Practical guidance from investigators.

Checklist

What to do in the first hour of a cyber incident

A short checklist you can follow now, or send to someone who needs it.

The invoice that changed: how payment redirection fraud works

Business email compromise is one of the most common cybercrimes reported by Australian businesses. How it works, the warning signs, and what to do if you've paid.

Ransomware: why you shouldn't wipe and rebuild straight away

After a ransomware attack, rebuilding fast feels right. Doing it before evidence is preserved can cost you the answers your insurer, regulator and customers need.

Five signs your business email account has been compromised

A hacked email account is often the start of invoice fraud or a data breach. Five signs to check for, and what to do if you find them.

An employee has resigned. Should you be worried about your data?

Most departures are routine. Some aren't. The warning signs that a departing employee may have taken client lists or files, and how to protect the evidence.

What a digital forensic examiner actually does (and doesn't do)

A plain guide for solicitors, accountants and business owners: what digital forensics can establish, how evidence is preserved, and what to ask.

Do I have to report a data breach? The Notifiable Data Breaches scheme explained

A plain-English guide to the Notifiable Data Breaches scheme for Australian businesses: who it covers, what counts as an eligible breach, and the 30-day assessment rule.