About
Cybersecurity fails at the point of explanation, not the point of detection.
An Australian family business, started in 2022, built on a simple observation: business owners are asked to make security decisions without being given the information to make them.
Founder’s message
Why I started Cyber Guys
Cyber Guys began in 2022, during the uncertainty of the COVID-19 pandemic.
Like many people during that period, our family was thinking differently about work, business and risk. Technology had become more important than ever. Businesses were relying heavily on remote access, cloud systems and digital communication, often without fully understanding the new risks that came with them.
At the same time, I could see a problem much closer to home.
My wife, Linda, runs an accounting firm. Her business handled sensitive client information and depended heavily on secure, reliable technology. From time to time, security improvements would be made. New systems would be introduced, settings would change and additional protections would be put in place.
Linda wanted those improvements. She understood they were important. But, like many business owners, she did not always understand exactly what had changed, why it mattered or whether there were still gaps.
More than anything, she simply wanted it taken care of.
She did not want to become a cybersecurity specialist. She wanted to focus on her clients, her staff and growing her firm. She wanted the confidence that the people responsible for her technology understood the risks, were doing the right things and would explain the decisions that genuinely mattered.
That experience became one of the foundations of Cyber Guys.
I realised Linda was not alone. Small business owners everywhere were being told that cyber threats were increasing, insurance requirements were becoming stricter and compliance obligations were growing. Yet they were still expected to make important security decisions without clear, understandable information.
Cybersecurity had become something that was done to businesses rather than with them.
Business owners were often presented with technical reports, unfamiliar terminology and lists of recommendations without being given the context needed to understand what was urgent, what was optional and what the consequences of each decision might be.
I started Cyber Guys to help change that.
We are a family business, and that shapes the way we see cybersecurity. We understand that behind every organisation are real people, families, employees and customers. A cyber incident is not simply a technical problem. It can disrupt livelihoods, damage trust and threaten something that has taken years to build.
My background sits across technology, cybersecurity, investigations and education. I have always believed that knowledge should give people confidence, not make them feel overwhelmed. Cybersecurity should not be hidden behind technical language, fear-based marketing or compliance reports that nobody outside the industry can properly interpret.
Cyber Guys was created to make cybersecurity clearer, more practical and more human.
The goal has never been to turn every business owner into a cybersecurity expert. It is to help them understand their position, make informed decisions and feel confident that the right protections are being put in place.
It is also about accountability. Business owners should be able to see what has been improved, what still needs attention and why particular decisions matter. They should not have to blindly trust that everything has been taken care of, but they also should not have to become technical experts just to protect their business.
Since we started in 2022, Cyber Guys has grown beyond that original idea. We now help businesses assess their security posture, train their people, test their resilience, prioritise improvements and produce evidence for clients, insurers, boards and auditors.
But the purpose has never changed.
I started Cyber Guys because business owners like Linda deserve more than technical jargon and quiet changes made in the background. They deserve clarity, confidence and the reassurance that someone is looking after the things they may not fully understand but know are too important to ignore.
Behind every business is something a family has worked hard to build.
Cyber Guys exists to help protect it.
What we decided to build
Cyber Guys has two layers, and the line between them is deliberate.
The public layer is our blog. It is free, it requires no account, and it explains real cyber risks properly — what they are, how they work, what the warning signs look like and what good practice looks like. We are not interested in content-marketing that withholds the useful half. If you read an article here and then go and fix the problem yourself without ever paying us, that is a good outcome.
The platform layer is paid, and it is where the education becomes a system. Assessments against recognised frameworks. Training that measures whether somebody would actually behave differently. Simulations that test it safely. Recommendations that force an answer. Declines that produce a signed, dated, immutable record. Quarters that turn into a report you can hand to a board or an insurer.
What we are not
- Not a downloadable template shop. If our value could be extracted into a folder of Word documents, it would not be worth paying for.
- Not a certification body. Our assessments are structured self-assessments, and every export says so on its face.
- Not an insurer, an auditor or a law firm. We help you evidence what you did; we do not opine on whether it was enough.
- Not in the business of frightening people. Fear produces a week of vigilance and then nothing. Understanding produces a changed habit.
How we write
Every cyber explanation in the platform answers the same five questions, because these are the questions a decision-maker is actually asking, whether or not they say them out loud:
- What does this mean?
- Why does it matter?
- What should we do?
- What happens if we ignore it?
- Who needs to act?
If a piece of content cannot answer all five without a glossary, it is not finished. We also avoid the two failure modes that make cyber content useless: technical overload, where every term needs another term to explain it, and fearmongering, where the reader is left alarmed but no better equipped.
On saying no
A business declining a cyber recommendation is not a failure. Businesses decline things constantly, for entirely rational reasons — cash flow, timing, competing priorities. The failure is when nobody records that the decision was made, by whom, on what information, and when it should be revisited.
That is why the risk acceptance workflow exists, and why those records are immutable. A declined recommendation with a named person, a date and a review point is a healthy business decision. A declined recommendation that lives only in somebody’s memory is a liability for everyone involved.
Disclosure
Our relationship with Defy IT
Worth stating plainly, because you will see the name on this site.
Defy IT is the managed service provider where Cyber Guys started, and it is involved in building and operating the platform. It is not an independent customer.
Where we quote Defy IT on this site, we label it as the origin story and pilot experience rather than presenting it as third-party validation. Independent customer results will be published as named case studies once those customers agree to be named — and not before, because an anonymous testimonial from a related party is worth less than nothing.
Principles
How we make product decisions
Plain English is a security control
If the person who has to act cannot understand the instruction, the control does not exist. Clarity is not a nicety here; it is the mechanism.
Every workflow ends in a record
Training ends in a certificate. An assessment ends in a gap list. A recommendation ends in a decision. A decline ends in an acknowledgement. If there is no artefact, the workflow is not finished.
Consequences honestly, then instructions
We will tell you plainly what can happen if something is ignored. We will then immediately tell you what to do about it. Never the first without the second.
Records are never quietly rewritten
Risk acceptances cannot be edited. A correction creates a new version and preserves the original, because the value of the record is that it cannot be tidied up later.
We count what exists, not what is planned
Where a capability is built but not yet available to customers, the website says so on the page rather than in a footnote. A number on a marketing page should survive somebody opening the product.
People are not the vulnerability
The human-risk model reads behaviour only, reporting always helps a score, and results are framed as where education or a control is needed — not as a ranking of employees.
The same standard applied to ourselves: our security overview lists what we have not built yet.
See whether this fits how you already work.
A short, honest walkthrough. If it is not right for you, we will say so.