A$160
monthly run cost for the full monitored estate
Security monitoring and evidence retentionSecurity, AI and cloud for licensed firms.
I look after Microsoft, Azure and CRM estates for small Australian licensed firms, with the evidence auditors ask for.
- AFSL & ACL holders
- Government & public services
- Social welfare & community
- Not-for-profit
Two suppliers, and the gap between them
Most firms already pay for both of them. What goes wrong sits in the space between the two.
The compliance adviser
Produces the manual, the register and the policy set. Describes what the controls should be. Is not asked to implement any of it, and does not.
The IT provider
Keeps the systems running, patched and backed up, and generally does that job properly. Is not asked to produce evidence an auditor will accept, so does not.
Neither is asked to check that what the manual describes is what your estate actually does, or to keep the record that proves it. That is the gap, and it is the part I do. Where you have both already, I work alongside them and replace neither.
Security monitoring and alerting, as delivered
The architecture of a platform running today at a licensed firm. Where events go, how long each retention tier is kept, and which path stays up when the reporting layer does not.
The pipeline runs in one line: Defender XDR sends endpoint and identity events to an Event Hub, which passes them to a Function for processing, then to Log Analytics as the queryable store, and finally to Managed Grafana. Two paths branch off that line rather than continuing it. Urgent alerts leave the Function directly for Teams, and the evidence archive is written from Log Analytics to write-once locked storage.
Defender XDR
endpoint and identity
Event Hub
ingest
Function
event processing
Log Analytics
queryable store
32-day detail, 24-month rollup
Managed Grafana
two audiences
Urgent alerts
to Teams
seconds, independent of dashboards
Evidence archive
write-once, locked
7 years, 25 containers
Runs at roughly A$160 a month for the full monitored estate.
Where this has been done
0
stored deployment secrets after the change
Deployment without stored credentialsA$1,826A$340
monthly Azure run-rate, a reduction of about 81 per cent
Cloud cost reduction that funded the security work975
privileged directory role assignments on the primary administrative account
Privileged access and endpoint hardening3
artefacts delivered: guidelines, usage register, enforced policy
AI usage policy, register and enforcement13
policies added across the IT, cyber and privacy layer
Compliance manual and coverage mapOne engagement, an AFSL and ACL holder.
How we would work
Ongoing
Month to month
I manage the IT estate. Things that drift get caught before they matter, and when a client or an auditor asks you a question, the answer is already written down.
What a month actually contains
Every month
A written pass over the things that drift. Administrative access checked against what people need today, and stale grants removed. Alerts triaged before they pile up. Configuration checked against the documented standard. Posture and cloud spend reported. You get all of it in writing, so the report is also the evidence.
As things arrive
Client security questionnaires answered from the configuration itself, since a manual and an estate drift apart over time. Changes made properly, and documented as they are made. Someone to ask before you act.
Terms
Month to month. Every change documented with a reverse command and a reason, so you can hand the estate to anyone, including in the month you decide to stop. Cost depends on the size of the estate and is a conversation before either of us commits to anything.
Not included: general helpdesk. Where you already have an IT provider I work with them, not around them. Where you do not, that is a separate conversation.
A defined piece of work
Scoped up front
An identity clean-up, a monitoring system stood up, a policy set written and enforced, a migration. Fixed scope agreed before it starts, and documented so your next provider can pick it up.
How a scoped engagement runs
Before it starts
A short look at what is actually configured, so the scope is written against your estate and not against assumptions about it. You get the scope in writing, with what is in it and what is not.
While it runs
Documented as it goes. Nothing is reconstructed at the end. A reverse command and a reason against every change, so you can see what happened for yourself.
Terms
The scope is fixed at the point it is agreed. If something turns up that changes the shape of the work, that is a conversation before it becomes work, not a surprise on an invoice. Handover documentation is included in the price.
Worth knowing: the review below is usually the cheapest way to find out whether a piece of work is the right size, and it is not wasted if you decide to go ahead.
A review
Short
Where you stand, as opposed to where the paperwork says you stand. You get the findings and what I would do about each, in order, with no obligation to have me do any of it.
What a review involves
What I look at
The configuration itself. Administrative access, logging and its retention, device compliance, multi-factor coverage, backup. Where a questionnaire or an audit prompted this, I work from that document, since it has already named what matters.
What you get
The findings, what I would do about each, in what order, and roughly what each involves. Written so you could hand it to somebody else and they could act on it.
Terms
No obligation to have me do any of it. If you are in reasonable shape and the questionnaire is the only real problem, I will tell you so.
Most ongoing arrangements start here. It is the cheapest way for both of us to find out whether the fit is right.
Reasons people get in touch
Nobody owns this
The estate works, more or less, and nobody is responsible for it. Perhaps a provider changed, or the person who knew it left. Nothing looks wrong from the outside.
A client has asked you to prove something
A security questionnaire arrived, there is a contract behind it, and the answers are not to hand.
An audit or attestation is coming
The manual describes the controls. Producing evidence anyone implemented them is a separate job that has never been done.
Your staff are using AI tools
Client data is going somewhere. There is no register of what is in use and nothing technically stopping any of it.
Get in touch
A sentence or two about where you are is enough to start. If there is a deadline it helps to know it. If there is not, the work is far easier to do before one exists.
If I am not the right fit for what you need, I will say so and point you towards someone who is.
Where somebody already handles your IT, I would sooner work with them than pitch against them. On most engagements they implement part of the answer, and that goes better when they are brought in early. Where nobody does, I can pick that up as well.Recent work if you want the detail first.