assess --read-only --evidence-required
Show them how secure you actually are. With evidence, not a form you filled in yourself.
When an insurer, a client or a tender panel asks how secure you are, answering it yourself carries less weight than someone independent answering it for you. We review your controls, evidence every finding, and give you the documents to hand over, at a fixed price, with the scope written down before we start.
No obligation, no pitch deck. Twenty minutes to work out whether this is even the right thing for you.
Where to start
“Someone is asking us to prove we’re secure.”
An insurance renewal, a vendor assessment, a tender question set. You need an independent answer with evidence behind it, and you need it in writing.
Readiness Check → Door 2“Nobody here actually owns this.”
You need a security function but cannot justify hiring one. Someone to hold the risk register, make the calls and tell you what matters this month.
Micro-vCISO Retainer → Door 3“Something has already happened.”
A payment went to the wrong account, a mailbox is behaving strangely, or you have been locked out of something. Start here rather than with a form.
Get in touch now →The problem, in numbers
This is what it cost Australian businesses last year.
The average cost a small business reported to the ASD after a cyber incident last year, up 14%.
How often a cybercrime report reached the ASD in 2024-25. That is more than 84,700 reports in a year.
The share of incidents the ASD responded to that involved ransomware.
Where those reports came from
Of the 84,700+ cybercrime reports made to ReportCyber in FY2024-25, this is the share from each state and territory.
reports so far today, at the published rate of one every 6 minutes
That figure is arithmetic, not a feed. It is the ASD's published annual rate carried forward from midnight in your own time zone. Nobody is reporting anything to us, and the real number for today is not knowable until ASD publishes next year.
- under 5%
- 5 to 9%
- 10 to 19%
- 20% and over
A schematic arrangement, not a map to scale. Drawn as real geography the Northern Territory would take a sixth of the picture for 1% of the reports and the ACT would be too small to see, so every jurisdiction gets the same tile and the number does the work.
These are reports that were made, not attacks that happened. Most incidents are never reported to anyone. Read it as where reporting happens, which tracks population more than it tracks risk, and not as a ranking of which state is most exposed.
Nothing here comes from IN-SEC. We run no sensors and hold no telemetry, and a map fed by nothing is decoration. This one is published government data, named and dated below.
What we do
Four pieces of work. Each one has a price and an end date.
Fixed scope and a published boundary on every engagement. You know what you are buying before you buy it, and you know what it does not cover. Every number is on the pricing page, including what changes it.
Readiness Check
An independent review of your security controls, producing evidence you can hand to an insurer, a tender panel or a customer running a vendor assessment.
$2,950 fixed price
Evidence Pack
Takes a completed assessment and assembles the artefact set needed to answer one specific insurer or customer questionnaire.
$2,950 fixed price
Micro-vCISO Retainer
A security function for a business that needs one but cannot justify a hire.
From $1,500 per month
Tabletop Simulation
A facilitated walk-through of a real incident, to find out who freezes, who does not know the number, and whether the backup actually restores.
$1,400 per exercise
Prices in Australian dollars. IN-SEC is not registered for GST, so no GST is added and your invoice will state that none was included. Every price on this site is the price.
What you get
Five documents, and you keep all of them.
The work produces artefacts, not a conversation. Everything below is yours to forward to an insurer, a board, or a client running a vendor assessment.
-
Executive summary
One page, written for an owner or a board. The version you forward without having to explain it first.
-
Readiness report
Every control assessed against the ASD Essential Eight, with the evidence for each finding attached. A finding without evidence is an opinion.
-
Prioritised remediation plan
Phased, with effort estimates, so you can decide what to do this month and what waits until next quarter.
-
Risk matrix
Likelihood against impact, in language a non-technical director can act on.
-
Published scope boundary
Written down before we start and included in the report, so nobody has to guess what was and was not covered.
Where this sits
There are four ways to answer that questionnaire.
Three of them are legitimate choices depending on what you need. Here is the honest version, including where we are not the right answer.
| Option | Example price | Who reviews it | Independent |
|---|---|---|---|
| Self-serve questionnaire Several Australian tools give the assessment away and charge for the report. Useful for orientation. It is still a self-assessment, which is the thing an insurer is asking you to go beyond. | $0 to $499 | Nobody. You answer, a tool scores it. | No |
| Your IT provider They know your environment, which helps. They also quote the remediation, which means the person finding the problems is the person selling the fix. | from $2,500 | Your MSP | No |
| IN-SEC Readiness Check Fixed price, published scope, every finding evidenced. We do not sell the remediation, so we have nothing riding on what we find. | $2,950 | A person, independently | Yes |
| Enterprise consultancy Thorough, and built for organisations several times your size. The higher tier usually bundles the uplift work, which puts it in the same position as your IT provider. | $8,500 to $18,000 | A team | No |
Prices are what each tier publishes, checked in September 2026. They are asking prices rather than what anyone actually paid, and they move. If a free tool is enough for what you need, use the free tool.
Scope boundary
What this is not.
This is not a penetration test. It is not a SOC 2 audit. It is not an incident response retainer. It is a fixed-scope assessment of how your business would hold up against ransomware and business email compromise, measured against the ASD Essential Eight, with a prioritised plan to close the gaps.
Out of scope, always: no live testing, no simulated phishing against your staff without separate written authorisation, and no red-team activity of any kind.
How we work
Four steps, and you see the scope before step one.
-
01
Scope and authorise
We agree exactly what is in scope and what is not, in writing. Nothing is touched until that authorisation is signed. This applies to every engagement, without exception.
-
02
Assess, read-only
We review your controls against the ASD Essential Eight. Read-only means we change nothing in your environment while we look. Every finding is evidenced. A finding without evidence is just an opinion.
-
03
Report in two registers
A one-page executive summary written for an owner or a board, and a full readiness report with every control assessed and a risk matrix that states likelihood against impact in plain language.
-
04
Prioritise the fixes
A phased remediation plan with effort estimates, so you can decide what to do this month and what can wait until next quarter.
Assessments are aligned to the ASD Essential Eight (current model). NIST CSF 2.0, CIS Controls v8 and MITRE ATT&CK sit underneath that as the engineering detail. Alignment describes the model we follow. It is not a certification, and we do not claim one.
Why IN-SEC
Four things we do differently.
We don’t quote the remediation
An IT provider who assesses your security usually also quotes the work to fix it. We do not bid on the remediation we recommend, so nothing we find is worth money to us. That is the whole product: an answer with no commercial interest attached.
The price is on the website
You can see what this costs before you speak to anyone. No scoping call that turns into a proposal that turns into a number you were not expecting.
You talk to the person doing the work
There is no account manager and no handover to a delivery team. The person on the call is the person who writes the report. Who that is, and the five rules the work runs on.
Built for your size
Enterprise security programs do not scale down, they just get expensive. This is shaped for an Australian business with twenty to a hundred and fifty staff.
Before you ask
The six questions that come up every time.
How is this different from the free online checklists?
A free tool scores the answers you give it. That is a self-assessment, and a self-assessment is usually the exact thing your insurer or your client is asking you to go beyond. Here a person looks at how your systems are actually configured and writes down the evidence for each finding.
If you have not done one yet, start with a free tool anyway. Orienting yourself before you spend money is a sensible first move.
Do you fix the problems you find?
No. Your IT provider does, or you take the plan to whoever you choose. That is deliberate rather than a limitation.
An assessor who also quotes the remediation has something riding on what they find, and from the outside you have no way of telling the difference between a real finding and a billable one.
Will this satisfy my insurer?
We cannot promise that, and anyone who does is guessing. The insurer decides, and different insurers ask for different things.
What we can do is give you evidenced answers to the questions insurers and client questionnaires ask, in a form you can hand straight over instead of assembling it yourself the week it is due.
What access do you need to our systems?
Read-only, and only after you have signed a scope and authorisation letter setting out exactly what is in and what is out. Nothing in your environment is changed while we look. That applies to every engagement without exception.
What happens if you find something serious?
You hear about it immediately, not when the report lands. Findings are about systems rather than people. If a gap exists because nobody was given the time or the budget to close it, that is what the report says.
We already have an IT provider. Does this step on their toes?
It should not. We do not sell managed IT and we are not auditing their work. In practice a prioritised list is useful to them. It is usually easier to get budget approved for something when the request did not come from the people who would be paid to do it.
Find out where you actually stand.
Twenty minutes on a call. We will tell you which of these is the right piece of work, or that none of them is. Both answers are useful.
Prefer to write? enquiries@in-sec.org