What are the 7 types of cyber security, translated for business owners?

The seven types usually listed are network, endpoint, cloud, application, data, identity and operational security. Lists vary, and for a business owner the labels matter less than the question each one answers: where can an attacker get in, and what are they after? Here is each type in plain English, sized for an Australian small business.

First, an honest note about the number. Some vendors count five types, some seven, some more; the taxonomy exists to organise textbooks and product catalogues, and your risk does not care how it is filed. What the list is good for is completeness: walking it once tells you whether any door in your business has no lock and no owner, which is the only reason to walk it at all.

Network security is the oldest type: the router, the firewall, the Wi-Fi. For a small business the practical content is a business-grade firewall instead of the internet company's default box, Wi-Fi that separates guests from business systems, and remote access that goes through proper authentication rather than a port someone opened in 2019 and forgot. Unglamorous, checkable, and still where auditors find the strangest things. It also includes the boring register: knowing what is actually connected to your network, because nobody can defend equipment nobody remembers installing.

Endpoint security is every laptop, desktop and phone. This is where several Essential Eight controls physically live: endpoint protection such as Microsoft Defender, application control such as ThreatLocker deciding what may run, operating system patching, and device management through Intune so a lost laptop is an inconvenience rather than a breach. If a device can open your files, it belongs under management; the unmanaged home PC with company email is the classic hole. Printers and scanners count too: anything with a network cable and a password is an endpoint, whether or not it looks like one.

Identity security is the modern centre of gravity, because most attacks are logins rather than break-ins. One phished Microsoft 365 password opens email, invoices and files from anywhere on earth, no malware required. The counters are multi-factor authentication on everything, access that matches each person's role, and leavers removed the day they leave. In Entra ID terms: if the identity layer is weak, every other type is decoration. It is also the cheapest type to fix, which is why it comes first in almost every uplift we run.

Cloud security is mostly configuration discipline. Microsoft and AWS secure their platforms; securing your use of them, who can share what externally, which apps have been granted access, whether admin accounts have multi-factor authentication, remains your job, and that split surprises many owners. Application and data security round out the core: keeping software patched, Office macros restrained and browsers hardened on one side, and on the other knowing where your important data lives, encrypting it, and backing it up with restores that have actually been tested, using tools such as Veeam. The test for the data type is one question: if this laptop or this account vanished right now, what exactly would be lost, and how quickly could you prove otherwise?

Operational technology security is the seventh type, and the only one many small businesses can skip. It covers the machines: factory equipment, warehouse scanners, point-of-sale systems, building controls. If you manufacture, move freight or run venues, the devices on the floor are computers with long lives and rare updates, and they need their own network segment and their own plan. If your business is entirely desks and laptops, note it and move on.

Now the translation to action, which is the point of the tour: you do not buy seven products. The Australian Government's Essential Eight already cuts across every type above with eight concrete controls, measured at maturity levels a provider can be held to. Our managed plans implement it by tier, from foundations at $79 per user per month to Maturity Level 3 at $199. Walk the seven doors once, then fund the one framework that locks them. This is also why comparing providers by type coverage misleads: every brochure covers all seven; compare named controls instead.

If you want the walk done for you, our Essential Eight Cyber Security Scorecard is free and reports in writing, or call 1800 456 567.