use a method an attacker cannot intercept, even holding your password and a convincing story. The Essential Eight asks for this at Maturity Level 2; it is in every plan here.

Locked out at 7am before a site visit, your team resets their own password from their phone — verified properly, not by ringing somebody who recognises their voice. It is the single most common call any helpdesk takes, and it comes off both our queue and your morning.

Nobody works all day as an administrator — that is what an attacker inherits the moment they land on somebody. The few programs that need elevation are approved to run that way. The admin accounts we keep are separate, with no mailbox or browsing, so the account that can change everything never opens an attachment.

This watches the deeper layer — your directory and sign-in systems — where somebody already inside tries to climb. It learns what normal looks like for each person, so when an accountant starts poking at admin tools at midnight the behaviour gives them away, whoever's password they're using.

Administrator accounts are the ones attackers want most, and the ones that quietly pile up: the contractor from two years ago, the account nobody switched off. Every privileged account gets revalidated each year, anything idle for 45 days is disabled, and admin activity is logged. A schedule we run, not a policy in a folder.

Administrative work is done down a controlled path rather than from whichever laptop is handy, and privileged environments are kept off unprivileged ones. Break-glass, local administrator and service account passwords are long, unique, unguessable and held somewhere managed — not reused, and not in somebody’s notes.

We configure Windows so passwords cannot be scraped out of memory — memory integrity and Local Security Authority protection both on, closing the technique almost every hands-on intruder reaches for. Full Credential Guard needs Windows 11 Enterprise rather than the edition in Business Premium, so we license it where you are certifying to Level 3.

Administrator rights are handed out for a task and taken back afterwards rather than held permanently, and admin work happens on a dedicated hardened workstation kept for nothing else. Each account carries only what the job needs — the difference between an attacker landing on an administrator and one who is mid-task.

Multi-factor authentication stops being a door policy and becomes a data policy: the repositories themselves — file shares, databases, document stores — require it, phishing-resistant, and so does any customer-facing service you run. Getting past the front door stops being the same as reaching what is inside.

Most security tools block what's known to be bad. This works the other way round: nothing runs unless it's on the approved list. Ransomware doesn't run. A dodgy download doesn't run. Approved programs are fenced in too, so your PDF reader opens documents and nothing else.

A USB stick somebody found in a car park, or a personal drive somebody plugs in to take work home — neither one gets to read your files. We allow storage by individual device rather than by type, limit network shares to the applications that should touch them, and log every file copy.

A vulnerability the vendor rates critical, or one with an exploit already circulating, gets patched within 48 hours — not at next month’s maintenance window. That short window is where most break-ins happen, because the patch itself tells an attacker exactly what to go after. The Essential Eight asks this at every level.

You cannot patch what nobody went looking for. We inventory every machine automatically, then scan on a schedule for anything missing — weekly across browsers, Office, email clients, PDF software and security tools, fortnightly across operating systems. Maturity Level 1 asks for the scanning, not only the patching.

Macros are small programs that travel inside Word and Excel files, and they remain one of the most dependable ways to get malware onto a computer. We switch them off for anyone without a real business reason, block them outright in anything from the internet, and lock the setting so nobody turns it back on.

The browser is where most of the risk actually arrives, so we give it less to work with: Internet Explorer gone, Java from the web refused, and web advertising — a long-running delivery route for malware — not rendered at all. Then we lock the settings so nobody can loosen them later.

Every company computer and phone enrolled, encrypted and following the same rules, with updates landing out of hours so nobody is interrupted mid-job. A new starter’s laptop turns up ready to use. We wipe a lost one remotely, and on somebody’s own phone only the business data goes.

A new starter’s laptop is shipped straight to them and sets itself up: they sign in once and the machine builds to your standard, with your apps, your policies and your security already on it. Nobody images a laptop on a bench, and nobody waits a week for one.

When people need a tool you haven't given them they find their own — a free file converter, a personal cloud drive. Well meant, and invisible until data walks out. We find every cloud service in use, rate the risk, and show you what to approve, replace or block.

Level 1 covers the software attackers aim at most — browsers, Office, PDF readers, security tools. Level 2 widens it to everything else you run: the line-of-business application, the accounting package, the design tool nobody remembers installing. That is usually where the oldest software turns up.

Allowlisting moves off the computers and onto the servers facing the internet, covering everywhere a program can launch from rather than only the obvious folders. We apply Microsoft’s own list of blocked applications, and review the rules at least yearly instead of setting them once and forgetting.

Even a permitted macro stays away from Windows itself: macros cannot call the operating system directly, which is the step that turns a spreadsheet into a foothold. Maturity Level 2 adds this on top of the macro rules already in place, so a trusted file still cannot reach the machine.

Word, Excel and your PDF reader cannot do what a document should never need to do: launch other programs, write executable files, inject code into other processes, or activate an embedded package. We configure each to ASD and vendor hardening guidance, the stricter winning, and nobody can change it afterwards.

Lower levels patch software. Level 3 goes underneath it — drivers and firmware, the printer driver and the laptop’s BIOS and the switch in the comms cupboard — scanned fortnightly and fixed within 48 hours when the vendor calls it critical. It closes the layer attackers turn to once the obvious way in is shut.

At Level 3 application control is on everything — workstations, the servers facing the internet, and the servers that never do. Nothing runs anywhere unless it is on the list, checked against Microsoft’s recommended block rules. There is no quiet corner of the network where the rule does not apply.

We remove the legacy pieces attackers lean on — .NET Framework 3.5 and Windows PowerShell 2.0 — and what remains runs in Constrained Language Mode, where the commands used to pull a payload down and run it from memory simply do not work. It takes the living-off-the-land toolkit away.

At Level 2 browsers, Office, PDF readers, email clients and security tools are patched within two weeks. At Level 3 anything the vendor rates critical is done inside 48 hours and the rest inside two weeks — the same clock your internet-facing systems already run on, applied to the software your people use all day.

We remove software the vendor has stopped fixing rather than tolerate it, and keep operating systems on the current release or the one before. It is the least glamorous control in the framework and the one that quietly undoes the others, because nobody can patch an unsupported system at any speed.

Allowlisting extends to drivers, which run deeper than any application: only an approved set loads, and we apply Microsoft’s vulnerable driver blocklist so the signed-but-exploitable drivers attackers bring with them are refused. A driver is the quietest way onto a machine that is otherwise locked down.

A macro runs only if it is sandboxed, sitting in a Trusted Location, or signed by a publisher you trust — and before any of that, someone allowed to do it has read it for malicious code. We review the trusted publisher list yearly, and nobody can wave a macro through from the warning bar.

Antivirus catches what the world already knows about. This is for what nobody has seen yet — software watching for the behaviour of an intruder, with real analysts reviewing what it finds around the clock. When something is genuinely wrong at 3am, somebody is awake and acting on it.

Microsoft’s enterprise endpoint protection on every machine — the same engine large organisations run, included in what you already pay rather than sold to you later. Alerts from your computers, your mail and your sign-ins arrive in one queue instead of three consoles, and the routine ones get investigated and cleaned up automatically.

We filter mail before it reaches anyone: junk, malware, and the links that look entirely legitimate until somebody clicks one. The measure of it is what never arrives — an inbox is still the easiest way into a business, and most of that traffic stops here.

The worst emails show their hand late — a link that turns malicious hours after it landed in forty inboxes. We pull every copy back out, wherever it has been filed. Attachments open somewhere safe before delivery, and links get re-checked the moment somebody clicks rather than only on arrival.

Anyone can put your business name in the From line of an email, and the invoice scam that costs Australian business most depends on it. SPF, DKIM and DMARC are the records that stop it — taken all the way to enforcement rather than left on monitoring, so the forgeries are refused at the door.

Security events from across your systems — sign-ins, PowerShell, command-line activity — collected into one place and protected from tampering, so nobody can quietly delete the record of what they did. Anything facing the internet has its logs read for trouble rather than simply kept. Maturity Level 2 asks for all of it.

When an event turns out to be a real incident it is reported — to you, and to the Australian Signals Directorate. That is an obligation at this level rather than a courtesy, and it is the part most businesses discover they have missed only afterwards. We make the call and keep the record.

A written plan for what happens when something goes wrong: who decides, who calls whom, and in what order. At this level it is enacted rather than filed. Maturity Level 2 asks for it against every one of the eight strategies — the framework’s way of saying the plan matters more than any single control.

At Level 2 the logs that actually get read are the ones from systems facing the internet. Level 3 extends that to every workstation and every internal server — so somebody already inside, moving quietly between machines that never touch the internet, is still walking through something a person is reading.

Good security can still come undone with one click. Short training on phishing, fake sites and password habits, then realistic test emails sent safely. Anyone who clicks gets quiet, no-blame feedback on the spot — because the goal is a team that spots the next one, not a list of who failed.

All eight of the Australian Government’s strategies, implemented, managed and documented. It is the baseline insurers, large clients and tenders increasingly ask about — and when they do, you have an answer with evidence behind it rather than a scramble through screenshots the night before a deadline.

We build your Microsoft 365 security settings — Conditional Access, Defender, Intune, Purview — against one written baseline aligned to the Essential Eight, then compare them against it continuously. When something drifts, because an exception was made one afternoon and never put back, we know. Your Secure Score gets tracked the same way.

Level 1 stops opportunists. Level 2 is for people who choose their target — because of what you do, what you hold, or who your clients are. Controls tighten, patching windows shrink, admin access narrows. For defence and government work it is often the entry ticket.

If you work with Defence, directly or somewhere in the supply chain, these standards aren't optional — without them you can't hold the contracts. We put the controls in, keep the paperwork current and walk you through assessment. Already in the sector, you simply stay eligible.

Most leaks aren't hacks. They're a tired person emailing the wrong attachment to the wrong Dave. Sensitive data — tax file numbers, card numbers, Medicare details — is found wherever it lives, labelled, and stopped from going where it shouldn't. The label travels with the document.

Level 2 documents the controls as well as implementing them. You get the evidence pack assessors, auditors, insurers and large clients ask for: what's in place, how it's set up, and proof it's maintained. When someone asks you to demonstrate your security, you hand over a document.

The top of the framework, written with determined and well-resourced attackers in mind. All eight controls at full strength, maintained and checked continuously, so you meet the standard every day rather than on audit day. Usually held where there is classified information or critical infrastructure.