Security advice sized for a small business.

oowl is a Melbourne-based cyber security consultancy for Australian small and medium businesses. We do three things: assess and improve your security against the ASD's Essential Eight, work out what you are legally responsible for under the Privacy Act and whether you could survive a breach, and securely destroy data when you no longer need it.

We started oowl because the security advice available to a twelve-person business is either free government documentation written for enterprise IT teams, or an enterprise vendor quoting enterprise prices for a platform nobody on staff can run. Neither helps. The useful version is someone who will read the government documentation for you, look at what you actually have, and tell you the three things to do this month.

What we will not do

• Claim certifications we do not hold. We are not ISO 27001 certified, not IRAP assessed, not ASD-endorsed and not accredited by anyone. If you need a certified assessor we will tell you and point you elsewhere, even though that costs us the work.
• Quote statistics we cannot source. Every figure on this site links to the ASD or the OAIC. If we cannot link it, we do not use it.
• Invent logos and testimonials. You will not find a wall of client badges here. When clients are willing to be named, they will appear with their permission and not before.
• Sell you Level 3 maturity. The ASD model goes to Level 3. Almost no small business needs to be there. We will tell you when to stop spending.
• Use fear as a close. The numbers on the home page are real and they are also averages that say nothing specific about you. The audit exists to replace them with facts.

How we work

A free 30-minute security check first, so both of us know whether there is a job here. Then a fixed fee, quoted in writing, for a one-off audit covering Essential Eight maturity and Privacy Act / Notifiable Data Breaches readiness. You get a findings report, a prioritised plan and effort estimates, and you own all of it — including if you decide to do the remediation yourself or hand it to another provider.

After that, a monthly subscription for continuous monitoring and auditing if you want your controls re-checked rather than left to drift. No lock-in contract. Cancel and keep every document.

We work remotely across Australia and on site where it genuinely needs hands on hardware — data destruction, network gear, anything physical.

The business

oowl operates as Mohamed Arshad Shafan trading as oowl, ABN 35 545 025 212, registered in Australia as a sole trader. Melbourne, Victoria. Our security contact and responsible disclosure policy is published at /.well-known/security.txt in line with RFC 9116.

If you would like to talk, the security check is the fastest way, or email [email protected].