For Australian small and medium businesses
Know where your cyber risk is, fix it, and prove it to whoever asks.
Assess your business against the Essential Eight and other recognised frameworks, train the people who make the decisions, test readiness with safe phishing simulations, and hold the evidence your insurer, board or biggest client will ask for.
- Assessment against the Essential Eight and other frameworks
- Staff and manager training that measures judgement
- Safe phishing simulations with follow-up training
- Evidence records for insurers, boards and clients
Australian owned and operated. Priced in Australian dollars, excluding GST.
Your cyber position at a glance
- Cyber readiness score64 / 100
- Staff training completion82%
- Open cyber actions4
- Completed this quarter9
- Risks formally accepted1
- Certificates issued23
Assess. Train. Simulate. Improve. Prove.
The whole loop, run for one business.
You do not need an IT provider to operate this for you. Everything below runs inside your own organisation, at your own pace.
- Step 1
Assess
Find out where you actually stand.
Work through a recognised framework — the Essential Eight, NIST CSF 2.0, ISO 27001 readiness or your insurer’s questionnaire — and get a gap list instead of a feeling.
Learn more - Step 2
Train
Teach the people who make the decisions.
Scenario-based modules for staff, managers and owners, written in plain English and measured on judgement rather than on whether somebody reached the last page.
Learn more - Step 3
Simulate
Test readiness safely, with permission.
Authorised phishing simulations using approved templates, with follow-up training assigned automatically to the people who need it.
Learn more - Step 4
Improve
Turn findings into decisions somebody owns.
Gaps become prioritised recommendations in business language, each with an owner, a due date and a recorded answer — approved, deferred, or declined with the risk formally accepted.
Learn more - Step 5
Prove
Show the improvement to whoever asks.
Evidence records, verifiable certificates and reports that answer an insurer, a board, a major client or an auditor without anybody rebuilding the story from email.
Learn more
The gap most businesses have
Your staff got trained. Your managers never did.
Staff awareness training teaches people not to click the link. It does not teach the person who approves the budget what they are actually approving — or what they are accepting when they say no.
What staff training covers
- Spotting a phishing email
- Passwords and multi-factor authentication
- Reporting something that feels wrong
- Safe file sharing and personal devices
What managers still need
- What cyber risk actually means for this business
- What IT controls and what the business controls
- How to read a recommendation and decide on it
- What those cyber insurance questions are really asking
What is included
Everything you need to train, decide and evidence.
Framework assessment
Assess against the Essential Eight, NIST CSF 2.0, ISO 27001 readiness, the Australian Privacy Principles and 9 other recognised frameworks — all sharing one control library, so you answer once.
Phishing simulations
Safe, authorised simulations against your own staff using approved templates, with follow-up training assigned automatically to anyone who engages. Included from Business Plus.
Staff awareness training
Cyber Basics for Staff, Business Email Compromise Prevention and Safe AI Use at Work. Around twenty minutes each, scenario-based, with a quiz and a pass mark.
Manager cyber literacy
A module written specifically for the people who approve, defer or decline cyber work — and who will be asked to explain that decision later.
Cyber readiness score
12 areas rated from Not started to Mature, rolled into a score out of 100 with a clear next action for each area. An internal indicator, not a certification.
Cyber action plan
A live list of what needs doing, in business language, with urgency, owner, effort and cost. Approve items, defer them, or decline and record why.
Responsibility matrix
A plain-English breakdown of what your IT provider owns and what your business owns. Most incidents happen in the gap between the two.
Evidence records
Training completions, decisions, accepted risks and readiness reviews, all dated and attributed. Exactly what an insurer or a large client asks for.
Certificates
Every completed module issues a verifiable certificate with a unique number, a completion date and an optional retraining date.
Management report
One controlled PDF covering completed actions, outstanding recommendations, accepted risks, training completion and readiness. Ready for a board pack.
The questions that catch businesses out
“Do you provide cyber awareness training to all staff annually?”
Cyber insurance applications, tender documents and enterprise supplier questionnaires all ask versions of this. Answering yes is easy. Evidencing it twelve months later is the hard part.
What Cyber Guys can show
- Who was assigned training, when, and by whom
- Who completed it, on what date, and what they scored
- The certificate number for each completion, verifiable online
- Which recommendations were made and what was decided
- Which risks were formally accepted, by whom, and when they are due for review
Go deeper
The parts businesses ask about most.
Get your managers cyber literate, not just your staff cyber aware.
See an Essential Eight assessment, the training, a simulation result and the evidence records in a fifteen minute walkthrough.