You run a financial advice, wealth or broking firm on the GC, with one capable IT person. Their day runs from password resets before the 9am meeting to a new starter’s laptop by lunch. Somewhere in between, they glance at the security alerts.
Cyber security joined their workload with no change to their role, but the accountability stayed with you. So the alert they miss at 4pm becomes your problem at 10pm. ASIC asks why it was missed, every affected client gets a breach letter, and those who leave take their portfolios. The reputation you spent years building now carries a breach.
Co-managed security services give your cyber security what your advice files already get, a second set of eyes before it counts, while retaining the person who already knows your systems.
Key takeaways
ASIC expects AFS licensees to resource cyber security for their size and the sensitivity of client data they hold. Round-the-clock detection, specialist judgement and evidence that controls work sit beyond one IT person’s role. Co-managed security services add that capacity alongside your IT person, who keeps running day-to-day IT.
Table of Contents
What does compliance expect beyond my IT team’s day-to-day work?
ASIC expects an AFS licensee’s cyber security to be adequate for its size and client data, monitored around the clock and backed by evidence.
In February 2026, FIIG Securities became the first AFS licensee to receive a $2.5 million Australian dollar civil penalty for cyber security failures. ASIC’s media release on the FIIG Securities cyber security penalty sets out the expectation.
“ASIC expects AFS licensees to prioritise cyber-resilience and invest in people, systems and governance which are fit-for-purpose for entity size and the sensitivity of client information held.”
– ASIC
The Federal Court made clear ASIC isn’t seeking an unattainable standard, only adequate systems.
Day-to-day IT keeps systems running, patched and protected with controls such as an endpoint protection subscription, email filtering and multi-factor authentication (MFA). Three requirements sit beyond that baseline, and each comes down to role design.
Who watches my systems after hours?
After-hours detection needs a trained team watching your systems overnight and on weekends.
FIIG admitted that adequate measures would have let it detect and respond to the breach sooner. Even Picard handed the bridge to the night watch. Your IT person still goes home at 5:30, and the system keeps getting monitored.
Who decides whether my cyber security is adequate?
A security specialist judges whether your controls are adequate and plans your Essential Eight maturity.
The Essential Eight is the Australian Signals Directorate’s eight priority strategies, from patching to backups, set out in ASD’s Essential Eight explained. FIIG had 9 to 14 IT staff, and the court’s reasons record that they lacked the security skills and the time to keep the right measures in place.
How do I prove my cyber security controls work?
You prove cyber security controls work by operating, monitoring and documenting them, before a regulator asks.
FIIG admitted that complying with its own policies and procedures could have supported earlier detection. A security policy without that evidence is an advice file without a review.
Should I replace, expand or back up my IT team?
ONGC’s managed IT and cyber security packages, Reach Ignite, Protect or Secure, suit firms without a capable, dedicated internal team member. If you already have a capable internal team and want to keep your security in-house, expanding may be the best option but requires hiring security specialists and carrying the recruitment, coverage and retention yourself.
If your IT already runs well but you don’t want the responsibility of managing extra staff, backing up your IT person with specialist security fits better than replacing or expanding. That backup option has a name, co-managed security services.
What are co-managed security services?
Co-managed security services pair your internal IT team with a specialist cyber security team, with each side owning defined responsibilities.
Your IT team keeps operations, user support and infrastructure. ONGC’s cyber security team handles threat detection, incident response, vulnerability management and security governance. Accountability is shared through escalation paths and reporting.
Co-managed IT shares general IT workload. Co-managed security shares only the security function.
Reach Defend is ONGC’s highest cyber security support, with a dedicated security team, 24/7 security operations centre coverage and ongoing uplift. It forms part of ONGC’s co-managed security services and sits within its wider IT and cyber security support for financial services firms.
How does co-managed security work with my IT team?
Co-managed security from ONGC works in three stages. The team learns your environment, operates as an extension of your IT team, then reports monthly.
The security operations centre, or SOC, watches for threats around the clock. Say a director’s mailbox starts forwarding client emails offsite at 2am. The SOC investigates and contains the activity overnight, and your IT manager reads the briefing over morning coffee.
SOC monitoring covers after-hours detection, maturity and evidence.
What would co-managed security services include for my firm?
Reach Defend bundles seven core elements into one service.
A dedicated security team runs 24/7 SOC monitoring and uncapped incident response. It proactively closes gaps across endpoint, identity, network, email and user awareness. Cyber security consulting services build your Essential Eight or ISO roadmap, and regular reporting keeps the evidence current.
Backup for an in-house IT manager
Children’s Hospital Foundation had an in-house IT manager and little cyber security visibility. ONGC’s security team worked alongside them on a 12-month Essential Eight and compliance roadmap. CHF now has full regulatory compliance, confident leadership and an IT manager with backup on every security query.
What else should I know about co-managed security services?
Co-managed security services keep your IT person, control and accountability in place, at a fixed monthly cost.
Bringing in an outside security team can feel like a vote of no confidence in your IT person. It isn’t, and the four answers that follow show why.
Will co-managed security replace my IT person?
No. Your IT person keeps day-to-day IT and ONGC adds security capacity alongside them.
Does my IT team lose control?
Not at all. Your IT team keeps control and visibility, with clear escalation paths and reporting.
Who is accountable if we have a breach?
Your business stays accountable under its AFS licence. Co-managed security adds defined responsibilities, faster response and documented evidence of what was done.
How is co-managed security priced?
Co-managed security is a fixed monthly cost under an ongoing agreement. That keeps your cyber security services spend predictable year to year.
Put together, your IT person keeps day-to-day IT, ONGC carries the security load and you hold the evidence.
Is my firm ready for co-managed security?
Any of these four signs means your firm is ready for co-managed security.
Each traces back to one gap. Security depends on one person’s hours and memory, and the evidence lives in their head.
Four signs your IT person needs backup
- Only your IT person can respond to security alerts.
- There’s no after-hours monitoring of your systems.
- You have no documentation to show a regulator or insurer.
- Hiring a security specialist has proved costly or difficult.
The bottom line
Your IT person keeps the firm running, and ASIC now expects you to show your security works too. Co-managed security services add that layer, while you keep the person who knows your systems.
A compliance review never replaced a good adviser. It made the advice defensible. Backup for your IT person does the same for your cyber security.
Talk to ONGC’s cyber security team about how co-managed security would work alongside your IT team.
