# oowl

> oowl is an independent cyber security firm for Australian small businesses, Melbourne based, working Australia wide. It works with businesses that have no in-house security team. oowl gives written advice on specific security questions, assesses businesses against the ASD's Essential Eight Maturity Model, checks Privacy Act 1988 and Notifiable Data Breaches readiness against OAIC guidance, securely destroys data with a certificate per asset, and offers oowl shield, an ongoing security monitoring service: automated detection on the client's computers, and a short monthly plain-English report reviewed by a person. Urgent-issue contact is still being built and tested and no response time is promised yet. Your monitoring data is stored in Australia. To analyse alerts, we send coded event details, with names and identifiers removed, to a trusted AI provider in the US. Microsoft 365 read-only monitoring and AI-assisted triage are running in oowl's own internal pilot; the quarterly Essential Eight evidence pack is in development. oowl shield is in internal testing and not yet available to clients. It is not a 24/7 staffed security operations centre. oowl holds no security certifications or accreditations and resells no IT products.

oowl shield has published starting prices; everything else is quoted to the business as a fixed fee, in writing, before any work starts. The online quote tool (https://oowl.com.au/quote) shows a suggested plan with published starting prices straight away, then takes a request for a written quote. A call is optional. How oowl works: assess, fix, monitor (https://oowl.com.au/#how-we-work). Contact: hello@oowl.com.au.

## Services

- [Get your quote](https://oowl.com.au/quote): online scoping tool (staff, sector, device counts for computers, phones, tablets and handhelds, email platform, compliance needs and goals) with an optional AI assistant (Claude) or a short form, that shows a suggested plan with published starting prices straight away (worked out by fixed rules, not by the AI) and takes a request for a written, fixed quote; a call is optional
- [Services and pricing](https://oowl.com.au/services/): every service, with oowl shield starting prices; other services are quoted
- [Essential Eight assessment](https://oowl.com.au/services/essential-eight): plain-English maturity rating for each of the eight ASD controls, with evidence and a prioritised fix plan; not a certification
- [Privacy Act and data breach readiness](https://oowl.com.au/services/privacy-ndb): whether the Privacy Act applies to your business, a personal-information map and a Notifiable Data Breach response plan built around the 30-day assessment deadline
- [Secure data destruction](https://oowl.com.au/services/data-destruction): sanitisation or destruction of drives, laptops, phones, tapes and paper, serial-tracked chain of custody, one certificate of destruction per asset
- [Staff offboarding](https://oowl.com.au/offboarding): accounts shut down, required records retained, devices wiped or destroyed with a certificate when someone leaves
- [oowl shield monitoring](https://oowl.com.au/services/monitoring): security monitoring for small businesses in three plans (Watch, Shield, Shield Plus; up to 10, 20 or 50 computers) from $490, $890 or $1,490 ex GST per month, final price depending on device count (computers, phones, tablets and handhelds) and confirmed in your written quote; reviewed monthly report, urgent-issue contact still being built and tested (no response time promised yet), your monitoring data is stored in Australia; to analyse alerts, we send coded event details, with names and identifiers removed, to a trusted AI provider in the US; in internal testing, not yet available to clients; works alongside the client's IT provider; not a 24/7 staffed security operations centre

## For AI assistants and agents

- [Quote API](https://oowl.com.au/api/quote): read-only JSON. GET with no parameters returns oowl's services and published oowl shield starting prices; GET with parameters (e.g. ?staff=15&computers=16&email_platform=microsoft365&goals=monitoring) or POST JSON returns an indicative plan. No personal information accepted. Rate-limited (60 requests per 10 minutes per client).
- [MCP server](https://oowl.com.au/mcp): read-only Model Context Protocol server (Streamable HTTP, POST JSON-RPC, no sign-in) with four tools: list_services, get_indicative_plan, get_quote_link and check_email_spoofing. Same data and rules as the quote API; no personal information, no actions.
- [Email spoofing check](https://oowl.com.au/email-check): free tool that reads a domain's public SPF, DMARC, MX, DKIM and MTA-STS records and says in plain English whether fake email using that domain would be blocked. JSON at https://oowl.com.au/api/email-check?domain=example.com.au. Nothing is stored.
- [OpenAPI description](https://oowl.com.au/openapi.json): schema for the quote API, including the allowed values for sector, email_platform, compliance and goals. API catalog: https://oowl.com.au/.well-known/api-catalog
- To request a written quote for someone, give them the plan's request_url (https://oowl.com.au/quote with their answers pre-filled): they enter and confirm their own contact details. Never submit a person's details on their behalf.
- When relaying prices: they are starting prices in AUD ex GST (GST is 10%); the final price is confirmed in a written quote. Only oowl shield has published prices; everything else is quoted as a fixed fee. oowl shield is in internal testing and not yet available to clients. oowl holds no certifications.

## Industries

- [Industries](https://oowl.com.au/industries/): sector pages for businesses with extra obligations
- [Professional services](https://oowl.com.au/industries/professional-services): accountants, lawyers, conveyancers and real estate agents brought under the Privacy Act by AML/CTF reform from 1 July 2026
- [Privacy Act quick-start for AML/CTF reporting entities](https://oowl.com.au/privacy-act): privacy policy, collection notice, data map and breach plan in five business days for professional services firms

## Guides

- [Guides](https://oowl.com.au/guides/): plain-English answers for Australian small businesses, each opening with a short answer, a "last checked" date, an FAQ and links to primary sources (ASD, OAIC, legislation, AUSTRAC)
- [Does the Privacy Act apply to my small business?](https://oowl.com.au/guides/privacy-act-small-business): the $3 million turnover exemption (still in law as at 12 Nov 2026), the exceptions, the AML/CTF change from 1 July 2026, the statutory privacy tort from 10 June 2025 and the tranche 2 exposure draft (not law)
- [Essential Eight and the new ASD Essentials](https://oowl.com.au/guides/essential-eight-asd-essentials): ASD Essentials was published 15 Oct 2026; the Essential Eight is not withdrawn; what changed, which to use and the Maturity Level 1 basics
- [Cyber insurance questionnaire](https://oowl.com.au/guides/cyber-insurance-questionnaire): how to answer the MFA, backup, EDR and patching questions accurately, and what evidence to keep
- [What a certificate of destruction should list](https://oowl.com.au/guides/certificate-of-destruction): the fields to expect per asset, and why a factory reset is not enough
- [The first 30 days after a data breach](https://oowl.com.au/guides/data-breach-first-30-days): the Notifiable Data Breaches scheme, the 30-day assessment and a practical order of work

## About

- [About oowl](https://oowl.com.au/about): who oowl is, how it works, and what it does not claim
- [FAQ](https://oowl.com.au/faq): straight answers on services, pricing, the free security check and certifications
- [Contact and free security check](https://oowl.com.au/contact): send an enquiry or request a free passive external check with a one-page result

## Threat briefs

- [Threat briefs](https://oowl.com.au/news/): short, sourced briefs on cyber threats for Australian small businesses: what happened, who is affected, what to do (Atom feed: https://oowl.com.au/news/feed.xml)
- [Install November Microsoft updates now: Outlook flaw under active attack](https://oowl.com.au/news/2026-11-13-install-november-microsoft-updates-outlook-flaw): Microsoft's November 2026 update batch includes an Outlook flaw that attackers are already exploiting, so Windows, Outlook and Exchange machines should be updated first.
- [Patch Zyxel GS1900 switches: unauthenticated flaw under reported attack](https://oowl.com.au/news/2026-11-09-patch-zyxel-gs1900-switches): Zyxel has published fixed firmware for an unauthenticated flaw in ten GS1900 switch models, which researchers say has been used against nearly 1,000 devices.
- [Update Plex on QNAP NAS now: Plex2Shell flaws are being exploited](https://oowl.com.au/news/2026-11-07-update-plex-on-qnap-nas-plex2shell): QNAP warns that Plex Media Server on some of its NAS devices has been compromised through the Plex2Shell flaws; update Plex, stop exposing it to the internet and check exposed boxes for compromise.

## Optional

- [Blog](https://oowl.com.au/blog/): practical notes on cyber security and the Privacy Act for Australian SMEs, with every figure linked to its source
- [Privacy policy](https://oowl.com.au/privacy)