One Unpatched Laptop Brought Down This Melbourne Business.

It Started With a Remote Worker's Laptop

In early 2023, a Melbourne-based accounting firm with 22 staff thought they were doing everything right. They had antivirus software. They had a firewall. They had a part-time IT contractor who came in once a month to "check things over."

What they didn't have was visibility.

One of their senior accountants had been working from home since COVID and was using a company-issued laptop that hadn't received a Windows security patch in over four months. The monthly IT visit hadn't flagged it. Nobody had noticed. That single laptop was sitting quietly outside the firm's security perimeter, connected to the internet, and wide open to a known vulnerability that Microsoft had already issued a fix for.

In March, a threat actor exploited that vulnerability. They moved laterally through the firm's cloud-connected file system over the course of 11 days, undetected, before deploying ransomware that encrypted client records, financial data, and internal systems.

The firm was offline for 19 days. They paid a ransom of approximately $65,000 AUD in cryptocurrency. Incident response, legal notification obligations under the Notifiable Data Breaches scheme, staff overtime, and lost billable hours pushed the total damage past $180,000. Two clients terminated their contracts.

This isn't a hypothetical. Variations of this story are playing out across Australian small and medium businesses every single week.

Why Australian SMEs Are Increasingly in the Crosshairs

There's a persistent myth that cybercriminals only go after big targets: banks, hospitals, government agencies. The reality is far more uncomfortable for smaller businesses.

According to the Australian Cyber Security Centre's (ACSC) Annual Cyber Threat Report, small businesses account for nearly 43% of cybercrime victims in Australia. The average cost of a cybercrime incident for a small business is now over $46,000, and that figure doesn't include reputational damage, client churn, or the psychological toll on business owners and their teams.

The reason SMEs are targeted is straightforward. They typically have valuable data (financial records, client information, intellectual property), but they don't have the security infrastructure or dedicated IT teams that larger organisations do. To a cybercriminal, that's an attractive combination.

And with the explosion of remote and hybrid work, the attack surface has grown dramatically. Every laptop, desktop, mobile device, and server that connects to your business systems is an endpoint, and every endpoint is a potential entry point.

What Is Endpoint Monitoring, and Why Does It Matter?

Endpoint monitoring (often delivered as part of a broader Managed Detection and Response, or MDR, service) is the continuous visibility and management of every device connected to your business network. It means someone, or more accurately a combination of intelligent tooling and experienced technicians, is watching what's happening across your environment at all times.

This includes:

Patch management: ensuring every device receives security updates as soon as they're available, not whenever someone remembers to apply them.
Real-time threat detection: identifying suspicious activity (unusual login times, unexpected file access, lateral movement) before it becomes a breach.
Device health monitoring: flagging devices that fall out of compliance, go unprotected, or behave abnormally.
Remote response capability: isolating a compromised device from the network within minutes, not days.
Audit trails and reporting: maintaining logs that are essential for incident response and regulatory compliance.

The accounting firm in Melbourne had none of this. Their monthly IT contractor visit was, in security terms, essentially useless, because threats don't wait for scheduled appointments.

The Real Cost of Doing Nothing

One of the most common objections we hear from SME owners when managed IT and endpoint monitoring comes up is: "We can't afford it."

It's worth unpacking what "can't afford it" actually means in this context.

Managed endpoint monitoring for a business of 20 to 50 users in Australia typically costs somewhere between $2,000 and $5,000 per month depending on scope, complexity, and the provider. That's $24,000 to $60,000 per year. It's a real expense, and one that deserves scrutiny like any other business investment.

Now consider the alternative:

The average ransomware payment for an Australian SME is between $20,000 and $100,000+
Incident response services from a specialist firm can run $15,000 to $50,000 for a single engagement
Mandatory breach notifications under the Privacy Act carry compliance and legal costs
Downtime for a 20-person professional services firm running at $150/hour per staff member costs roughly $60,000 per week in lost productivity alone
Cyber insurance premiums are rising sharply, and many policies now require demonstrable endpoint controls before they'll pay out

The maths isn't complicated. A single serious incident will cost most SMEs more than several years of managed IT investment. The question isn't whether you can afford endpoint monitoring. It's whether you can afford to go without it.

"But We Have Antivirus" and Other False Comforts

Antivirus software is a bit like wearing a seatbelt but not having airbags, crumple zones, or lane-keep assist. It's better than nothing, but it's not a security strategy.

Traditional antivirus works by comparing files against a database of known malware signatures. The problem is that modern threats, particularly those used against SMEs, are increasingly sophisticated. Fileless malware, living-off-the-land attacks, and zero-day exploits don't leave the kind of fingerprints that signature-based antivirus catches.

Similarly, many businesses rely on their cloud provider, Microsoft 365 or Google Workspace, as a proxy for security. These platforms provide excellent collaboration tools and strong baseline security features, but they are not endpoint protection solutions. They don't tell you when a device on your network is unpatched, compromised, or behaving suspiciously.

Other common gaps we see in Australian SME environments include:

Personal devices used for work without any management or monitoring (BYOD with no controls)
Staff working from home networks with no visibility from the business
Servers that haven't been patched in months because "we don't want to risk breaking anything"
No multi-factor authentication on critical systems
Shared local admin credentials across multiple machines

Each of these is a gap. And gaps are what attackers look for.

What Good Endpoint Monitoring Actually Looks Like

Effective managed endpoint monitoring isn't about installing an agent and forgetting it. It's an ongoing, active process that includes human expertise: people who understand the difference between legitimate after-hours activity and an attacker quietly mapping your network.

For an Australian SME, a well-implemented endpoint monitoring program should deliver:

24/7 Visibility Across All Devices
Every managed device, whether it's in your office, at someone's home, or in a branch location, should be visible to your IT provider. You should be able to answer, at any given moment: how many devices are on my network, are they all patched, and are any of them behaving strangely?

Automated Patching With Human Oversight
Patches should be deployed automatically and consistently, with a human review process to catch anything that might cause application conflicts. The four-month patch gap that crippled the Melbourne accounting firm should be technically impossible in a properly managed environment.

Threat Detection With Response Capability
Detection without response is just expensive alerting. Your managed IT provider should have the ability and the mandate to act (isolating devices, blocking traffic, or escalating to you) when something suspicious is identified. Time matters enormously in a breach; every hour of dwell time increases damage.

Regular Reporting You Can Actually Understand
You shouldn't need a computer science degree to understand your security posture. Monthly or quarterly reports should give you a plain-English summary of your environment's health, any incidents or near-misses, and what's been done to address them.

Compliance Is Also in Play

For many Australian SMEs, particularly those in professional services, healthcare, finance, or any sector that handles personal information, there's a regulatory dimension that can't be ignored.

The Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme require organisations to notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when a data breach is likely to result in serious harm. Failure to do so, or failure to have reasonable security measures in place, can result in significant penalties.

The Australian Government's Essential Eight framework provides a clear, practical baseline for cybersecurity controls. Patch management and application control, both core components of endpoint monitoring, are among the foundational requirements. If you're working toward Essential Eight alignment (increasingly expected by government contractors and larger corporate clients), endpoint monitoring isn't optional.

The Orkestro Approach

At Orkestro, we work with Australian SMEs who are serious about protecting what they've built, without the complexity and cost overhead of an in-house IT security team.

Our managed IT and endpoint monitoring services give you enterprise-grade visibility and response capability at a scale and price point that makes sense for a business of your size. We don't sell you tools. We manage outcomes, so you can focus on running your business rather than worrying about whether someone's laptop in Geelong is quietly compromised.

We've seen what happens when businesses wait. We've also seen what happens when they don't.

Take the First Step: Book a Free Security Audit

If you're not completely certain about the security posture of every device connected to your business (and most SME owners we speak to aren't), the right starting point is visibility.

Orkestro offers a free endpoint security audit for Australian SMEs. In a structured, no-obligation session, we'll assess your current endpoint coverage, identify gaps, and give you a plain-English picture of your risk exposure. No sales pressure. No technical jargon. Just an honest assessment of where you stand and what, if anything, needs to change.

The Melbourne accounting firm wishes it had had that conversation before March 2023. You still can.

Book your free security audit with Orkestro today: https://orkestro.com.au/contact
Or call us directly to speak with one of our team. We're based in Australia, and we understand the challenges facing Australian businesses.

Don't wait for an incident to find out where your gaps are.