How Cyber-Safe Is Your Business Quiz

An 8-question self-assessment quiz for Australian small businesses to check their cybersecurity basics, with an instant plain-language score.

You don’t need to be a security expert to know roughly where your business stands — you just
need to answer eight honest questions. This quiz takes about two minutes, needs no signup or email
address, and gives you a plain-language score at the end, along with what it actually means.

Answer as honestly as you can. The point isn’t to get a perfect score — it’s to find out where
the real gaps are, if any.

What the questions actually cover

Every question in this quiz was chosen to map directly onto a documented, common cause of real security
incidents — not a generic “best practice” checklist copied from elsewhere, but the specific gaps
that show up again and again when something actually goes wrong at an Australian small or medium
business.

Each question in this quiz maps to a specific, well-documented cause of real security incidents at
Australian small and medium businesses — not a hypothetical “best practice” checklist, but the
actual things that show up again and again in breach reports:

• Individual logins: shared accounts make it impossible to trace who did what, and
  rarely get updated when someone leaves the business.
• Multi-factor authentication: the single highest-impact control against account
  takeover, even when a password is compromised.
• Verifying payment requests: business email compromise remains one of the costliest
  attack types facing Australian businesses.
• Password managers: reused passwords are still one of the most common root causes of
  a breach.
• Device encryption: protects business data if a laptop is lost or stolen, beyond just
  the login screen.
• Managed endpoint protection: antivirus that’s installed but not actively managed
  often misses updates silently.
• Tested backups: a backup that’s never been restored is really just a hope, not a
  plan.
• Staff awareness training: most incidents still start with one person clicking one
  link — training measurably reduces that.

Why these eight, specifically

There are dozens of things a comprehensive security audit could check, but this quiz deliberately sticks
to eight fundamentals for a reason: these are the controls that, together, address the overwhelming
majority of real-world incidents affecting Australian small and medium businesses. Advanced protections
matter too, but they matter far less if these basics aren’t already in place — there’s not much
point in sophisticated threat detection if half the team is still sharing one login.

It’s also worth being honest about why these particular gaps are so common. None of them happen because
a business doesn’t care about security. They happen because security work competes for time against
everything else a growing business has to do, and unlike a broken printer or a missed delivery, a security
gap doesn’t announce itself until something goes wrong. That’s exactly why a structured check-in —
even a two-minute one like this — is useful: it surfaces the gaps before an incident does.

Why a self-check is worth doing even before talking to anyone

There’s value in going through an exercise like this yourself before bringing in outside help, and it
has nothing to do with saving money on a consultation. Working through the eight questions honestly forces
a moment of genuine reflection on parts of the business that rarely get deliberate attention —
most owners and managers have a rough sense of whether their marketing is working or their finances are
healthy, but far fewer have a clear, current picture of exactly what security measures are actually in
place versus assumed to be in place.

It’s also a useful exercise to repeat periodically, not just once. A business that scored well a year
ago may have added new staff, new software, or new ways of working since then, any of which can quietly
open new gaps. Treating this as a once-a-year check-in, rather than a one-time test, keeps the picture
current rather than stale.

A closer look at the two highest-impact questions

If you only fix two things from this quiz, make it these two — they carry a disproportionate
share of the real-world risk reduction.

Multi-factor authentication

MFA adds a second step to logging in — typically a code sent to your phone or generated by an
app — in addition to your password. Even if an attacker has your password (through a data breach,
phishing, or simple guessing), they still can’t get in without that second factor. Security researchers
consistently rank MFA as one of the single highest-impact, lowest-effort controls available, and most
major business email and cloud platforms now offer it for free. If it’s available and switched off,
that’s the fastest win on this entire list.

Verifying payment detail changes

This costs nothing to implement and takes seconds to apply, yet it’s the single control most likely to
stop a business email compromise attempt in its tracks. The rule is simple: any request to change bank
details for a payment, however convincing or urgent it looks, gets verified by phone using a number
you already have on file — never a number provided in the email itself.

Whatever you scored, here’s what actually matters

This quiz isn’t a pass/fail test, and a lower score isn’t a reason to panic — it’s genuinely
common, especially for growing businesses that have added staff and systems faster than their security
setup has kept up. What matters is knowing where the real gaps are, and tackling the highest-impact ones
first rather than trying to fix everything at once.

Sharing this with your team

This quiz works just as well as a team exercise as it does an individual one. Running it in a short
team meeting — even five or ten minutes — often surfaces useful discussion: different people
in the same business sometimes have different assumptions about what’s actually in place, which is itself
a useful thing to discover. A shared, accurate picture of where things stand is a better foundation for
deciding what to prioritise than any one person’s individual guess.

A closer look at the remaining questions

Individual logins vs shared accounts

It’s a common shortcut, especially in smaller teams: a new starter needs access quickly, so someone
shares their password “just for now,” and it becomes permanent. The problem isn’t just security in the
abstract — it’s accountability. If three people share one login, nobody can say with confidence who
sent a particular email, changed a particular file, or approved a particular payment. And shared passwords
almost never get changed when one of those people leaves the business, which means former staff can
retain access long after they should.

Password managers, specifically

The alternative to reusing a handful of memorable passwords everywhere is, in theory, using a unique,
complex password for every account — which is essentially impossible to do reliably without a tool
to help. Password managers solve this by generating and securely storing a unique password for every
login, so the only password you actually need to remember is the one for the manager itself. This turns
“use a strong, unique password everywhere” from an impractical piece of advice into something genuinely
achievable.

Device encryption

A login password stops someone from casually opening a laptop and browsing around. It does very little
against someone who removes the hard drive entirely and reads it directly on another machine — which
is exactly what disk encryption is designed to prevent. Most modern operating systems include built-in
encryption tools that take only a few minutes to switch on, turning a lost or stolen laptop from a
potential data breach into simply a hardware replacement.

Managed endpoint protection

There’s a meaningful difference between “antivirus software is installed” and “antivirus software is
actively managed.” Software that was installed once, years ago, and never checked again can silently fail
to update — missing the very threats it was meant to catch. Managed endpoint protection means
someone (either an internal IT resource or a provider like Comstel) is actively monitoring that coverage
stays current across every device, not just hoping it does.

Tested backups

A backup that runs automatically every night sounds reassuring — until the day you actually need
to restore something and discover the backup was silently failing, or missing the specific file you
needed, or corrupted in some way nobody noticed. The only way to know a backup genuinely works is to
actually test a restore periodically, not just confirm that the backup job completed without an error.

Staff awareness training

Technical controls matter, but most real-world incidents still start with a person clicking a link,
opening an attachment, or trusting a convincing email. Regular, brief awareness training — even
something as simple as periodic reminders of what a suspicious email looks like — measurably reduces
how often staff fall for these attempts, without requiring a large investment of time or budget.

Frequently asked questions

Is my quiz data stored or sent anywhere?

No — this quiz runs entirely in your browser. No answers are recorded or transmitted anywhere.

What’s a “good” score?

Above 80% suggests solid foundations are in place. Between 50–80% is common and usually means a
handful of specific, fixable gaps. Below 50% is worth a proper conversation sooner rather than later.

We scored well — do we still need to do anything?

A strong score is a great sign, but security isn’t a one-off project. Periodic reviews, especially as
your team grows, keep it that way.

Talk to Comstel ICT

Fill in the form below and a Comstel specialist will be in touch the same business day — or call
1300 070 747.

Error: Contact form not found.