K2CT / Cybersecurity

Cybersecurity designed around your business.

Security works best when it fits the way your people actually work. K2CT designs, implements and manages practical security controls that protect your people, identities, devices, applications and business information — without making everyday work harder.

Review Your Cybersecurity See what's included

Layered protection, not a single product

Most incidents start with a compromised account, a malicious email or an unpatched device. Effective security combines controls across each layer: identities (who can sign in), devices (what they sign in from), email and applications (how threats arrive) and information (what needs protecting). K2CT aligns these controls to your risk, budget and Microsoft licensing.

Business problems

Security challenges we see in growing businesses

These gaps are common, and most can be addressed with tools businesses already pay for.

Passwords as the only defence

Accounts without multifactor authentication are the easiest route into a business.

Phishing and invoice fraud

Convincing emails trick staff into sharing credentials or changing payment details.

Alerts nobody reviews

Security tools generate warnings, but nobody is responsible for triaging them.

Unclear readiness

Customers, insurers or contracts ask about Essential Eight maturity and there's no clear answer.

Services

Cybersecurity services

Delivered as implementation projects, ongoing management or advisory, depending on your needs.

Microsoft Defender management

Configuration and management of supported Microsoft Defender capabilities for endpoints, email and identities, according to your licensing.

Microsoft Entra ID security

Hardening of your identity platform: admin role review, legacy authentication removal, sign-in risk policies and access reviews.

Multifactor authentication

Rollout of MFA across all users, using authenticator apps or phishing-resistant methods where appropriate.

Conditional Access

Policies that decide when access is allowed, based on user, device compliance, location and risk.

Endpoint protection

Antivirus, attack surface reduction, encryption and patching across supported devices.

Email threat protection

Anti-phishing, anti-spoofing, safe links and attachments, and SPF, DKIM and DMARC configuration.

Security monitoring and alert triage

Review of security alerts from your Microsoft environment, investigation of suspicious activity and escalation under agreed response responsibilities.

Vulnerability identification

Identification of missing patches, misconfigurations and exposed services, with a prioritised remediation plan.

Essential Eight readiness

Assessment against the ACSC Essential Eight strategies, current maturity and a practical roadmap to your target level.

Security awareness and governance

Staff awareness training, security policies and clear ownership of security decisions.

Incident response preparation

A documented response plan, key contacts and decision points, so your team knows what to do if something happens.

Good to know

Implementation, monitoring, advisory and certification are different things

Understanding the difference helps you buy the right service.

Security implementation

A project to configure controls such as MFA, Conditional Access or Defender. It has a defined start and finish.

Managed monitoring

Ongoing review of alerts and suspicious activity within agreed hours and response responsibilities, documented before services start.

Security advisory

Assessments, roadmaps and governance support that help leadership make informed security decisions.

Formal certification

Independent audit against a standard such as ISO 27001. K2CT can help you prepare, but certification is issued by an accredited third party.

Outcomes

What improves

Stronger account protection

MFA and Conditional Access across every user.

Fewer successful phishing attempts

Better filtering plus better-prepared staff.

Clear visibility

Someone responsible for reviewing security alerts.

Evidence for customers and insurers

Documented controls and Essential Eight maturity.

A prepared team

An agreed plan for responding to incidents.

Prioritised investment

Security spend directed at the biggest risks first.

Delivery

Our security approach

Step 01
Assess
Review identities, devices, email, licensing and current controls.
Step 02
Prioritise
Rank gaps by risk and effort, with quick wins identified.
Step 03
Implement
Deploy controls in stages with clear communication to staff.
Step 04
Manage and review
Ongoing management, alert triage and periodic reassessment.

Pricing

How cybersecurity is priced

Core security controls are included in managed packages. Assessments, Essential Eight programs and implementation projects are scoped and quoted separately.

Modern Workplace

$147 per user / month, ex GST

$147 per user per month, ex GST — includes Defender management, security operations monitoring and awareness training within scope.

View Modern Workplace

Secure Essentials

$32 per user / month, ex GST

$32 per user per month, ex GST — includes cyber awareness training alongside helpdesk support.

View Secure Essentials

• Microsoft licensing is additional and determines which Defender capabilities are available.
• Monitoring hours and response responsibilities are confirmed in your service agreement.

Compare all packages

FAQs

Cybersecurity questions

What cybersecurity services does a small business need?

At a minimum: multifactor authentication on every account, email threat protection, managed endpoint protection and patching, reliable backups, and staff awareness training. These address the most common attack paths. Businesses with contractual or regulatory obligations typically add Essential Eight alignment and security monitoring.

What is Microsoft Defender?

Microsoft Defender is Microsoft's family of security products. It includes Defender for Endpoint or Defender for Business (device protection), Defender for Office 365 (email and collaboration protection) and Defender for Identity. Which capabilities you have depends on your Microsoft licences.

What is the Essential Eight?

The Essential Eight is a set of eight mitigation strategies published by the Australian Cyber Security Centre (ACSC): application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting admin privileges, patching operating systems, multifactor authentication and regular backups. Each is assessed across maturity levels one to three.

Does Microsoft 365 include cybersecurity?

Microsoft 365 includes baseline security, and higher plans such as Business Premium add Defender, Intune and Conditional Access. However, these features need to be configured and managed — many tenants run with defaults that leave significant gaps.

What is managed security monitoring?

Managed security monitoring means a provider reviews security alerts and activity from your systems, investigates anything suspicious and acts or escalates according to agreed responsibilities. K2CT confirms monitoring hours, scope and response steps in writing before services begin.

How is cybersecurity priced?

Ongoing security management is included in K2CT managed packages, with Modern Workplace at $147 per user per month ex GST including Defender management and security monitoring. Assessments, Essential Eight programs and implementation projects are quoted based on scope.

Can security services be added to managed IT?

Yes. Security is built into K2CT managed packages, and additional services such as Essential Eight assessments, incident response planning or advisory can be added as projects or ongoing engagements.

Related services

Know where your security stands.

Tell us about your environment, any customer or insurer requirements, and your main concerns. We'll recommend practical first steps.

Review Your Cybersecurity