Independent, Melbourne based, Australia wide
A cyber security firm for Australian small and medium businesses.
Independent Essential Eight assessments, Privacy Act and data breach readiness, secure data destruction and ongoing monitoring, for businesses without a security team of their own.
- AssessEssential Eight and Privacy Act readiness, with the evidence and a fix plan.
- FixIn the order that reduces risk fastest, by your IT provider or us.
- Monitoroowl shield◆: a short monthly report. Urgent-issue contact is being built and tested.
From oowl shield, our security monitoring service, in internal testing.
Fees in writing
Fees agreed in writing before we start.
Independent
We earn no commission on any product we recommend.
Australian
Melbourne based, serving businesses Australia wide.
What we offer
oowl is a Melbourne-based cyber security firm for Australian small and medium businesses. Here is each thing we do, in plain English.
-
Coming soon
oowl Shield: monitoring
Keeps watch on your computers and sends a short monthly report. How we contact you about urgent issues is still being built and tested. In internal testing, not yet available to clients.
How oowl shield will work -
Available now
Essential Eight audits
We check your business against the government’s eight key security controls and give you a plain-English report and a fix plan.
What an audit covers -
Coming soon
Microsoft 365 security reviews
A check of how your Microsoft 365 is set up, to find the weak spots in sign-in and email. Not open yet. Ask us if you want to know when it is.
Ask us about it -
Available now
Data destruction
Old drives, laptops, phones and paper destroyed for good, with a certificate for every item.
How data destruction works -
Available now
Privacy policy writing
A privacy policy and collection notice written for your business, as part of our five-day Privacy Act quick-start.
What the quick-start covers
Audits, reviews and advice
We look at what you actually have, measure it against published Australian standards, and tell you plainly what to fix first. Every finding comes with the evidence behind it.
Essential Eight assessment
Your maturity against each of the eight controls in the ASD’s published Essential Eight Maturity Model, reported at the level you are genuinely at, with the evidence and a fix plan in the order that reduces risk fastest. Not a certification.
What an assessment coversPrivacy Act and NDB readiness
Whether the Privacy Act applies to your business, what personal information you hold and where, and whether you could assess a suspected breach inside the 30-day window the Notifiable Data Breaches scheme allows.
Privacy Act and data breachesSecure data destruction
Drives, laptops, phones, tapes and paper sanitised or destroyed, with a serial-tracked chain of custody and a certificate for every asset. Staff departures are handled end to end through offboarding.
How data destruction worksOngoing monitoring: oowl shield
A small agent on each computer reports to oowl's server in Australia. Rules flag unusual activity, a person at oowl reviews what matters, and you get a short monthly report with at most three things to do, and urgent-issue contact that is still being built and tested. In internal testing, not yet available to clients.
How oowl shield worksWritten security advice
A straight answer when you need one: an insurer or tender questionnaire, a concern after an incident, a supplier asking about your controls, or simply where to start. Tell us the question online and we quote a fixed fee for written advice, with the next steps in priority order. A call is optional.
Get your quote
oowl shield
Security monitoring for small businesses, in plain English
Automated detection runs 24 hours a day on your computers and Microsoft 365◆, and a person at oowl reviews alerts in business hours. Each month you get a short report you can act on. How we contact you about a confirmed urgent issue is still being built and tested, so we promise no response time yet.
- A report, not a dashboard. About two pages a month, with at most three things to do.
- Urgent issues◆. How we contact you is still being built and tested. No response time is promised yet.
- Stored in Australia. On oowl's own monitoring server in an Australian data centre.
- Works with your IT provider. We watch and advise. They make the changes.
From your computers to your report
Monitoring data is stored in Australia; one coded flow leaves (see security and privacy)- 1. Your computersA small agent on each Windows, Mac or Linux computer. It only sends data out, encrypted.
- 2. oowl's server, in AustraliaEvents and alerts are stored in an Australian data centre, under reference codes, not your business name.
- 3. Rules and triage◆Rules flag what matters. Names become codes, then an AI assistant helps sort the alerts.
- The one flow that leaves Australia◆The AI assistant (Anthropic, US) receives codes only, never names or addresses.
- 4. A personSomeone at oowl reviews urgent alerts and reports before we contact you.
- 5. YouA monthly report with up to three actions. Urgent-issue contact is still being built and tested.
- Microsoft 365◆Read-only activity logs, on Shield and Shield Plus. We can't read email or change anything.
◆In development, or running only in oowl's own internal pilot, and not yet available to clients. oowl shield is in internal testing and not yet monitoring any client's systems.
How we work
Assess, fix, monitor. You can stop after any step and keep everything we have written for you.
Assess
We measure your controls against the Essential Eight and your obligations under the Privacy Act, with evidence for every rating. You get a plain-English report and a prioritised fix plan.
Fix
The gaps are closed in the order that reduces risk fastest, by your IT provider, your own staff or us. We resell no products, so the plan never depends on buying something from us.
Monitor
oowl shield (in internal testing, not yet available to clients) keeps watch so you can see whether fixes hold: a small agent on each computer, and a monthly report checked by a person. Urgent-issue contact is still being built and tested. Nothing is ever installed without your written agreement. How oowl shield works
Not sure where you stand? Tell us about your business online and we will tell you which step you are at, with a written quote.
Get your quoteIndustries
The same work applies to any Australian business. Some sectors carry extra obligations, and we cover those on their own pages.
Professional services
Accountants, lawyers, conveyancers and real estate agents who provide AML/CTF designated services must comply with the Privacy Act for that work from 1 July 2026, even under the $3 million small business threshold. Our fixed-fee Privacy Act quick-start covers it in five business days.
Professional servicesPricing
oowl shield has published starting prices. Everything else is quoted to your business: tell us about it online and we send a written, fixed quote before any work begins. Prices exclude GST.
Security assessment
Essential Eight maturity and Privacy Act readiness in one engagement, with the report, fix plan and walkthrough. Independent: we resell no IT services, so the assessment isn’t a sales pitch for a managed-IT contract. What an assessment covers
Privacy Act quick-start
Five business days to a privacy policy and collection notice, a personal-information map, a Notifiable Data Breach response plan and ID-document retention advice. What the quick-start covers
Advice on a specific question
An insurer or tender questionnaire, a concern after an incident, or where to start, answered in writing with the next steps in priority order. A call is optional.
Staff offboarding and data destruction
Accounts shut down, required records retained, what the business needs handed over, devices wiped or destroyed with a certificate. How offboarding works
Data destruction
Priced per job, because a drawer of old laptops and a decommissioned server room are not the same piece of work.
oowl shield monitoring
Watch (from $490, up to 10 computers), Shield (from $890, up to 20 computers and Microsoft 365) or Shield Plus (from $1,490, up to 50 computers), per month ex GST, plus a one-off setup fee equal to one month. The final price depends on your devices (computers, phones, tablets and handhelds) and is confirmed in your written quote. Compare the plans
The quick-start privacy policy includes the automated decision-making disclosure that APP 1.7 requires of APP entities from 10 December 2026: OAIC, transparency for AI and automated decision-making. Whether the Privacy Act applies to your business is the first thing we check.
Tell us about your business online and we send a written, fixed quote. A call is optional.
Get your quoteThe numbers
Every figure here comes from an Australian government source and links to it. We do not use statistics we cannot point you to.
Average self-reported cost of cybercrime per report for an Australian small business in FY2024–25, up 14% on the year before.
How often a cybercrime report was made to ReportCyber in FY2024–25, from more than 84,700 reports in the year.
Data breach notifications received by the OAIC in the 2025 calendar year, an all-time high and 8% above 2024. Around 59% came from malicious or criminal attack.
OAIC, published 6 July 2026
What these numbers are not. They describe the Australian small business population, not your business. Nobody can tell you your risk as a percentage without looking, and we will not pretend otherwise. Replacing averages with facts about you is the entire point of the assessment.
About oowl
oowl is a Melbourne-based cyber security practice serving small and medium businesses across Australia. We started it because the advice available to a twelve-person firm is either free government documentation written for enterprise IT teams, or an enterprise vendor quoting enterprise prices for a platform nobody on staff can run. Neither helps. The useful version is someone who reads the government documentation for you, looks at what you actually have, and tells you the three things to do this month.
What we don't do
- We claim no certifications. oowl is not ISO 27001 certified, not IRAP assessed, not ASD-endorsed and not accredited by anyone. If your contract or insurer needs a certified assessor, we will say so and point you to one, even though it costs us the work.
- We resell no products. No commissions, no vendor partnerships, no licences marked up. What we recommend is what we would do ourselves.
- We don't use fear as a close. If your setup is already in reasonable shape, we will tell you that rather than invent work.
- We publish no client logos or testimonials. When clients are willing to be named, they will appear with their permission and not before.
Questions
What does oowl do?
oowl is an independent cyber security firm for Australian small businesses, Melbourne based, working Australia wide. We work with businesses that have no security team of their own. We assess your controls against the ASD’s Essential Eight Maturity Model, check your Privacy Act and Notifiable Data Breach readiness, securely destroy data, and keep watch afterwards with oowl shield, our security monitoring service. Shield is in internal testing and not yet available to clients.
How do I get a price?
Use the quote form: tell us your business size, how many computers, phones, tablets and handhelds you have, and what you need. We reply by email with a written, fixed quote before any work starts. oowl shield plans start from A$490 a month ex GST, and oowl shield is in internal testing and not yet available to clients. A call is optional, if you would rather talk it through.
Do you hold any certifications?
No. oowl is not ISO 27001 certified, not IRAP assessed, not ASD-endorsed and not accredited by anyone. We apply the ASD’s published Essential Eight Maturity Model and OAIC guidance. If your contract or insurer needs a certified assessor, we will say so.
What does the free security check involve?
A passive external check of what your business already exposes to the internet: DNS and mail authentication (SPF, DKIM, DMARC), TLS and certificate configuration, login portals reachable from the open internet, and credentials for your domain that already appear in known public breach data.
All of it is read from public records and public-facing services, the same way anyone on the internet could. We do not scan, probe or log in to your systems, and we never will without your written authorisation.
You get a one-page result in plain English, yours to keep. If you want to talk it through, there is an optional 30-minute call afterwards. There is no follow-up sequence and no mailing list.
Current risks for Australian businesses are covered in our threat briefs, and practical notes are on the blog.
Enquire
For a price, the quote form asks for your business size and device counts, and we reply with a written, fixed quote. For anything else, use this form. Any fee is confirmed in writing before work starts.
Not ready for that? The free security check is a passive external look at what your business already exposes to the internet, read from public records only. No charge, no obligation.
What the free security check covers
- DNS and mail authentication: whether SPF, DKIM and DMARC are set up so your domain cannot be spoofed.
- TLS and certificate configuration on the names that face the internet.
- Login portals exposed to the open internet, and whether they sit behind multi-factor authentication.
- Credentials for your domain that already appear in known public breach data.
- A one-page result, plain English, yours to keep. Then a 30-minute call if you want one.
Passive only. Everything above is read from public records and public-facing services, the same way anyone on the internet could. We do not scan, probe or log in to your systems, and we never will without your written authorisation.