Cyber security services, one-off projects or ongoing support?

You paid for the security work 18 months ago. MFA (multi-factor authentication) went on, the firewall was replaced, and the report went into a shared drive. No regulator in your industry asks you to open it again, so it’s still there. 

Since then, you’ve hired two graduates, won the school job, and started swapping drawings and progress claims with a new builder. Each of those changes landed after your cyber security services project closed. The work was sound on handover day, but your practice kept changing. 

You already plan for this on every project. Practical completion comes with a defects liability period for faults that surface after handover. Your security project had no such clause. The project ended. The risk didn’t. 

Why doesn’t a one-off security project keep my business safe? 

A one-off security project secures your practice as it stood on handover day. Every change since, like the new builder, adds exposure it was never set up to watch. 

The new builder is where the first exposure shows up, through invoice redirection. Business email compromise is when an attacker gets into, or imitates, a mailbox and changes the bank details on a progress claim or supplier invoice. Email compromise made up the two most-reported business cybercrimes in the Australian Signals Directorate’s (ASD’s) 2024–25 figures. 

The second is the school job’s drawings and tender documents, now in more inboxes than the project covered. The third is reputation, because a builder who loses a progress payment remembers whose mailbox sent the request. 

A one-off project is a sound starting point. The question is who looks after it afterwards. 

What changes in my business after a security uplift ends? 

After a security uplift ends, every change moves your setup further from what you signed off. That gap is drift. 

I see it arrive in four ways. Project teams leave, and their access doesn’t always leave with them. Subcontractors are given access to a shared folder for one job and are never removed. Laptops travel between sites and on the passenger seat of a ute. A director signs up to a new project management tool on a Friday afternoon, without MFA. 

The Essential Eight is ASD’s eight baseline strategies for reducing cyber risk. Even the lowest level of ASD’s Essential Eight maturity model expects daily vulnerability scanning of online services and fortnightly asset discovery. A closed project does neither. 

Having security tools you don’t actively manage is like running Windows XP because it still technically works. ‘Technically’ is doing a lot of heavy lifting in that sentence. 

What risk does my business carry without ongoing cyber security services? 

Without ongoing cyber security services, the risk passes back to your business at handover. Managed security shares the work of reducing and responding to it, without removing the risk or your accountability. 

Before an incident, who is watching my setup for drift? 

On a one-off project, no role is assigned to watch for drift after sign-off. 

Departed staff keep access, patches wait, and sign-in alerts go unread. 

With managed security, access is managed centrally, dark web scanning flags leaked credentials, and security awareness training helps your accounts team question a changed bank detail. 

If my firm is targeted, who notices first? 

Without ongoing monitoring, the first sign of an incident can be a subcontractor asking where their progress payment went. 

After hours, your systems go unwatched. With managed security, 24/7 threat monitoring flags the suspicious login, and Reach Protect includes unlimited incident response. 

After an incident, what does recovery cost me? 

Recovery costs more when you can’t say what was accessed or whether your backups work. 

According to ASD’s Annual Cyber Threat Report 2024–25, the average self-reported cost of cybercrime per report for a small business was AUD $56,600, up 14%. With managed security, backups are monitored and tested, and Reach Secure includes documented incident response and disaster recovery plans. 

6 ways the risk shifts with ongoing security 

	One-off project	With Reach Protect
Access management	Unassigned once the project closes	Managed centrally
Leaked credentials	Unchecked	Dark web scanning
After-hours detection	Unmonitored	24/7 threat monitoring
Incident response	Arranged mid-crisis	Unlimited incident response
Backups	Whatever the last project set up	Monitored and tested
Cost profile	Billed per project	Consistent ongoing billing

Access management and backups are in all three Reach packages. 

Your projects get a defects liability period. Your security can too. 

What do ongoing cyber security services include at ONGC? 

ONGC delivers ongoing cyber security services through its Reach Ignite, Reach Protect and Reach Secure security packages. 

Reach Ignite covers managed IT with entry-level security, including MFA, user access management, monitored backups and 24/7 device health monitoring. 

Reach Protect adds a 24/7 security operations centre, unlimited incident response, dark web scanning and security awareness training. 

Reach Secure aligns you to Essential Eight Maturity Level 2, with an annual assessment, a roadmap and its implementation, and incident response and disaster recovery plans. 

For a practice like yours, Reach Protect is where I’d start. ASD’s guide, Essential Eight explained, covers the full framework. 

How do I know when my business needs ongoing security support? 

Your business needs ongoing security support when your practice has changed since its last review and no named person is watching. 

What else should I know about managed cyber security services? 

Will I lose control of my security with a managed provider? 

No. With managed cyber security services, accountability for your firm’s security stays with you. 

Planned reviews show you who has access, what was flagged and what has changed. You make the calls on risk, and the provider does the watching. 

I have an internal IT person. Do I still need this? 

Possibly not the full package. Co-managed security supports an internal IT person rather than replacing them. 

One person can’t watch your systems at 2am and still make the 8am site meeting. Co-managed security services share that load. 

How is ongoing security billed compared with one-off projects? 

One-off security projects are billed ad hoc, job by job. Managed cyber security services are billed consistently under an ongoing agreement. 

Think of it as a stage fee rather than a variation every time the scope moves. You can budget for security alongside your software. 

The bottom line 

A one-off project gives you a sound setup on handover day, and your practice starts pulling it out of shape the next morning. Ongoing cyber security services keep a team watching for drift, responding to incidents and testing recovery, while accountability stays yours. 

Building contracts don’t stop at practical completion. The project ends, the risk doesn’t. 

Talk to ONGC’s team about how our managed IT and cyber security services would keep your firm’s protection current.