Cyber security in Melbourne for SMBs: which services you need, what they cost (scanning from $149/month) and who watches your systems at 2am. Free review.
Key IT provides cyber security in Melbourne for small and mid-sized businesses from its Greensborough office: free security reviews, Essential Eight assessments, vulnerability scanning from $149 a month, penetration testing, phishing simulation, incident response and Key IT's 24/7 SOC service. Every engineer is security-certified, and you can buy a single project or an ongoing managed service, billed month to month and never tied to a lock-in contract.
Nearly every small or mid-sized business needs IT security services that run all the time (MFA, patching, backups, monitoring), plus one-off checks when something triggers them, such as an insurance renewal, a tender or a breach scare. The table below shows which is which, and our cyber security glossary explains any unfamiliar term.
| Service | One-off or ongoing | Typical trigger | Where to start |
|---|---|---|---|
| Free IT & Cyber Security Review | One-off, free | You are unsure where you stand, or weighing up a new provider | Book a review |
| Essential Eight assessment | One-off assessment, then ongoing uplift | An insurer, tender or larger client asks for your maturity level | Essential 8 compliance |
| Vulnerability scanning (from $149/month) | Ongoing, monthly | You need to know what is exposed and prove you patch it | Vulnerability scanning |
| Penetration testing | One-off, repeated after big changes | A new web app or portal, or a client wants independent proof | Penetration testing |
| Key IT's 24/7 SOC service | Ongoing | Security alerts fire overnight and nobody reads them | 24/7 SOC monitoring |
| Incident response | One-off, when it happens | A ransom note, a hijacked mailbox or a misdirected payment | Cyber incident response |
| Phishing simulation | Free demo, then ongoing training | Staff pay invoices or handle client money | Phishing simulation demo |
| Dark web scan | One-off and free, worth repeating | A site your staff use announces a breach | Free dark web scan |
| Email security | Ongoing | Spoofed invoices, or your own emails landing in clients' junk folders | Email security |
A one-off project answers a question at a single point in time: what is our Essential Eight maturity, or could a tester get in? Managed security answers a different one: who keeps every control working next month, after staff change and fresh vulnerabilities are published?
Projects suit businesses with capable IT that want an outside check. Ongoing managed cybersecurity suits businesses where security is nobody's actual job: Key IT's engineers run patching, MFA, email filtering, backups and scanning, Key IT's 24/7 SOC service looks out for attacks day and night, and you get Essential Eight reporting. The managed service runs month to month, so starting with a project is a sensible path.
The best public figures come from the Australian Signals Directorate (ASD). Its Annual Cyber Threat Report 2024–25 counted over 84,700 cybercrime reports, an average of one every six minutes, and the average self-reported cost rose for every business size:
| Business size | Average self-reported cost per cybercrime report | Change on the previous year |
|---|---|---|
| Small | $56,600 | Up 14% |
| Medium | $97,200 | Up 55% |
| Large | $202,700 | Up 219% |
Because these are self-reported averages, they can miss slower costs such as a lost client. We break down where a small business's $56,600 actually goes.
There is no honest single price: security is priced on what must be protected and proven. The main cost drivers:
Ongoing security is usually charged per user or device.
Servers, Azure workloads and extra Microsoft 365 tenants add monitoring and backup.
Essential Eight reporting for an insurer, tender or regulator adds documentation.
Testing one website is a much smaller job than external, internal and wireless testing together.
Round-the-clock SOC monitoring costs more to deliver than business-hours alerting, so check which one a quote includes.
Key IT publishes one security price: vulnerability scanning from $149 a month, depending on locations and endpoints. Everything else is quoted after a free review. For context, Melbourne managed IT typically runs around $100 to $200 a user each month, varying with how much security is included (a market range, not a Key IT quote).
Here is our plain answer:
That gives a 20-person firm round-the-clock detection without paying for a night shift. To see how the tools fit together, read EDR vs MDR vs XDR vs SIEM vs SOC.
Since 30 May 2025, if your business has annual turnover above $3 million (or is responsible for critical infrastructure) and pays a ransomware or cyber extortion demand, you have 72 hours from the payment, or from finding out one was made for you, to report it to ASD. Non-cash benefits count as payment, according to the Home Affairs factsheet. See how the 72-hour ransomware report works.
Businesses with annual turnover over $3 million fall under the Privacy Act, and so do some smaller ones, health service providers among them. Where a breach is likely to seriously harm anyone, the affected individuals and the OAIC must be notified. A suspected breach has to be assessed quickly, too: the law expects all reasonable steps to finish that assessment within 30 calendar days.
The Essential Eight is not law for most private businesses, but insurers, tenders and larger clients ask for evidence of it. On 15 October 2026 ASD released ASD Essentials, a principles-based framework that will replace it. The Essential Eight stays on ASD's website for a transitional period of one to two years, and no date has been set for the new framework to become mandatory (iTnews). Existing maturity counts towards the new framework, but ASD advises checking controls rather than assuming they are equivalent; see what ASD Essentials changes.
Hiring a cyber security consultant or a managed provider? Skip the ranked lists; the government has already written the questions. The ACSC's Questions to ask managed service providers covers five areas, and we add two of our own:
Does the provider apply the Essential Eight to its own systems, not just yours?
How does it protect its admin and remote access into your systems?
Does it log and watch activity on its own systems?
How often does it test itself for vulnerabilities?
Is it prepared to respond to an incident, and who does what?
Who watches your systems overnight and at weekends, and when is the helpdesk actually staffed?
Is there a lock-in contract, and do you get every admin login back if you go?
Good providers answer all seven in writing. Weighing an IT provider against a security specialist? Read MSP vs MSSP.
Begin with the government's Cyber Health Check, a free and anonymous self-assessment of about five minutes for small businesses, not-for-profits and individuals, which finishes with an action plan. Then book a free 30-minute cybersecurity health check with Key IT, where our team scores you against the Essential Eight, names your three biggest risks and ranks the fixes. Prefer to self-serve? Try the Essential 8 self-assessment.
It depends on users, devices, servers, the compliance evidence you need and how much testing is in scope. Key IT's one published security price is vulnerability scanning from $149 a month. Managed security and one-off projects are quoted once a free IT & Cyber Security Review has mapped what you have, so the scope is clear before you commit.
Yes. According to ASD's 2024–25 Annual Cyber Threat Report, small businesses reported an average cybercrime cost of $56,600 per report. Much of today's attack activity is automated: scanners and phishing kits hunt for weak passwords and unpatched systems without caring how big the company is. A small business does not need everything on the menu, but it does need MFA, patching, tested backups, email filtering and someone watching for alerts.
Antivirus is software on each device that blocks known malicious files. A Security Operations Centre combines people and tooling to watch devices, Microsoft 365, email and cloud for behaviour that looks like an attack, such as a sign-in from an unusual country or a new forwarding rule. Antivirus never sees a stolen password being used; a SOC is built to.
Ring 1300 053 948 and say it is a security incident; Key IT helps first-time callers as well as clients. Disconnect affected machines from the network, but do not switch them off or wipe them. The work then runs in order: contain the attack, find out what was accessed, recover from clean backups, and handle any data breach notification or 72-hour ransom payment report.
Yes. Scanning, SOC monitoring and most security work are delivered remotely, which lets Key IT look after firms in regional Victoria and interstate as well as our home ground of north-east Melbourne and the CBD. Onsite work centres on Melbourne. See how remote IT support works.
Greensborough is home, but our engineers support businesses right across Melbourne. A few of the areas we work in:
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.