A free check of your Microsoft 365 — every setting that matters. After that, 30 minutes on the phone explaining what we found, in plain English.
Free. We do ten of these a month, and this month's list is open.
The things business owners say to us before we start.
"Someone left last year and I honestly couldn't tell you whether their access was ever turned off."
"I heard about a business that paid an invoice into the wrong bank account. It was for eighty grand."
"A client sent us a security questionnaire and I had to guess at half the answers."
"We pay for IT support every month. I've got no idea whether any of this is covered."
"Half my team is on their own laptops and phones. I'd never thought about it until now."
"If something went wrong tomorrow, I wouldn't know where to start."
When your business email was first set up, a long list of protections came switched off — not broken, just off, waiting for someone to turn them on. Microsoft leaves that to you, and in most businesses it never happens, because it's nobody's job. Your IT support fixes what breaks, and nothing breaks while a protection is off, so nobody ever looks. That's how years go by.
A 25-person accounting firm in Sydney — with IT support, and never a hint of trouble.
If any one account had been broken into, the intruder could have set it to secretly copy every message out of the business — no warning, nobody told. It's exactly how invoices end up paid into the wrong bank account.
Their accounts were never switched off, and the passwords hadn't changed since the day they walked out the door.
Devices nobody had touched in months could still reach company files.
Two of their three email addresses had nothing stopping it — a scammer could have emailed their clients, as them, asking to be paid.
If that password had ever turned up in a leak, that was the whole front door.
The classic "quick favour, can you transfer this today" email would have landed like any other.
Nineteen problems in total, and every one of them was a setting that had been sitting switched off since the day they started.
Same business, same team. Nothing bought, nothing replaced, nobody retrained.
If you're in the second column, we'd rather say so now than take up your afternoon.
There's no catch — but there is a reason, and you deserve it straight.
The checking part is automatic, so one more check costs us almost nothing. What does cost us is the half hour one of our people spends going through it with you, which is why we do ten of these a month rather than a hundred.
Out of those ten, a few ask us to fix what we found. We quote that work like any other job, and that's where we make our money.
The rest take the report to whoever already looks after their IT and get it fixed without us, and that's fine by us — we'd rather these holes got closed than left open. Besides, the business that trusts us this year is usually the one that calls us in a few years' time.
That's the whole arrangement.
You're not spending money here, so the only thing you're risking is about forty minutes. Here's what you get for it.
If we find things, I'll tell you plainly what they are, what they could cost you, and what fixing them would involve. And if you're in good shape, I'll say that too — in writing, so you can show whoever asks. We're not going to invent problems to avoid giving you a clean report.
Either way the report is yours.
Two ways this actually plays out.
The redirected invoice. One account gets broken into. Someone reads quietly for a fortnight, waits for you to invoice a client, then emails that client with different bank details.
Ransomware. A staff password turns up in a data leak. With nothing else guarding the account, the attacker logs in like they own it, quietly copies your files out of Microsoft 365, then locks every document and spreadsheet the business has — and leaves a note with the price.
The invoice figure's an example. The ransom is the median Australian businesses actually paid last year, and the 24 days is the average lockout. Put your own numbers in — the answer doesn't change much.
One screen, about ten minutes. If your IT provider handles that side, forward it to them.
It runs quietly in the background — nobody in your team will notice a thing.
You get the written report, then we spend 30 minutes going through what it means for you.
No. We look at your settings, not your messages — we're not opening your inbox, your documents or your files, and we couldn't tell you what's in any of them. You'll see exactly what we're looking at before you approve anything.
No. Nothing changes, nothing gets switched off, and nobody has to log in again — your staff won't know it happened.
That's the point — you don't need to. We do the looking, then explain what we found the way we'd explain it to a mate over coffee. If we use a word you don't know, we've done our job badly.
It shouldn't be. Most businesses we check have an IT provider, and we're not asking you to change that. Think of it as a second set of eyes: if they've got it covered, you'll have proof, and you can send them the report either way.
Because the checking part is automatic and costs us almost nothing. Some businesses ask us to fix what we find, and we quote that work like any other job — that's where we make our money. Plenty take the report to their own IT provider instead.
We tell you what we'd recommend doing about it, and what that would cost. Every business is different, so the price depends on how much is out of place — you'll have the recommendation and the costing in front of you before anything happens. Keeping the report and sorting it yourself is always on the table.
It's the question we hear most, and it's the one that costs people. Almost none of this is personal — it's automated, sweeping around for whoever left a door open. Being small doesn't hide you; it just means nobody's checked.
Whenever you like, in a couple of clicks. It's your account, and access stays entirely in your hands.
Pages like this can feel like they were made by nobody, so here's who's behind it. We're Elscomm, a small IT team in North Sydney, and we've looked after Australian businesses since 2006. These are the people who'll actually pick up the phone.
Ten minutes to set up, then a 30-minute call. The report's yours to keep.
Free. We do ten of these a month, and this month's list is open.
P.S. If you scrolled straight to the bottom, here's the four-line version.
Your business email came with a list of protections switched off, and nobody's ever checked which ones. We'll look, for nothing, and send you a written report.
Then we'll spend thirty minutes explaining it to you without a single acronym.
The report's yours whatever you decide to do next. The only thing you lose by skipping it is knowing.
