“Cybersecurity company” covers very different businesses. Some test your systems and hand you a report. Some write the policies and get you certified. Some watch your systems every day as part of a monthly fee. And some you only call when something has already gone wrong. Most best-of lists for Brisbane mix all four together and rank them, usually with the author on top.
This list groups nine firms by the job you need done. Every fact about a provider links to the page we got it from, checked in October 2026. We run Bastion IT, which is one of the nine, so read our entry with that in mind.
Start with the job, not the firm
Before you look at names, work out which of these you actually need.
- A test. Someone independent tries to break in and tells you what they found. Usually a one-off project.
- A certificate. A customer, tender or insurer wants ISO 27001, SMB1001 or similar, and you need help getting there.
- Day-to-day protection. Someone runs and watches your security controls every day, normally as part of managed IT.
- A part-time security lead. You need senior judgement on risk and policy but not a full-time hire.
- Help in an emergency. You’ve had an incident and need forensic and response specialists now.
A 15-person office often needs the third one first and the others later. The Australian Signals Directorate’s Essential Eight maturity model is a sensible yardstick for day-to-day protection, and ASD is clear that there’s no requirement for an Essential Eight implementation to be certified by an independent party, unless a regulator, a government policy or a contract asks for it. So don’t let anyone sell you an Essential Eight certificate as if the law requires one.
We’ve left out review scores, and we’ve only quoted prices where a firm publishes them.
Best for an independent penetration test
Acumenis. Acumenis has been operating since 2017, with consultants in Brisbane and Toowoomba. It’s ISO 27001 certified and CREST (International) accredited for penetration testing, which is the accreditation to look for in a tester. Its services also cover Essential Eight assessments, ISO 27001 implementation and internal audits, and incident response tabletop exercises. It works with startups, mid-market and regulated organisations, and enterprise and government, so ask which of their clients look most like you.
Siege Cyber. Siege Cyber is in the Brisbane CBD and publishes its penetration testing prices. It says a single test typically lands between $3,400 and $16,500 excluding GST, a basic website test starts at $3,400, and a retest after you’ve fixed the findings is included. It also states its CREST accreditation is held at company level rather than borrowed from one person. If you’ve never bought a test before, that pricing page is a useful education even if you buy elsewhere.
One opinion of ours on testing: the firm that tests your systems shouldn’t be the firm that runs them. If your managed IT provider also offers testing, that can be fine for routine vulnerability scans, but for a penetration test that a customer or insurer will read, use someone independent. Both testers above are standalone security firms, and either should be happy to work alongside whoever looks after your IT day to day. Ask your current provider to help scope the test and fix the findings, then have the tester confirm the fixes on the retest.
Best for getting certified
Siege Cyber again, for its compliance packages. Its CERTIFY package for ISO 27001 or SOC 2 is $3,750 a month excluding GST on a 12-month subscription for up to 50 employees, and it says the programme is built to get you audit ready in three to nine months. There’s also a MAINTAIN package at $2,450 a month for businesses already certified, and a package for Defence Industry Security Program membership. Siege holds CyberCert SMB1001 Gold Level 3 itself.
Mino IT. If the certificate you need is SMB1001 rather than ISO 27001, Mino IT in West End is SMB1001 Gold certified through CyberCert and says it runs the whole certification pathway for clients: gap assessment, fixing missing controls, documentation and the application, then keeping it current each year as part of its managed IT service. That suits a small business that would rather not run certification as a separate project.
Whoever you use, ask which SMB1001 level they’re aiming you at and why, and whether that level is self-assessed or independently audited. The answer should come from what your customers expect of you.
Best for day-to-day managed security
This is the group most 10 to 50 person businesses need, because it’s where the controls actually get run.
Grassroots IT. Grassroots IT is ISO 27001 certified and SMB1001 Gold, and works with organisations of about 20 to 200 staff. Its cybersecurity page covers endpoint protection, identity threat detection, vulnerability and patch management and staff training, and describes human-led response 24/7/365. It calls itself an Essential Eight and SMB1001 specialist.
Epic IT. Epic IT’s Brisbane cybersecurity page says it supports teams from 20 seats to 500 and beyond, and publishes a typical range of $100 to $250 per user per month, depending on how much security and coverage you take. It’s ISO 27001 certified, SMB1001 Gold certified and a Microsoft Solutions Partner. Its Brisbane engineers are based at Brisbane Airport, and it also has a North Perth office. It lists penetration testing and incident response alongside managed security, with after-hours support under the service agreement.
Bastion IT. That’s us. We provide cybersecurity alongside managed IT for small and medium businesses across South East Queensland, from a head office in Carindale. We’re SMB1001 Gold certified and a Microsoft Partner. Our service desk is Australian and runs 8am to 6pm Monday to Friday, and our response target for a P1, where the business has stopped, is 15 minutes. We don’t publish prices. What we cover is on our services page.
Best for a part-time security lead
Securitribe. Based on Eagle Street in the CBD, Securitribe offers a virtual CISO retainer, ISO 27001 and SOC 2 compliance, Essential Eight implementation and governance, risk and compliance work. The clients it describes are specific: software companies facing enterprise security reviews, medtech firms dealing with hospital procurement, defence-adjacent SMEs working toward DISP membership and Essential Eight Maturity Level 2, and regulated professional services such as law and accounting firms. It also says your logs and data never leave your tenant. If your business looks like one of those, it’s worth a conversation.
Best for staff and board training
ADITS. People are part of every security programme. ADITS lists cyber awareness training, board and executive training and a human risk report among its security services. Its homepage displays ISO 27001 among four ISO certification badges and a CyberCert Gold badge, and lists offices across Queensland from Brisbane to Townsville and Cairns, which helps if your staff aren’t all in one city.
Best for a major incident
CyberCX. CyberCX is a national firm with a Brisbane office on Creek Street. Its homepage lists incident response, penetration testing and managed security services and refers to nine security operations centres. Its incident response page is for businesses, governments and other organisations, and existing clients can hold a digital forensics and incident response retainer. It’s built for larger organisations, but it’s worth knowing the name before you need it, and asking your own provider who they’d bring in if an incident outgrew them.
Questions to ask before you sign
Whichever group you need, put these to every firm on your shortlist, us included, and get the answers by email.
For testers:
- Is your CREST accreditation held by the company, and will the person on my job be accredited?
- Is a retest included, and what does the report look like? Ask for a sanitised sample.
- Who in my business will you need, and for how long?
For managed security providers, start with the five questions ASD publishes for managed service providers: are you implementing better practice cyber security, securely administering your systems, monitoring activity on them, regularly assessing them, and prepared to respond to incidents? Then add:
- Who watches alerts outside business hours, and are they onshore?
- What does a response actually include, and what’s billed on top?
- Which certifications does your own business hold, and can I see them?
- If we leave, who holds the admin accounts, the logs and the documentation?
For certification help, ask what’s included in the price, how long it really takes, and what you’ll have to do yourselves.
Work out which of the five jobs you need first, shortlist two firms from that group, and send them the same questions. If you’d like a second opinion on where to start, get in touch.