Confident business leader at her desk with her team collaborating in the background

Cyber security, managed end to end

A cybercrime is reported in Australia every six minutes. You shouldn't have to lose sleep worrying about whether your data, your clients, and your reputation are safe. We handle your cyber security end-to-end — so you can focus on running your business.

Book a free security review

30 minutes, no obligation — and you will get a straight answer about where you stand whether you use us or not. Or see how we protect you first.

In short

What is managed cyber security?

Managed cyber security is the ongoing protection of a business's systems, data and people from cyber threats by a dedicated provider, rather than relying on in-house staff or antivirus alone. Otaris provides managed cyber security for Adelaide businesses and organisations across Australia — aligned to the Australian Government's Essential Eight framework, with application allowlisting, zero trust access, 24/7 monitoring, and threat detection and response.

Most owners aren't sure whether they're covered

Most business owners we talk to share the same feeling: they know cyber threats are real, but they don't know if they're properly protected — and they don't have time to figure it out. You're not an IT expert. You shouldn't have to be.

  • The threats are real

    The Australian Signals Directorate received over 84,700 cybercrime reports last year — one every six minutes. The average cost of a cyber incident for small businesses rose 14% to $56,600. Ransomware, phishing, and data breaches are targeting businesses like yours every day.

  • You're not sure if you're covered

    If your cyber security strategy is antivirus software and a firewall, you're not protected to the standard the Australian Government sets, and that is the standard an insurer or a tender will ask you about. Antivirus works on definitions — it tries to guess what threats look like based on known patterns. New threats are created faster than definitions can keep up. Yet we still find businesses relying on antivirus as their primary defence, with no application control, no zero trust policies, and no way to know if their accounts have already been compromised.

  • You shouldn't have to be a cyber expert

    Running a business is hard enough. You shouldn't need a degree in cyber security just to keep your data safe.

Book a free consultation

We've been doing this since 2006

At Otaris, cyber security isn't a product we bolt on — it's built into everything we do. We're an Adelaide-based IT team that manages and monitors your entire digital environment, 24 hours a day, 7 days a week. We use the same tools and frameworks trusted by government and defence organisations, and we make them work for everyday Australian businesses.

Our approach is built on zero trust— the principle that no device, no user, and no application is trusted by default. Every access point is verified, every device is enrolled, and every application is approved before it can run. It's the same architecture used to protect government systems, and we've made it practical for businesses of every size.

We've helped businesses from trades and professional services to defence contractors and healthcare providers get properly protected without the jargon, the complexity, or the fear.

  • 24/7 Monitoring

    Our Security Operations Centre watches your systems around the clock, including nights and weekends.

  • Government-Grade Standards

    We implement the Australian Signals Directorate's Essential Eight framework across every plan.

  • Adelaide-Based Team

    When you call, you speak to a real person who already knows your business.

  • Essential Eight Cyber Security Scorecard

    The Essential Eight Cyber Security Scorecard gives you a clear, plain-English picture of how protected you are — your maturity level against the Australian Government's standard.

What you actually get

One plan, called Fortress. At Essential Eight Level 1 it is 43 things for $139 per user per month, and they arrive together — the eight controls the Australian Government asks for, the monitoring behind them, and the IT support that keeps it all running. Published on our pricing page, not quoted. Here is the whole list, grouped.

  • Device Management 8

    every machine to the standard

    • Application Allowlisting
    • USB & Storage Control
    • Critical Patches in 48h
    • Weekly Vulnerability Scans
    • Office Macros Restricted
    • Browsers Hardened
    • Managed Computers & Phones
    • Windows Autopilot

  • Identity & Access 5

    who can get in

    • Dark Web Monitoring
    • Zero Trust Security
    • Phishing-Resistant MFA
    • Self-Service Password Reset
    • No Standing Admin Rights

  • Backup & Disaster Recovery 5

    keeping it running, and getting it back

    • 24/7 Health Monitoring
    • Daily M365 Backup
    • Cloud Server Backup
    • Restores Tested
    • Power Protection

  • Cyber Security 5

    catching and stopping attacks

    • 24/7 Attack Detection
    • Defender for Business
    • Spam & Malware Filtering
    • Self-Cleaning Email
    • Email Authentication

  • Essential Eight & Compliance 2

    proof you can show

    • Essential Eight — Level 1
    • Baseline & Drift Alerts

  • Cyber Security Training 1

    the half that isn’t technology

    • Security Awareness Training

  • Microsoft 365 7

    email, files and teamwork

    • M365 Business Premium
    • Desktop Office Apps
    • Business Email — 100GB
    • 1 TB OneDrive Storage
    • Microsoft Teams
    • SharePoint
    • Bookings & Planner

  • IT Support 10

    your IT department, on call

    • Unlimited incident support
    • Unlimited service requests
    • New Starters & Leavers
    • Dedicated Account Manager
    • Email, Phone & LiveChat
    • Onboarding
    • Technology Business Reviews
    • Onsite When Needed
    • Pickup & Return
    • Extended Hours

There are two levels above this one. Most businesses shouldn't buy them.

Level 1 is the full Essential Eight, and it is where most Australian businesses should sit. We do offer Level 2 and Level 3 — but they exist for specific requirements, not for extra peace of mind.

  • Level 2+$40 per user

    Required for Defence Industry Security Program (DISP) membership at every level. Financial services licensees land here too — ASIC expects adequate cyber risk management, and this is the standard most reach for.

  • Level 3+$80 per user

    For businesses that are a target in their own right — critical infrastructure, defence, or anyone holding something worth months of an attacker's time.

If a customer, an insurer or a tender asks you for one of them, we will take you there. If nobody is asking, the money is better spent elsewhere.

We would rather sell you less. Over-specified security is money that could have gone somewhere it was needed. If nobody is asking you for Level 2, don't buy Level 2 — and we will tell you that on the call, not after you have signed.

How we keep your business safe

Effective cyber security requires multiple walls of defence — not a single product. We build layers of protection around your users, your devices, your data, and your network. Each layer works independently, so that if one barrier is breached, the next one catches the threat. Here's what's working for you behind the scenes.

  1. ThreatLocker

    Application Allowlisting

    If your business is still relying on antivirus software as its primary defence, you're not protected to the standard the Australian Government sets. Traditional antivirus works on definitions and tries to recognise threats based on known patterns. New threats are created faster than definitions can keep up. Application allowlisting is fundamentally different: instead of trying to identify what's bad, ThreatLocker only allows software that's on your approved list to run — and blocks everything else automatically. If ransomware, malware, or any unauthorised program tries to execute, it's stopped immediately because it's not on the trusted list. Combined with your software catalogue managed through Intune, ThreatLocker knows exactly which applications are approved for your business. This is the same approach used by government agencies and defence contractors.

  2. Intune

    No administrative rights

    Users on your computers don't have administrative rights — which means they can't install software, change system settings, or inadvertently give malware the permissions it needs to do damage. All software is deployed centrally through your software catalogue via Intune. This is a simple but powerful control: even if a threat makes it past the first layer, it can't install itself or escalate its access without admin rights it doesn't have.

  3. Microsoft 365

    Zero Trust device access

    Zero trust is one of the most important concepts in modern cyber security. With zero trust configured, your Microsoft 365 environment — email, Teams, SharePoint, OneDrive — can only be accessed from the user's enrolled work device. Not from a personal laptop. Not from a computer at a café. Not from an attacker's machine on the other side of the world. This means that even if an attacker sends a phishing email and a user reveals their credentials, the attacker still can't access the Microsoft 365 account from their own device. The login is blocked because the device isn't enrolled and trusted. Without zero trust, stolen credentials give an attacker full access to your email, files, Teams conversations, and client data. With zero trust, those credentials are useless on any device that isn't approved.

  4. Intune

    Zero Trust mobile (BYOD)

    Many team members access business systems from their personal mobile devices — checking email, joining Teams calls, reviewing documents on the go. Zero trust extends to these devices too. We enrol mobile devices through Intune with security policies that protect your business data — including MFA, encryption, and the ability to remotely wipe business data if the device is lost or compromised. Importantly, we can't see any personal data on the device. Your team's photos, messages, personal apps, and browsing history are completely private. Zero trust protects your business data without invading your team's personal space.

  5. Network Segmentation

    Zero Trust network

    Zero trust doesn't stop at devices — it extends to your entire office network. We create separate logical networks for each business system: one for your office computers, one for guest Wi-Fi, one for CCTV, one for access control systems, and so on. Each network is isolated from the others, and the devices on each network are specified and approved. An additional device can't simply be plugged in and gain access — it needs to be approved and assigned to the correct segment. A compromised device on guest Wi-Fi can't reach your office computers. A security camera can't be used as an entry point to your business data.

  6. Huntress SOC

    Mailbox compromise detection

    One of the most damaging attacks we see is email mailbox compromise. An attacker gains access to a user's mailbox and creates a hidden rule that redirects incoming emails to a subfolder the user never checks. The attacker reads every email, monitors conversations, and waits for the right moment — typically when an invoice is being sent — then replies to the email thread with a fraudulent invoice containing different EFT bank details. The user never sees the emails coming in, and the person paying the invoice has no reason to suspect anything is wrong. Huntress Security Operations Centre monitors your mailboxes for exactly these kinds of compromises — detecting hidden rules, unusual forwarding configurations, and signs of account takeover in real time. When a compromise is detected, it's flagged and contained before the attacker can act.

  7. Huntress EDR

    Threat detection and response

    Enterprise-grade endpoint detection and response monitors every computer in your business in real time. If something suspicious happens — a program behaving strangely, a file being encrypted, an unusual network connection — Huntress detects it and responds immediately. This isn't just automated alerts; trained security analysts investigate every threat, 24/7.

  8. Huntress SAT

    Security awareness training

    Your team is your first line of defence — and your biggest vulnerability. Huntress Security Awareness Training runs regular, engaging training and simulated phishing campaigns to teach your staff how to spot threats. When someone clicks a simulated phishing email, they get immediate, non-punitive feedback. Over time, your team becomes a genuine security asset instead of a risk.

  9. SIEM

    24/7 security monitoring

    Our Security Information and Event Management system collects and analyses data from across your entire IT environment — emails, devices, logins, network traffic — and correlates it in real time to detect threats that no single tool would catch alone. Our Security Operations Centre monitors these signals around the clock, so threats are identified and contained before they become incidents.

  10. Network Devices

    Managed network security

    Firewalls, routers, switches, and wireless access points all need constant attention. We manage and monitor every network device — applying firmware updates, configuring firewall rules, and watching for performance issues — so your business stays connected and protected without you thinking about it.

Built on the Australian Government's own standard

You don't need to understand cyber security frameworks — that's our job. But it's worth knowing that your protection is built on the same standards used to secure government and defence organisations across Australia.

Essential Eight (ASD)

The Australian Signals Directorate developed the Essential Eight as the baseline cyber security standard for all organisations. It covers eight critical areas: controlling which applications can run, keeping software updated, restricting admin access, using multi-factor authentication, configuring Microsoft Office macros, hardening user applications, backing up data, and patching operating systems. Our support plans implement these controls at Maturity Level 1, 2, or 3 depending on your needs — from baseline protection right up to the standard required for defence industry work.

Source: Essential Eight framework — Australian Signals Directorate (cyber.gov.au)

Maturity Levels 1, 2 and 3

The Essential Eight is scored, not pass-or-fail. Maturity Level 1 is the baseline every Australian business should hold. Level 2 is what tenders, insurers and larger customers increasingly ask for. Level 3 is the bar for defence-industry work and high-threat environments. The eight controls are the same at every level — what changes is how tightly they are enforced and how quickly they are kept current. You choose the level on our pricing page, and you can move up whenever a customer, an insurer or a tender asks you to.

Source: Essential Eight Maturity Model — Australian Signals Directorate (cyber.gov.au)

Book a free consultation

What happens when businesses don't act

  • $56,600

    Average cost of a cyber incident for Australian small businesses (up 14% year-on-year)

  • 84,700+

    Cybercrime reports received by the ASD in 2024–25 — one every six minutes

  • 280%

    Increase in denial-of-service attacks targeting Australian organisations

Beyond the financial cost, a cyber incident means downtime — your team can't work, your clients can't reach you, and your reputation takes a hit. Recovery can take weeks. Some businesses never fully recover. The good news: most attacks are preventable with the right protection in place.

Source: Australian Signals Directorate (ASD) Annual Cyber Threat Report 2024–25 — Australian Cyber Security Centre (ACSC)

Book a free consultation

What it looks like when your security is sorted

  • You stop worrying about cyber threats

    Because someone is watching your systems 24/7 — even on weekends and public holidays. If something happens, you'll know about it in minutes, not months.

  • Your data is only accessible from approved devices

    Even if a password is compromised, zero trust means attackers can't access your email, files, or business systems from their own device. Stolen credentials become useless.

  • Your team stays productive

    No unexpected downtime, no disruptions, no scrambling to recover from incidents that could have been prevented. Your team uses their devices normally — zero trust works behind the scenes.

  • You meet compliance requirements without the headache

    Whether you're working to the Essential Eight or to DISP for defence contracts — we put the technical controls in place, maintain them, and document them, so the evidence exists before anyone asks for it.

  • You have one team to call

    One Adelaide-based team that knows your business, manages your security, and gives you straight answers. No jargon, no runaround.

Book a free consultation

Every plan is built on the Australian Government's framework — read our full guide: What is the Essential Eight? The 8 controls & 3 maturity levels explained

Frequently asked questions

It is part of the plan, not a project. Otaris Fortress is $139 per user per month at Essential Eight Level 1, $179 at Level 2 and $219 at Level 3, with a five-user minimum — published, not quoted. Level 1 is the full Essential Eight and is where most Australian businesses should sit; the levels above it exist for defence, government and critical-infrastructure requirements rather than for extra peace of mind. Call 1800 456 567 if you would rather talk it through.

The Essential Eight is a set of eight mitigation strategies from the Australian Cyber Security Centre that protect against common cyber attacks, covering patching, multi-factor authentication, application control and backups. Any Australian business that handles client data, money or sensitive information benefits from it. Otaris aligns your security to the framework and reports clearly on your maturity level.

Round-the-clock monitoring means threats are detected and stopped before they cause damage, even overnight or on weekends when no one is watching your screens. Otaris watches your systems continuously for unusual activity, failed logins and known attack patterns, then responds straight away. The result is fewer incidents reaching your team and far less chance of a breach going unnoticed.

Disconnect affected devices from the network, stop using compromised accounts, and contact your IT and security provider immediately so the attack can be contained. Do not pay any ransom before getting expert advice. Otaris helps businesses respond, isolate the threat, recover from clean backups and review what happened to prevent it recurring. Call 1800 456 567 for urgent help.

Yes. A managed cyber security provider helps you meet obligations like the Privacy Act, industry regulations and client security requirements by putting the right controls, documentation and reporting in place. Otaris aligns your security to the Australian Essential Eight, monitors your environment continuously and gives you evidence of your security posture. To map your obligations, call 1800 456 567.

Let's make sure you're properly protected.

Book a free 30-minute consultation. We'll review your current setup, identify gaps, and give you a clear picture of where you stand — no obligation.

  • 30-minute discovery — no jargon, no pressure
  • Plain-English Essential Eight Cyber Security Scorecard
  • A clear plan tailored to your business

Prefer to talk?

Call 1800 456 567

Powered by Calendly — your data is handled securely.

Our office · Level 2, Suite 201, 7 James Place, Adelaide

By submitting, you agree to our terms and privacy policy. No spam — ever.

Related insights

Questions we are asked about this regularly, answered in plain English with no obligation attached.

More questions we are asked about this

Related solutions

These services work hand in hand with what you just read — all delivered by the same Adelaide team.

View all solutions