Frequently Asked Questions

Most Australian SMBs think they're secure because they "use the cloud." But M365 security isn't automatic.

We regularly find businesses with:

• 6+ admin accounts (should be 2-3 maximum)
• No MFA on 30-50% of user accounts
• External sharing set to "Anyone with the link" — files shared in 2021 still accessible today
• No backup solution for M365 data (Microsoft's recycle bin isn't a backup)
• Audit logging disabled — no way to detect if someone accessed your data

The average data breach costs Australian SMBs $49,600 in remediation, downtime, notification costs, and lost business. An assessment finds these gaps before they become breaches.

A data breach can devastate a small business:

Financial impact:

• Direct remediation costs ($20,000-$80,000)
• Cyber insurance claims (and future premium increases)
• Client trust and reputation damage
• Business disruption (average 3-7 days downtime)
• Legal costs if client data was compromised

Small businesses are specifically targeted because:

• Lower security posture: Easier to breach than large enterprises
• Supply chain access: Hackers use SMBs as stepping stones to larger clients
• Valuable data: Client files, financial records, employee data all have value
• Less monitoring: Breaches often go undetected for weeks or months

We use a proprietary assessment platform. Instead of manually clicking through settings for hours, our platform conducts comprehensive security analysis efficiently and consistently.

Traditional manual assessment (1-2 weeks):

• Consultant manually logs into your tenant
• Clicks through 50+ admin portals and settings pages
• Takes screenshots and notes
• Writes report from scratch
• Variable quality depending on consultant skill

Our platform-powered assessment (1-5 days):

• Comprehensive security analysis across all critical controls
• Captures detailed evidence systematically
• Applies Microsoft best practices consistently
• Expert review and validation before delivery
• Professional report with remediation roadmap
• 100% consistent quality every time

More thorough. Here's why:

Coverage:

• Manual assessments: Typically 10-15 checks (what one consultant can realistically check in 2-4 hours)
• Our platform: Up to 30 comprehensive checks (depending on your M365 license)

Consistency:

• Manual: 85-90% consistency (depends on consultant experience, time pressure, fatigue)
• Platform-powered: 100% consistency (same checks, same methodology, every time)

Evidence:

• Manual: "External sharing appears to be enabled" (vague screenshot)
• Platform-powered: "External sharing is set to 'Anyone with the link' at tenant level. 47 OneDrive links have been shared externally in the past 90 days with no expiry date" (specific, actionable)

Pricing is flat per assessment — the same price regardless of how many Microsoft 365 licences or seats you have. Every tier runs the same automated assessment (up to 30 checks, with the exact depth depending on your M365 licence — we only run checks applicable to features you actually have). The tiers differ by the service we add on top of that automated run, not by the scope of the scan.

Standard ($499 + GST):

• Automated Microsoft 365 security assessment (up to 30 checks by licence tier)
• CyberChex Score + Microsoft Secure Score
• Professional branded PDF report
• Prioritised, plain-English recommendations + secure portal access
• Delivery: 1–5 business days

Premium ($1,299 + GST) — most popular:

• Everything in Standard, plus:
• Consultant-led findings walkthrough (call)
• Prioritised remediation roadmap
• Re-assessment after remediation (before/after improvement)
• Priority email support

Enterprise ($1,999 + GST):

• Everything in Premium, plus:
• Quarterly scheduled re-assessments
• Comparison reporting between assessments (track improvement over time)
• Executive / board-ready summary

Read-only access only. We never make changes to your environment.

Specifically, we request:

• Global Reader role: Read-only access to view settings (no edit permissions)
• Security Reader role: Read-only access to security & compliance settings

What we CAN do:

• View configuration settings across your M365 tenant
• Review security policies and controls
• Check Secure Score and recommendations
• View audit log status (but not read the logs themselves)

What we CANNOT do:

• Make any configuration changes
• Access mailbox content or read emails
• View files stored in SharePoint/OneDrive
• Export user data
• Delete or modify anything

You get a clear action plan and multiple options for how to proceed.

Step 1: Report Delivery (1-5 business days)

• Professional PDF report with findings, risk ratings, and remediation roadmap
• Executive summary (1 page for board/stakeholders)
• Prioritised action list: Immediate (48 hours) / 30 days / 90 days
• Portal access for ongoing tracking

Step 2: Debrief Call (scheduled within 3 days of report)

• 45-90 minute video call (depending on tier)
• Walk through every finding
• Answer questions
• Build your implementation plan
• Discuss options for remediation

Step 3: Your Options

Option A: DIY Implementation

• Use our report and roadmap to fix issues yourself
• We provide links to Microsoft documentation for each item
• Email support during your support window (14-60 days depending on tier)
• Best for: Businesses with internal IT resources

Option B: CyberChex Remediation

• We fix the critical issues for you (charged hourly or project basis)
• Typical remediation: 5-15 hours depending on findings
• We make the changes, test, and document
• Best for: Businesses without internal IT or time constraints

Option C: Monthly Monitoring

• Monthly scans to track progress
• Change detection alerts
• Ongoing compliance evidence
• Best for: Businesses wanting ongoing visibility

It depends on your findings, but here's a realistic timeline:

Critical issues (within 48 hours):

• Enable MFA on admin accounts: 30 minutes
• Remove excessive admin privileges: 1 hour
• Enable audit logging: 15 minutes
• Disable risky sharing settings: 30 minutes

30-day priorities:

• Configure SPF/DKIM/DMARC email authentication: 2-4 hours
• Set up Conditional Access policies: 3-6 hours
• Implement backup solution: 4-8 hours (including testing)
• Review and update external sharing policies: 2-3 hours

90-day improvements:

• Implement DLP (Data Loss Prevention) policies: 8-12 hours
• Configure device compliance policies: 4-8 hours
• Set up retention policies: 4-6 hours
• Document processes and train staff: 8-16 hours