Notes from the audits
Email security, without the vendor noise
What we actually find inside Australian Microsoft 365 and Google Workspace tenants, and what the rules around them require of you.
Email security11 September 2026 · 5 min readBoost Microsoft 365 Email Security - External Sender Warning
Learn how to add an external sender warning banner to inbound emails in Microsoft 365, protecting your Australian small business from phishing and business email compromise.
Read the article →
Google Workspace10 September 2026 · 5 min readGoogle Workspace API controls: Restrict third-party app access in Australia
Learn how to restrict third-party app access in Google Workspace, boosting your organisation's security and preventing data breaches. Neil Frick explains the why and how.
Read the article →
Microsoft 3658 September 2026 · 5 min readRestrict Third-Party OAuth App Consent in Entra ID for Microsoft 365 Security
Learn how to secure your Microsoft 365 environment by restricting user consent to third-party OAuth apps in Entra ID, preventing unauthorised access and data breaches.
Read the article →
Google Workspace7 September 2026 · 5 min readBlock Automatic Email Forwarding in Google Workspace for Small Business
Learn how to block automatic email forwarding to external addresses in Google Workspace, a critical security setting for Australian small and medium businesses.
Read the article →
Email security6 September 2026 · 5 min readBoost Microsoft 365 Email Security: Safe Links and Attachments for SMB
Learn how to turn on Safe Links and Safe Attachments in Microsoft 365 to protect your Australian small business from phishing and malware. Neil Frick explains the steps.
Read the article →
Google Workspace2 September 2026 · 5 min readGoogle Workspace Security Audit: Turn off IMAP and POP access
Secure your Google Workspace email by disabling IMAP and POP access. This simple setting change significantly reduces your attack surface and protects against unauthorised access.
Read the article →
Microsoft 3652 September 2026 · 5 min readEnable Microsoft 365 Audit Logging for Australian Businesses
Learn why enabling Microsoft 365 audit logging is crucial for investigating breaches and complying with data regulations. Neil Frick (CISSP) provides practical steps.
Read the article →
Microsoft 3651 September 2026 · 6 min readBoost Microsoft 365 Security: Turn on Multi-Factor Authentication
Learn why enabling multi-factor authentication for all Microsoft 365 users is crucial for Australian small businesses and how to set it up.
Read the article →
Google Workspace26 August 2026 · 6 min readBoost Email Security: Google Vault Retention for Australian SMBs
Learn why Google Vault retention is crucial for Australian small and medium businesses. We'll show you how to set it up to investigate deleted emails and meet compliance.
Read the article →
Google Workspace26 August 2026 · 5 min readGoogle Vault Retention: Keeping Deleted Mail for Australian Businesses
Learn how to turn on Google Vault retention to keep deleted emails discoverable for investigations, crucial for compliance and security in Australian small businesses.
Read the article →
Email security20 August 2026 · 5 min readMicrosoft 365 Security Audit for Small Business: Alert on New Inbox Forwarding Rules
Learn how to set up an alert policy in Microsoft 365 that notifies you immediately when new inbox forwarding rules are created, protecting your business from email compromise.
Read the article →
Email security20 August 2026 · 6 min readGmail External Recipient Warnings
Learn how to turn on Gmail external recipient warning banners in Google Workspace to protect your business from email scams and data breaches. Neil Frick explains the steps.
Read the article →
Email security18 August 2026 · 5 min readBoost Google Workspace Email Security: Set Up DMARC Quarantine
Learn how to secure your Google Workspace email by setting up DMARC quarantine. Protect against spoofing and phishing with our step-by-step guide for Australian small businesses.
Read the article →
Google Workspace17 August 2026 · 5 min readGoogle Workspace Super Admin Security: Require Keys for Admins
Secure your Google Workspace with hardware security keys or passkeys for super admins. This tip prevents account takeovers and protects your critical business data.
Read the article →
Microsoft 36517 August 2026 · 5 min readMicrosoft 365 Security Audit for Small Business: Dedicated Admin Accounts
Secure your Microsoft 365 environment by requiring administrators to use separate, privileged accounts. This simple change reduces your risk of cyber attacks.
Read the article →
Microsoft 36513 August 2026 · 6 min readClosing Microsoft 365 Security Gaps for Australian Small Businesses
Many Australian small businesses overlook critical Conditional Access settings in Microsoft 365, leaving them vulnerable to cyber threats. Learn what to check.
Read the article →
Microsoft 36512 August 2026 · 5 min readBoost Your Security: Microsoft 365 security audit for small business
Learn why separating admin accounts from daily-driver logins is crucial for your Australian small business's cyber security. Protect your Microsoft 365 and Google Workspace.
Read the article →
Microsoft 36511 August 2026 · 6 min readLegacy Authentication: Biggest Microsoft 365 Security Audit for Small Business Risk
Legacy authentication poses the most significant threat to Microsoft 365 security for Australian small businesses. It bypasses modern security, leaving your accounts vulnerable.
Read the article →
Email security10 August 2026 · 6 min readEssential Microsoft 365 security settings for Australian small businesses
Turn on these Microsoft Defender for Office 365 settings today to protect your Australian small business from email threats like phishing and Business Email Compromise.
Read the article →
Microsoft 3659 August 2026 · 6 min readMicrosoft Intune device compliance basics for Australian SMBs
Understand Microsoft Intune device compliance basics for a 20-person business. Keep your devices secure and meet Essential Eight standards without overcomplicating things.
Read the article →
Compliance6 August 2026 · 5 min readCyber insurance renewals: essential security for Australian small business
Cyber insurance is getting tougher to renew for Australian small businesses. Insurers now demand solid evidence of robust cybersecurity practices before issuing policies.
Read the article →
Compliance5 August 2026 · 6 min readNotifiable Data Breaches: What Your SMB Must Do in the First 72 Hours
When a data breach hits your Australian small to medium business, the clock starts ticking. Understand your legal obligations and what to do within the first 72 hours under the Notifiable Data Breaches scheme.
Read the article →
Google Workspace4 August 2026 · 6 min readGoogle Workspace Security Audit for Small Business: Sharing Risks
Google Workspace sharing settings can quietly expose client files, creating significant risks for Australian small and medium businesses. Understand how to secure your data.
Read the article →
Email security3 August 2026 · 6 min readEmail Security Protocols: SPF, DKIM, and DMARC for Australian Small Business
Understand how SPF, DKIM, and DMARC protect your Australian small business from email impersonation, scams, and phishing. Essential for email security and trust.
Read the article →
Microsoft 3652 August 2026 · 5 min readStop Shadow IT: Microsoft 365 Security Audit for Small Business
Shadow IT, especially uncontrolled OAuth app consent, can silently expose your Microsoft 365 data. Learn how to protect your Australian small business from these hidden risks.
Read the article →
Microsoft 3652 August 2026 · 5 min readMicrosoft 365 security audit for small business: Shadow IT risks
Shadow IT in Microsoft 365, particularly through OAuth app consent, can leak sensitive data. We explain how this happens and what you can do to protect your Australian small business.
Read the article →
Email security31 July 2026 · 6 min readWhy MFA isn't enough to stop business email compromise in Australia
Multi-Factor Authentication (MFA) is crucial but no longer a complete defence against sophisticated business email compromise (BEC). Learn why and how Australian SMBs can strengthen their email security.
Read the article →
Microsoft 36529 July 2026 · 5 min readWhy Separate Admin Account Security is Critical for Your Business
Learn why separating your daily login from your privileged admin access is vital for enhanced security, reducing cyber risks for your Australian business.
Read the article →
Microsoft 36529 July 2026 · 6 min readWhy Legacy Authentication is the Biggest Microsoft 365 Security Risk
Legacy authentication poses the biggest threat to Microsoft 365 security for small businesses, making it easier for cybercriminals to breach your systems. Learn why and how to fix it.
Read the article →
Microsoft 36529 July 2026 · 5 min readBoost your cyber security: Admin accounts and privileged access
Learn why separating daily login accounts from powerful admin accounts is a critical step for Australian small and medium businesses to boost their cyber security.
Read the article →
Microsoft 36528 July 2026 · 5 min readLegacy Authentication: Still Microsoft 365's Biggest Risk
Despite advancements, legacy authentication remains a critical vulnerability for Microsoft 365 users, leaving businesses ripe for account compromise. Understand why and how to fix it.
Read the article →
Insurance9 July 2026 · 5 min readAnswering the cyber insurance questionnaire honestly
Insurers now ask specific, checkable questions about your email tenant. Guessing at the answers is how claims get reduced.
Read the article →
Healthcare2 July 2026 · 6 min readNotifiable data breaches: what an Australian practice must do in 30 days
Health service providers are covered by the Privacy Act regardless of turnover. Here's what the NDB scheme requires when a mailbox is compromised.
Read the article →
Compliance25 June 2026 · 7 min readThe Essential Eight, translated for a 20-person Australian business
The ACSC's Essential Eight was written for government agencies. Here's what Maturity Level One honestly means when you're a 20-person firm running Microsoft 365.
Read the article →
Google Workspace18 June 2026 · 6 min readWhat a Google Workspace security audit actually checks
Beyond 'turn on 2FA' — the twelve settings that decide whether a mailbox compromise stays contained or turns into a payment-redirection claim.
Read the article →