Cyber security is no longer a discretionary line item for Australian businesses. Ransomware, credential theft, and supply chain compromise now affect organisations of every size, and the businesses that fare worst are rarely the ones that were deliberately targeted — they are the ones that were simply easier to breach than the business next door. Cyber insurers, government buyers, and enterprise clients have all responded the same way: by asking Australian businesses to demonstrate, with evidence, that a defined set of security controls is in place and working.
This guide brings together the cyber security solutions Australian businesses of 10–300 users actually need, how they map to the Australian Cyber Security Centre's Essential Eight, and what it costs to have them implemented and managed properly. Mycelium 365 delivers these controls as part of a managed service — see our Essential Eight compliance services for the implementation and evidence side of the work.
What cyber security solutions do Australian businesses actually need?
Australian businesses face a consistent set of cyber threats: ransomware delivered via phishing emails, credential theft via password spray attacks, supply chain compromise through a managed service provider or software vendor, and insider threats through misconfigured permissions. These four vectors account for the overwhelming majority of incidents reported to the ACSC each year, and they share a common characteristic — each one is preventable with controls that are already available in the Microsoft platform most Australian businesses already pay for.
The Australian Cyber Security Centre (ACSC) identified these attack vectors and designed the Essential Eight specifically to mitigate them. Rather than an open-ended list of best practices, the Essential Eight is a deliberately short, prioritised set of controls chosen because they block the techniques attackers actually use against Australian organisations. That focus is what makes it useful for a business of 10–300 users: it is achievable, measurable, and defensible in an audit.
Mycelium 365 implements and manages the Essential Eight as the foundation of cyber security for Australian businesses — using Microsoft 365 Business Premium and Azure, which together cover the majority of the eight controls at Maturity Level 2. That matters commercially as well as technically. A business that already licences Microsoft 365 Business Premium has largely paid for the tooling; what is usually missing is the configuration, the enforcement, the monitoring, and the evidence trail. Those four things are the actual service.
In practice, the minimum viable security posture for an Australian SMB looks like this: multi-factor authentication enforced on every account through Conditional Access, managed and compliant devices, endpoint detection and response running on every machine, email filtering tuned against phishing and impersonation, tested backups held separately from production, and least-privilege administration with no permanent standing admin rights. Everything else builds on those foundations.
The Essential Eight — Australia's cyber security standard
The Essential Eight is the ACSC's recommended baseline of eight controls. Each one targets a specific stage of a typical intrusion:
Application control — only approved applications are allowed to execute, preventing malware and unapproved software from running on managed devices.
Patch applications — third-party software such as browsers, PDF readers, and productivity tools is patched promptly, closing the vulnerabilities most commonly exploited in drive-by and phishing attacks.
Patch operating systems — Windows, macOS, iOS, and Android are kept current and supported, with end-of-life operating systems removed from the environment entirely.
Restrict Microsoft Office macros — macros are blocked by default and permitted only where there is a documented business need and a trusted source.
User application hardening — browsers and productivity applications are configured to block risky content such as legacy scripting, Flash-era plug-ins, and untrusted add-ins.
Restrict administrative privileges — administrative rights are limited, reviewed, and issued just-in-time rather than held permanently by day-to-day user accounts.
Multi-factor authentication — MFA is enforced on all internet-facing services and privileged accounts. This is the single highest-impact control on the list; our guide to multi-factor authentication covers how it is configured and enforced in Microsoft 365.
Regular backups — business-critical data is backed up, retained, protected from tampering, and — critically — restore-tested on a defined schedule.
Each control has four maturity levels, from Maturity Level 0 (not implemented) through Maturity Level 3 (aligned against adaptive, well-resourced adversaries). Maturity Level 2 is the current standard expected by cyber insurers and government procurement. Insurers now ask specific Essential Eight questions at renewal, and an incomplete or unevidenced answer increasingly translates into a higher premium, a restricted policy, or a declined claim. Government and defence supply chains ask the same questions earlier, at tender stage.
Mycelium 365 uses Microsoft 365 Business Premium to achieve Maturity Level 2 across all eight controls — Microsoft Intune for device control and application management, Microsoft Defender for Business for endpoint protection, and Entra ID Conditional Access for MFA enforcement and privileged access restriction. Where a control cannot be met with the Microsoft stack alone, we close the gap with a documented compensating control rather than leaving an unexplained blank in the assessment.
Managed cyber security — why Australian businesses use an MSP
Managing cyber security in-house requires more than a licence. It requires a security engineer who understands Microsoft Defender alerts well enough to separate a genuine intrusion from noise — an average Australian salary of $120,000 or more, before recruitment and retention costs. It requires 24/7 monitoring capability, and one person cannot cover nights and weekends, which is precisely when ransomware deployment tends to occur. It requires continuous platform maintenance as Microsoft releases new security controls, deprecates old ones, and changes defaults. And it requires ongoing Essential Eight assessment and evidence collection so the posture can be demonstrated to an insurer or auditor on request, not reconstructed under pressure after an incident.
Most Australian businesses of 10–300 users cannot cost-effectively maintain this in-house. The maths rarely works: the salary of a single security specialist exceeds the entire annual managed security spend for a business of that size, and a single specialist still cannot provide round-the-clock coverage.
Mycelium 365 provides managed cyber security for a fixed monthly price — including 24/7 SOC monitoring via Huntress, Essential Eight management, Microsoft Defender configuration and response, and monthly security reporting. The SOC provides human eyes on alerts at 2am; the Essential Eight management keeps the configuration from drifting; the reporting gives leadership something concrete to review each month rather than an assumption that everything is fine. See our managed security services for how the monitoring and response layer operates.
The other argument for a managed provider is consistency. Security posture degrades quietly — a policy exception granted for one user and never revoked, a device enrolled outside Intune, an admin account created for a project and forgotten. Ongoing management exists to catch that drift before an attacker does.
Microsoft Defender for Business — enterprise security for Australian SMBs
Microsoft Defender for Business (included in Microsoft 365 Business Premium at $32/user/month) provides enterprise-grade endpoint detection and response (EDR) for Australian SMBs. It is the same detection engine lineage that protects large enterprises, packaged and priced for businesses that would never have justified a standalone EDR product.
What it covers: real-time malware and ransomware detection on Windows, macOS, iOS, and Android devices; automated investigation and remediation of security alerts, so common threats are contained without waiting for a human; vulnerability management, identifying unpatched software across all devices and ranking it by exploitability; and integration with Microsoft Sentinel for advanced threat correlation where a business needs to bring signals from multiple systems into one timeline.
The value of Defender for Business is highest when it is genuinely deployed across the whole fleet and its alerts are actually acted upon. An unmonitored EDR console is a log, not a control. Managed by Mycelium 365, Defender for Business provides the detection layer — Huntress SOC provides the 24/7 human monitoring and response layer. Detection without response leaves the business exactly where it started; response without detection is guesswork. Both layers together are what turns a licence into a security outcome.
Cyber security for Australian compliance — APRA, DISP, and Privacy Act
Australian businesses in regulated industries face specific cyber security obligations, and the controls above map directly onto them.
For APRA-regulated entities — banks, insurers, and superannuation funds — APRA CPS 234 requires MFA on all internet-facing services, endpoint security proportionate to the sensitivity of the information held, and a tested incident response capability. APRA also expects information security capability to be maintained where it is provided by a third party, which means an MSP arrangement must be documented and evidenced, not simply assumed.
For defence contractors, the Defence Industry Security Program (DISP) requires Essential Eight at Maturity Level 2 or higher, with evidence documentation. Membership is assessed and periodically reviewed, so the evidence needs to be continuously maintained rather than assembled once at application.
For all Australian businesses holding personal information, the Privacy Act requires reasonable security measures, and the OAIC has found Essential Eight Maturity Level 1 to be the minimum standard. With the Privacy Act reform agenda continuing to raise expectations — and notifiable data breach obligations already in force — Maturity Level 1 should be read as a floor, not a target.
Mycelium 365 provides cyber security solutions mapped to each compliance framework, with evidence documentation suitable for APRA, DISP, and Privacy Act audits. The evidence pack is produced as a by-product of the managed service rather than as a separate consulting exercise, which is what keeps it current between audits.
Cyber security pricing for Australian businesses
Mycelium 365's managed cyber security is included in Secure Essentials from $95/user/month — covering Microsoft 365 Business Premium management, Essential Eight controls, Intune device management, Defender for Business, and IT helpdesk. For a business of 25 users, that is a single predictable monthly figure covering both day-to-day IT support and the security posture behind it.
Businesses requiring 24/7 SOC monitoring and Azure infrastructure security use the Secure Cloud package from $150/server/month, which extends monitoring and hardening to server and cloud infrastructure alongside the user-level controls.
There is no separate charge for cyber security management within the managed package — it is included as a non-negotiable component of how Mycelium 365 manages every client environment. We do not offer an unsecured tier, because an unsecured environment creates risk for the client, for their customers, and for us as the provider managing it.
If you would like a current-state view before committing to anything, contact Mycelium 365 for a cyber security assessment. The assessment reviews your Microsoft 365 and Azure configuration against the Essential Eight, identifies the gaps that matter most, and gives you a costed plan to close them.