Practice Cyber Health Check
A fixed-scope review of how exposed your practice actually is. You get a written report you can act on, whether or not you engage us to do the work.
The attack path
Five gates sit between the open internet and your patient records. The Cyber Health Check tells you which ones are shut.
Most of these go the same way. Someone finds a domain they can send mail as, or a mailbox with no MFA on it, or a laptop nobody has touched in two years, or an account belonging to a receptionist who left in March. Pick a gate to see what we check and what you get back.
All five open. Switch across for the same five after the findings are actioned.
Your patient records
Reachable through every gate above
Email authentication
What we check
Your SPF, DKIM and DMARC records, whether DMARC is set to none, quarantine or reject, whether anyone is reading the reports it produces, and any lookalike domains registered against yours.
How it gets used against you
If DMARC is set to none, mail sent from your domain by someone who is not you still gets delivered. The version we would expect to see is an email to your customers changing your bank details. It clears the spam filters because, as far as the receiving mail server can tell, you sent it.
What the report gives you
The DNS records to publish, the order to publish them in, and what each one stops.
What we look at
Five areas, evidence-based
- Email authentication. Whether SPF, DKIM and DMARC are configured correctly, and whether someone can send email that appears to come from your practice.
- Your public attack surface. What is reachable from the internet, using passive lookups only. We do not scan or probe your systems.
- Microsoft 365 and Entra ID configuration. Multi-factor authentication coverage, admin account handling, conditional access, and legacy authentication.
- Endpoint and backup posture. What is managed, what is patched, and whether your data is genuinely recoverable when you need it.
- User and access review. Who has access to what, including accounts belonging to staff who have left.
What you get
A prioritised report you can act on
- A written report in plain language, mapped against the Essential Eight and Australian Privacy Principle 11.
- A prioritised list of findings, ordered by risk.
- A walkthrough call to go through the findings.
- Fixed-price quotes for any remediation you decide to do. There is no obligation to have us do it.
Request your Health Check
Short form. We will confirm next steps by email.