Cyber Risk Health Check
Find your biggest cyber risks and what to fix first.
A practical, fixed-scope cybersecurity assessment for SMEs, with a plain-English report and prioritised remediation roadmap.
Starting from $495
The $495 starting package
A clear first step for small Microsoft 365 environments.
Up to 10 staff
Designed for one Australian organisation and one Microsoft 365 tenant.
Five business days
Expected turnaround after the agreed information and access have been received.
Delivered remotely
The assessment, evidence review and findings walkthrough are completed remotely.
60–90 minutes
Typical total client time for the questionnaire, clarification and findings discussion.
Replace assumptions with evidence
Security gaps are often invisible until they cause disruption.
Antivirus, backups and MFA are important, but they do not automatically mean the whole business is protected. The Health Check examines how your controls work together, explains the business impact of gaps and identifies the improvements that matter most.
Hidden exposure
Former-user access, excessive privileges and inconsistent MFA can remain unnoticed.
Untested recovery
A backup is only useful when its coverage, protection and recovery process are understood.
Unclear priorities
A long list of technical recommendations is not a practical improvement plan.
Assessment scope
A structured review of the controls that protect your operations.
The exact scope is confirmed before the assessment begins and may include the following areas.
Identity and access
User accounts, administrator privileges, MFA coverage and account-management practices.
Microsoft 365 and cloud
Relevant security settings, access controls and common cloud configuration risks.
Devices and patching
Endpoint protection, supported software, patching practices and device-management controls.
Backup and recovery
Backup coverage, protection, recovery responsibilities and testing practices.
Policies and incidents
Security responsibilities, essential policies and readiness to respond to an incident.
Essential Eight alignment
Practical observations against relevant Essential Eight mitigation areas. This is not a formal certification.
What you receive
Clear findings you can act on.
The assessment is designed for business decisions, not to overwhelm you with technical jargon.
Executive summary
A concise, non-technical overview of your current risk position.
Risk register
Identified gaps described with severity and potential business impact.
Immediate quick wins
Practical actions that may reduce risk without a major project.
Prioritised roadmap
Recommended next steps ordered by urgency, value and dependency.
Findings review
A guided discussion of the report, priorities and questions.
Implementation options
Act internally, work with your existing IT provider or request a separate fixed quote.
How it works
A defined path from questions to priorities.
Scope
Complete a short questionnaire so we can confirm fit, requirements and price.
Review
Provide the agreed information and access needed for the assessment.
Report
Receive a practical report explaining risks and recommended priorities.
Roadmap
Review the findings and decide how each improvement will be delivered.
Pricing and boundaries
Starting from $495, with scope confirmed first.
The starting package is intended for smaller, straightforward environments. Final pricing depends on factors such as team size, number of systems, cloud platforms and assessment complexity.
Before work begins, we confirm:
- Systems and business areas included
- Information or access required
- Deliverables and review format
- Expected assessment schedule
- The fixed price for your agreed scope
Remediation and implementation are not automatically included. Any additional work is agreed and quoted separately.
Who it’s for
Built for SMEs that want practical risk visibility.
This service is particularly useful if you use Microsoft 365, handle customer or employee information, are preparing for cyber insurance, rely on an external IT provider or have not completed a structured security review recently.
Business owners
Understand the risks and priorities without needing specialist cybersecurity knowledge.
Growing teams
Check whether security controls have kept pace with new people, systems and suppliers.
Regulated or trusted services
Strengthen evidence for customer expectations, insurance discussions and internal governance.
Frequently asked questions
What to know before you begin.
Is this a penetration test?
No. This is a structured review of your security posture and practices. Specialist penetration testing, vulnerability scanning or certification work requires a separately defined scope.
Will you need administrator access?
Access requirements depend on the agreed scope. We confirm what is needed before the assessment and use the minimum practical level of access.
How long does the assessment take?
The schedule depends on the size and complexity of your environment. Your expected timeline is confirmed with the fixed scope before work begins.
Is remediation included?
No. The Health Check identifies and prioritises improvements. You can implement them internally, use your existing provider or request a separate fixed quote from CyberCrunch.
Can you work with our current IT provider?
Yes. With your approval, we can explain findings and priorities so your existing provider can assist with remediation.
Does this certify Essential Eight compliance?
No. The review may identify observations relevant to the Essential Eight, but it is not a formal certification or guarantee of compliance.
How is our information handled?
Information requirements and handling expectations are agreed during scoping. Only information relevant to the assessment should be provided.
Sample report contents
See what your Health Check report covers.
- Executive summary and overall risk position
- Assessment scope, assumptions and limitations
- Identity, administrator access and MFA findings
- Microsoft 365 and email-security observations
- Device, patching and endpoint-protection observations
- Backup coverage and recovery-readiness findings
- Incident-response and policy observations
- Prioritised risk register
- Immediate quick wins
- 30-, 60- and 90-day remediation roadmap
The final report reflects the systems and evidence included in your confirmed scope. Sensitive client information is not displayed in public examples.
Continue learning
Useful guidance before your assessment.
Explore these plain-English resources for more context on common risks and controls.
Check eligibility
Find out whether the $495 starting package fits.
Complete the short form below. If the starting package fits, CyberCrunch will confirm the next step. If your environment needs a larger scope, you will receive a clear fixed quote before deciding.