NIST’s 2025 guidelines dropped complexity rules: length beats symbols. A 2011 stick-figure comic was right all along - most password policies still aren’t.
In June 2026 the same 150 Australian small-business sites medianed A+ on technical SEO and F on security. The difference is what was on the launch checklist.
ASD is retiring the Essential Eight, quietly admitting it was built for a world we have left. A founder’s take: do not wait for the replacement — and do not assume it fits small business.
We scanned 450 domains Australians rely on. Enterprise and government medianed an F on web security - same grade as small business. Budget didn’t buy basics.
A clean penetration test report often proves the scope was wrong, not the business safe. With AU tests running $5k-$40k and the average breach now AUD $4.26M, here’s what to ask before you trust the result.
Most small business security advice is a shrunk-down enterprise plan built for staff you don’t employ. The ASD puts small-business cybercrime at $56,571 a year. Here’s the index-card version that actually fits.
PwC’s 2025 Digital Trust survey is solid for the ASX 200 and wrong for the corner clinic. Four findings that don’t translate to Australian small business, and the honest version that does.
Australia’s big cyber consultancies sell a $40k-a-year product that 95% of small businesses cannot buy. Here is the market gap I left a consulting career to fill, and the numbers behind it.
