> ## Content Index > Fetch the complete content index at: https://www.theaidirectory.com.au/llms.txt > Use this file to discover other available public pages before exploring further. # Cynch Security Review Australia 2026: Cyber Fitness for Small Business? - URL: https://www.theaidirectory.com.au/review-cynch-security-australia-2026/ - Published: 2026-06-06T23:00:00.000Z - Updated: 2026-10-09T06:29:10.000Z - Description: The Melbourne-built platform that turns 'geek speak' into a plain-English to-do list for small business cyber security. Our honest verdict. - Author: Adam - Tags: Cybersecurity & Data Protection, #review **18**/25 ★★★★☆ Very Good Cynch Security Verified 7 Jun 2026 Value for Money**2**/5 Ease of Use**5**/5 Feature Depth**3**/5 Australian Fit**5**/5 Reliability & Support**3**/5 From **A$149**/mo · ex-GST **The gate:** Five stars need 21+ and Australian Fit of at least 4/5. [Skip to the verdict ](#verdict) > **Verdict (TL;DR):** Cynch is a Melbourne-built "cyber fitness" platform that does one thing very well — it takes a non-technical small business owner who has no idea where to start on cyber security and hands them a short, plain-English, prioritised to-do list. It assesses your posture, scans your Microsoft 365 or Google Workspace settings, points you at Essential Eight–style fixes, and gives you real humans to ask when you're stuck. What it is *not* is an "AI tool" in any meaningful sense, and it is not protective software: it tells you what to fix, it doesn't fix it for you. Buy it if you're a sole trader or small operator who needs a guided starting point and a report to wave at an insurer or a tender. Skip it if you already have an MSP or IT person running your security. **Score: 18/25 — ⭐⭐⭐⭐** *Australian Fit: 5/5 — gate passed.* *Last reviewed: 7 June 2026 by Adam.* > > **A note on why this is here.** The AI Directory reviews tools that help Australians work with AI. Cynch is the exception that proves a rule: we included it as our first **Cybersecurity & Data Protection** pick because it is the rare local tool aimed squarely at our reader — the non-technical small business owner — not because it is an AI product. As you'll read below, its "AI" credentials are thin. We've scored it honestly on that basis. (See the AI angle section.) ## What Cynch Security is Cynch Security is a cyber risk **assessment and guidance** platform for small business. The company calls it "cyber fitness," and the gym metaphor is exact: instead of auditing you once and leaving, it measures where you are, gives you a tailored plan to improve, and keeps nudging you along over time. The core loop is simple. You answer a guided assessment about how your business operates. Cynch connects to your Microsoft 365 or Google Workspace and scans your configuration automatically. It then produces a "cyber fitness" score and — this is the bit that matters — a short, prioritised list of bite-sized tasks written for people who don't speak IT. When you get stuck, you can reach a human "Cyber Fitness Coach" on demand. Cynch was founded in **Melbourne in 2017** by Adam Selwood and Susie Jones, on the premise that security should coach businesses to health rather than audit them to death. The company says it has guided more than 2,000 organisations, from sole traders to enterprises. For an Australian small business owner this is a genuinely useful proposition. Most cyber security tooling is built for IT teams. Cynch is built for the person who runs the business, does the BAS, and has a nagging fear they'd fail an insurer's questionnaire — and has no idea what "MFA" or "application control" actually means. ## What it costs in Australia Cynch publishes a single, refreshingly simple AUD price. | Plan | Price | What you get | | ---------- | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | Free trial | A$0 for 14 days, no credit card | Full, unlimited platform access for two weeks | | Membership | **A$149/month per business** (annual billing available at a discount) | Unlimited cyber fitness assessments, automated M365 & Google scanning, on-demand coaching, downloadable policies and reports | | Discounted | Apply | "Significant discounts" for new businesses, micro-businesses and non-profits | That's it — one tier, one number. After the trial you're invoiced for continued access; you can cancel any time, and annual payers get a discount. The amount of the annual discount and the size of the micro-business discount aren't published — you apply for the latter. **GST note:** Cynch is an Australian company billing Australian businesses in AUD, so GST applies. The pricing page does not state whether the A$149 is GST-inclusive or GST-exclusive. Assume 10% GST is added or built in, confirm the exact figure on your tax invoice, and — as a business expense — a GST-registered business can generally claim the input credit. Confirm deductibility with your accountant; this is general information, not tax advice. At A$149/month (call it roughly A$1,800 a year before any discount), Cynch isn't free, and that frames the verdict. For a sole trader it's a real line item. The question is whether guided, ongoing coaching is worth it versus a one-off afternoon working through the free ACSC Small Business Cyber Security Guide yourself. For people who'll never do that afternoon, the structure is the value. ## How it works in practice Getting started is quick. You sign up — no credit card for the trial — answer a guided questionnaire about your business, and connect your Microsoft 365 or Google Workspace account. The automated scan checks your environment's security settings and feeds the results back into your fitness score. The output is the product's best feature. Cynch's own words: "We don't dump a 50-page PDF on your desk. We give you a prioritised list of bite-sized tasks tailored for non-technical teams". Each task is a plain-English action — turn on multi-factor authentication, fix a specific sharing setting — rather than a control reference you'd need a consultant to decode. The platform says it draws on a large library of plain-language recommendations aligned to industry standards. When you hit something you don't understand, the "on-demand coaching" is real human support whose job is, in Cynch's phrasing, to "translate 'Geek Speak' into action". For a non-technical owner this is the difference between a report that gathers dust and tasks that actually get done. The other practical payoff is the **report**. Cynch generates a validated cyber fitness report you can hand to an insurer at renewal, a customer running a supplier security check, or a government tender that asks about your posture. For small businesses being asked, increasingly, to prove they take security seriously, having a structured answer is worth something on its own. ## The "AI tool" question — read this before you buy This matters enough to be blunt, because it's the reason Cynch sits awkwardly in an AI directory. **Cynch Security is not, in any meaningful sense, an AI product.** Its public product pages — pricing, membership, small-business and homepage — describe assessments, automated configuration scanning, a recommendation library and human coaching. **None of them mention AI**. The only place AI appears at all is the About page, which describes a "Human-in-the-Loop" approach combining "AI and automation" with expert guidance, and notes a team role driving "GenAI integration". That's a direction of travel, not a feature you can point to. So be clear about what you're buying. The "automated scanning" of M365 and Google is configuration checking — useful, but rules-based automation, not the thing most people mean by AI. The intelligence in the product today is the curated recommendation library and the human coaches, not a model doing the reasoning. If you came looking for an AI that detects threats or responds to incidents, this is not that. We're flagging this loudly because our voice rules demand it, and because a reader who buys Cynch expecting "AI security" will be disappointed. It earns its place in this category on **audience fit and Australian fit** — it's built for the exact non-technical Australian owner we write for — not on its AI credentials. (One caution: don't confuse Cynch Security at cynch.com.au with the unrelated US company "Cynch AI" at cynch.ai, which is a financial-decisions product. Different company entirely.) ## How Cynch helps with the Essential Eight The Essential Eight is the Australian Cyber Security Centre's baseline set of eight mitigation strategies — multi-factor authentication, patching, application control, restricting admin privileges, and so on. It's the closest thing Australia has to a national small-business security checklist. Cynch's tasks reference Essential Eight–style controls directly. The platform surfaces items like "Application Control" and tags priority tasks against an Essential 8 framing, and its reports are described as ISO 27001–aligned. For a non-technical owner who has heard "Essential Eight" mentioned by an insurer or an IT supplier and felt their eyes glaze over, Cynch is a reasonable on-ramp: it translates the framework into specific things to do, in priority order. But be precise about the boundary. **Cynch is a management and guidance layer. It assesses your posture and tells you what to do — it does not implement the controls or block attacks.** It has no antivirus, no endpoint detection and response, no email filtering, no application-control enforcement of its own. When Cynch tells you to turn on MFA or restrict admin rights, *you* (or your IT support) still have to do it inside Microsoft 365, Google, or your other systems. Cynch directs; it does not defend. ## High-trust caveat (please read) This is editorial guidance, not security advice, and cyber security is a field where the difference can cost you. Three things to hold onto: 1. **No single tool delivers Essential Eight compliance on its own** — least of all an assessment platform. The Essential Eight is implemented across your actual systems, at a maturity level; a platform that scores you against it is a map, not the journey. 2. **A posture/management tool must be paired with real protective controls** — MFA, patching, backups, endpoint protection, email filtering. Cynch tells you what you're missing; it doesn't supply the missing pieces. 3. **For anything material — an incident, a compliance obligation, an insurance condition — get qualified professional advice.** Cynch is a useful guide for a small operator; it doesn't replace an IT security professional or a lawyer when the stakes are high. ## What it does well - **Genuinely built for non-technical owners.** The whole product is engineered around the person who runs the business, not the IT team. Plain English, prioritised, bite-sized. - **Australian through and through.** Melbourne-built since 2017, AUD pricing, AU framing (Essential Eight, ISO 27001 alignment), local coaches. - **A simple, single price.** One tier, A$149/month, real 14-day no-card trial, cancel anytime. No confusing matrix of plans. - **The report has real-world use.** A validated cyber fitness report you can give an insurer, a customer or a tender is a concrete deliverable, not just a dashboard. - **Human coaching on demand.** Actual people to translate the jargon — rare and valuable for this audience. ## What it doesn't do well - **It is not an AI tool.** Despite sitting in this directory, the public product makes no AI claim; the "AI" is a stated future direction, not a feature. - **It guides, it doesn't protect.** No AV, EDR, email filtering or control enforcement. You still need actual security software and to do the work. - **Data residency isn't published.** For a cyber security tool that scans your M365/Google settings, the absence of a clear "your data stays in Australia" statement and named certifications (ISO 27001, SOC 2) on the security page is a notable gap. Ask before you connect your environment. - **The price needs justifying for a sole trader.** A$149/month is real money for guidance you could partly self-serve via the free ACSC small-business guide. The value is the structure and coaching, which not everyone needs. - **Limited public detail on the discounts.** The micro-business/NFP discount is "apply to find out," and the annual discount isn't quantified publicly. ## Australian fit **Built here, priced here.** Cynch is Melbourne-founded (2017), bills in AUD, and frames its guidance around Australian baselines — the ACSC Essential Eight and ISO 27001 alignment. This is about as Australian as a cyber tool gets, and it's the publication's strongest reason to feature it. **Data residency.** Here's the honest gap. Cynch's security page describes encryption in transit (256-bit SSL) but does not state where customer data is hosted, nor does it name any formal ISO 27001 or SOC 2 *certification* — its reports are described only as ISO 27001 "Aligned". For a tool you'll connect to your Microsoft 365 or Google tenant, that's a question worth asking directly before you sign up: where is my data stored, and is it onshore? We'd expect an Australian SMB-focused vendor to host onshore, but no public Cynch page states an onshore-AU hosting commitment, so we won't present it as fact. **GST.** AUD billing from an Australian company means GST applies. The A$149 figure carries no GST line on the pricing page; confirm inclusive/exclusive on your invoice. A GST-registered business can generally claim the credit — check with your accountant. **Support and context.** On-demand human coaching from a local team, with Essential Eight and Australian small-business context baked in. Cynch does not publish specific AU support hours or a phone line on these pages. **The caveat that matters most:** Cynch does not replace qualified professional advice, and it does not by itself make you secure or compliant. It is a guide. Pair it with real controls and, for anything serious, a professional. Australian Fit score: 5/5. ## Alternatives - **The ACSC Small Business Cyber Security Guide (free).** The Australian government's own plain-English guide covers much of the same ground at no cost. Consider this first if you're disciplined enough to work through it yourself and don't need coaching or a report. See cyber.gov.au. - **Your MSP or IT provider.** If you already pay someone to run your IT, ask them to assess you against the Essential Eight — you may be paying for Cynch's job twice. - **A dedicated security awareness or protection tool.** If what you actually need is staff phishing training or endpoint protection rather than guidance, Cynch is the wrong shape — those are different products that *do the protecting* Cynch only points you towards. ## Bottom line Cynch Security is a well-made, genuinely Australian answer to a real problem: small business owners who know they should "do something about cyber" and have no idea what. It assesses you, scans your Microsoft 365 or Google settings, and hands back a short, plain-English, Essential Eight–aware to-do list — with humans to ask when you're stuck. For the non-technical sole trader or small operator, that structure is worth paying for, and the validated report earns its keep at insurance renewal or tender time. Two honest caveats keep it at four stars rather than five. First, it is **not an AI tool** in any meaningful sense — its place in this directory rests on its fit for our reader, not on AI credentials, and we'd rather say that plainly than oversell it. Second, it **guides rather than protects**: it will tell you to turn on MFA, but you still have to do it, and you still need real security software underneath. The unpublished data-residency position is the one thing we'd press the vendor on before connecting a live environment. Recommended, with eyes open, for the audience it's built for: the Australian small business owner who wants a guided, no-jargon path to better security. Just don't buy it expecting AI, and don't mistake a good map for the territory. ## Score | Criterion | Score | Why | | --------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Value for Money | 2/5 | One clear AUD price, real no-card trial, micro/NFP discounts; marked down hard because A$149/month (roughly A$1,800 a year) is steep for a sole trader against the free ACSC guide that covers much of the same ground | | Ease of Use | 5/5 | Built end-to-end for non-technical owners — guided assessment, plain-English bite-sized tasks, human coaching to decode jargon | | Feature Depth | 3/5 | Strong at assessment, scanning, prioritised guidance and reporting — but it advises rather than protects, and has no real AI feature despite the category | | Australian Fit | 5/5 | Melbourne-built since 2017, AUD pricing, Essential Eight + ISO 27001 framing, local coaches — the most Australian tool we've reviewed | | Reliability & Support | 3/5 | On-demand human coaching is a plus; marked down for no published data-residency, no named ISO 27001/SOC 2 certification, and no public uptime/status page | | **Total** | **18/25** | **⭐⭐⭐⭐ Very Good** | *Australian Fit gate: 5/5 — gate passed. (Note: the 18/25 total sits in the four-star band on its own, so the Australian Fit cap is not the binding constraint here; the Australian Fit gate is comfortably cleared.)* Update history - **7 Jun 2026** — First reviewed. ## Frequently asked questions ### Is Cynch Security available in Australia? Yes — it's built here. Cynch is Melbourne-founded (2017), bills Australian businesses, and frames its guidance around Australian baselines like the ACSC Essential Eight and ISO 27001 alignment. About as Australian as a cyber tool gets. ### Does Cynch charge in AUD? Yes. Cynch publishes a single simple AUD price: A$149/month per business (annual billing available at a discount). GST applies as an Australian company billing in AUD — confirm whether the A$149 is inclusive or exclusive on your tax invoice. ### Is there a free trial? Yes. A full 14-day trial with unlimited platform access and no credit card required. After that you're invoiced for continued access and can cancel any time. Significant discounts are available for new, micro and non-profit businesses on application. ### Is Cynch actually an AI tool? Not in any meaningful sense. Its public product is assessment, configuration scanning and human coaching — no public page makes an AI claim beyond a stated future direction. It earns its place on Australian fit, not AI credentials. ### Does Cynch protect my business or just advise it? It guides, it doesn't protect. Cynch tells you what to fix — turn on MFA, fix a sharing setting — but has no antivirus, EDR or email filtering. You still need real protective controls underneath, and its data-residency position isn't published, so ask before connecting your environment. ## Read next - Category guide: [Best AI Cybersecurity Tools for Australian Small Businesses (2026)](https://www.theaidirectory.com.au/roundup-best-ai-cybersecurity-smb-australia-2026/) ## Sources 1. Cynch Security — About (Melbourne HQ, founded 2017, founders Adam Selwood & Susie Jones, mission, 2,000+ organisations, "Human-in-the-Loop" AI/automation + GenAI integration mention) — https://cynch.com.au/about — Wayback: http://web.archive.org/web/20260607134730/https://cynch.com.au/about — checked 7 June 2026 2. Cynch Security — Pricing (A$149/month per business, 14-day no-card trial, annual discount, micro/new/NFP discounts, plan inclusions) — https://cynch.com.au/pricing — Wayback: https://web.archive.org/web/20260607203041/https://cynch.com.au/pricing — checked 7 June 2026 3. Cynch Security — Small Business Cyber Security (prioritised bite-sized tasks for non-technical teams, Essential 8 reference, ISO 27001-aligned reports, advisory-only output) — https://cynch.com.au/small-business-cyber-security — Wayback: http://web.archive.org/web/20251125145116/https://cynch.com.au/small-business-cyber-security/ — checked 7 June 2026 4. Cynch Security — Membership (unlimited assessments, M365 & Google scanning, on-demand coaching, "translate Geek Speak into action", Essential 8 / Application Control framing) — https://cynch.com.au/membership — Wayback: http://web.archive.org/web/20241019174657/https://cynch.com.au/membership — checked 7 June 2026 5. Cynch Security — Homepage (cyber fitness platform, validated cyber fitness report for insurers/customers/tenders, supply-chain/partner portal) — https://cynch.com.au/ — Wayback: http://web.archive.org/web/20251125142653/https://cynch.com.au/ — checked 7 June 2026 6. Cynch Security — Website security and privacy (encryption in transit, no published data-residency or named ISO 27001/SOC 2 certification) — https://cynch.com.au/security — Wayback: http://web.archive.org/web/20260311043352/https://cynch.com.au/security — checked 7 June 2026 7. Australian Cyber Security Centre — Essential Eight (framework context, secondary/official) — https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight — Wayback: http://web.archive.org/web/20250216113858/https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight — checked 7 June 2026 *The AI Directory Australia is an independent editorial publication. We don't accept payment for positive reviews. Read our* [*Methodology*](https://www.theaidirectory.com.au/methodology/) *and* [*Affiliate Disclosure*](https://www.theaidirectory.com.au/affiliate-disclosure/)*.*