Cyber Security
One team for your endpoint, email, Microsoft 365 and firewall security, connecting what each one sees and telling you what needs a decision.
Starting from $79 ex GST per user per month
In short
Managed security means a specialist team runs your security tools: endpoint detection and response, email security, Microsoft 365 monitoring and firewalls, with vulnerability scanning, staff training and incident response planning as add-ons. Catharsis Cyber Security, an ISO/IEC 27001:2022 certified company in Sydney, acts as your outsourced security team, with coverage and response targets agreed in a written service level agreement.
01Who it's for
It suits organisations that need good security but can't justify a full-time security team. Security tools don't protect you on their own: someone has to tune them and act on what they find.
02What's included
Detect & respond
We deploy, tune and monitor endpoint detection and response (EDR) on your laptops, desktops and servers. Our team triages alerts and contains confirmed threats, for example by isolating an affected device from the network.
We watch for risky sign-ins, new mailbox forwarding rules and admin changes in your Microsoft 365 tenant, the early signs that an account has been taken over.
Prevent
We manage filtering for phishing, malware and impersonation, and look after the SPF, DKIM and DMARC records (email authentication records) for your domains. Suspicious messages your staff report are reviewed and removed from other mailboxes where needed.
We check that security updates for your devices and servers are applied, and track overdue fixes with your IT team or provider until they are closed.
We review, configure and maintain your firewalls and VPN, including rule reviews, firmware updates and web filtering. You keep control of the traffic entering and leaving your network, with changes documented.
Report & review
Plain-English reports covering threats stopped, open risks and progress against your chosen framework, followed by a review meeting where we agree the next priorities with you.
Add-ons, quoted separately
Scheduled scans of your devices, servers and internet-facing systems, ranked by risk rather than raw severity. We track fixes with your IT team or provider and check them in a follow-up scan.
Short training modules and regular phishing simulations for your staff, with results reported by team. You can see who needs more support and whether reporting of suspicious emails is improving.
We help you write and rehearse an incident response plan that sets out who does what to identify, contain, eradicate and recover from an incident, and how you learn from it afterwards.
03Related work
Real engagements, anonymised because our clients are under NDA. The full write-ups, with results, are on our work page.
Technology and engineering · client under NDA
A repeatable security operations program with clear governance for an organisation with distributed engineering teams, built within a tight budget.
Australian small business · client under NDA
An investigation and clean-up after an attacker took over a Microsoft 365 mailbox, hid a forwarding rule and emailed everyone in the user's contacts.
Cyber Security
Reports highlight what has changed since the last one, such as devices out of date, alerts raised and closed, risky settings fixed and anything waiting on a decision from you. The aim is a short list of actions, not a pile of charts.
04In detail
Each layer covers a different way in. You can start with the core and add services over time, and each has its own page with the detail:
The value of one team running all of them is correlation. A risky Microsoft 365 sign-in, a new forwarding rule and a suspicious email to the same person mean more together than three separate alerts. A typical example from this work: a staff member clicks a convincing invoice link, and soon after their mailbox gains a hidden rule forwarding anything mentioning invoices to an outside address. We link the risky sign-in, the new rule and the original email, remove the rule, end the account’s active sessions, reset the password and MFA, pull the same email from every other mailbox and then tell you what happened and what to tighten.
Many email and endpoint threats are blocked or quarantined automatically when they are detected. Critical alerts are then reviewed by our team as a priority, with response targets for every alert level agreed in your service level agreement (SLA).
A security operations centre is a team that watches security alerts and responds to them. Large organisations build their own. Most small and mid-sized organisations don’t need to, and can’t justify the cost of staffing one.
Managed security gives you the core of what a SOC does: alerts from your endpoint, email and Microsoft 365 tools are reviewed and acted on by our team. Penetration testing is also part of our work, so the people reviewing your alerts understand how attacks unfold.
If you later need a full SOC, the groundwork carries over: tuned tools, a tested escalation path and a record of what normal looks like in your environment.
No set of controls stops every attack, so the service is also built to limit damage. A good plan works through the same sequence each time: identify, contain, eradicate, recover and learn.
Your plan names who makes decisions, who you need to notify (if personal information is involved, that can include the OAIC under the Notifiable Data Breaches scheme) and how you communicate with staff and customers. ASD’s incident response planning guidance includes a plan template you can start from. We help you rehearse it, so the first time you use it isn’t during a real incident.
05The process
We review your current tools, people, risks and budget, and baseline your controls against ASD Essentials or another framework you need to meet.
We agree which services you need and how alerts are handled and escalated. You receive a written service description.
We deploy or take over your security tools, tune them to your environment and confirm everything is reporting correctly.
As soon as 1 week, and within 4 weeks, depending on the services you choose
Our team manages the tools, acts on alerts and works with your IT team or provider on fixes.
Regular reports and review meetings show what changed, what is still open and what to do next.
06Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD Essentials | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|---|
| Managed EDR and alert triage | Visibility and response | Not applicable | A.8.7, A.8.16 | Detect; Respond |
| Email security management | Boundary services | Not applicable | A.5.14, A.8.7 | Protect |
| Patch oversight, and vulnerability scanning (add-on) | Not applicable | Patch applicationsPatch operating systems | A.8.8 | Identify (ID.RA-01) |
| Firewall and VPN management | Boundary services | Not applicable | A.8.20, A.8.23 | Protect (PR.IR-01) |
| Security awareness program (add-on) | Governance and culture | Not applicable | A.6.3 | Protect (PR.AT-01) |
| Incident response planning (add-on) | Visibility and response | Not applicable | A.5.24, A.5.26 | Respond |
07Pricing
Starting from*
$79 ex GST
per user per month
What changes the price
Final price depends on the number of users and devices, which services you include, how many sites and firewalls we manage, and any framework reporting you need, such as progress against the controls ASD prioritises for a board.
Not included: helpdesk and IT support, awareness training and phishing simulation (an add-on), and vulnerability scanning, incident response planning and hardware (quoted separately).
08FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistA managed security service provider is a company that runs security tools and processes on your behalf, for an ongoing monthly fee. Instead of hiring and training your own security staff, you get a team that manages endpoint protection, email security, Microsoft 365 monitoring and alerts for you. Catharsis acts as an MSSP for Australian organisations, working alongside your existing IT team or provider.
Coverage and response targets are discussed with you based on your requirements and agreed in a written service level agreement (SLA) before you sign. It sets out who acts on an alert and how it is escalated, so your incident response plan reflects the real coverage rather than an assumption.
Managed IT asks "is it working?": helpdesk, devices, Microsoft 365 and networks. Managed security asks "is it safe, and would we know if it wasn't?": detecting threats, filtering email, scanning for weaknesses, training staff and responding to incidents. Many organisations need both. We offer each separately, or Catharsis can deliver both as one security-first service.
We confirm whether the alert is real, contain it where the tools allow, for example by isolating a device or removing a malicious email, and tell your nominated contact. We then work with you and your IT provider to remove the cause and recover. Afterwards, we explain what happened and recommend changes that make a repeat less likely.
Yes. Many organisations keep their existing IT provider and add managed security. We agree who does what at the start: typically we run the security tools and act on alerts, while your provider applies patches and changes systems. Shared reporting means everyone works from the same list of open risks, so less falls between the two teams.
Managed security starts from $79 per user per month, ex GST, for managed endpoint detection and response, email security, Microsoft 365 sign-in monitoring, patch oversight, and firewall and VPN management. Vulnerability scanning, awareness training and incident response planning are quoted add-ons. Your written quote sets the final price after we review your users, devices and sites.
Talk to our team
No obligation. You talk to the people who do the work.
