Biz Secure Online — User Handbook
The complete user guide to Biz Secure Online: create and secure your account, add and organise your websites, run security scans, read your report, run an Essential Eight compliance assessment, share branded reports, manage plans and billing, and invite your team.
Your guide to monitoring and protecting your websites with Biz Secure Online.
Version: August 2026 release · Covers the Biz Secure Online portal (web app)
Welcome
Biz Secure Online (BSO) keeps an eye on your websites so you don't have to. You add the web addresses you care about, and BSO regularly scans them for security weaknesses, performance problems, and other issues that could hurt your business or your customers' trust. After each scan you get a clear, plain-English report — a security score, a list of what needs attention, and practical steps to fix it.
BSO also helps you answer a harder question: can you evidence your security position? The Essential Eight compliance area walks you through the Australian Signals Directorate's baseline, control by control, and produces a signed report you can hand to an insurer, a client or a tender.
This handbook walks you through everything the portal can do, from creating your account to signing off a compliance assessment. You don't need any technical background to follow it. Where we mention a security term, we explain it in everyday language.
How this handbook is organised
Monitoring your websites
- Getting started — creating your account and securing it
- Your dashboard — the home screen, at a glance
- Adding and organising your websites — domains and companies
- Running scans — automatic and on-demand
- Understanding your report — a section-by-section walkthrough
- Sharing reports and branding them as your own
Essential Eight compliance
- Essential Eight compliance — what it is, and how to get it
- Running an assessment — the workflow, step by step
- Your Essential Eight report — signing off and sharing
Your account
- Plans and billing
- Working as a team — inviting members
- Managing your account — devices, passwords and closing your account
- Troubleshooting and FAQ
A note on availability: everything described in this handbook is live now. Essential Eight compliance needs a company licence and nothing else — it is sold on its own, with no scanning subscription required; Chapter 7 explains how that works. Five team members are included once you pay for a website. Where a feature is genuinely not built yet, we say so plainly rather than implying it is coming.
1. Getting started
What you'll need
- A business email address
- A website (or several) that you want to monitor
- A smartphone with an authenticator app, for secure sign-in (we explain this below)
Creating your account
Go to the Biz Secure Online sign-up page and you'll see a short three-step guide at the top: Create account → Secure with 2FA → Start scanning.
Fill in the registration form:
- First name and Last name
- Business name — this becomes the name of your first company in BSO and appears on your reports (you can change it later)
- Work email — you'll sign in with this
- Password — at least 8 characters
- Confirm password
You'll also see two checkboxes:
- Authorised Scanning & Lawful Use Consent (required) — by ticking this you confirm you're allowed to scan the websites you add. You can only submit the form once this is ticked.
- Marketing communications (optional) — tick this if you'd like product news and tips by email.
There is no "account type" to choose — every account works the same way, and you can grow from a single website to managing many companies and websites without switching plans-types or starting over.
Tip — pricing in your currency. If you arrived from the Biz Secure Online marketing site, your local currency (Australian dollars, British pounds, US dollars, or euros) is detected automatically and carried through to checkout. You don't need to set it manually.
Securing your account with two-factor authentication (2FA)
Biz Secure Online protects every account with two-factor authentication. This means that, on top of your password, signing in also requires a one-time code from an app on your phone. Even if someone learned your password, they couldn't get in without your phone.
Setting it up takes a minute and is required — your account isn't active until it's done:
- After registering, you'll see a QR code on screen.
- Open an authenticator app on your phone. Any of these work: Google Authenticator, Microsoft Authenticator, Authy, or 1Password. (If you don't have one, install it from your phone's app store first — they're free.)
- In the app, choose to add a new account and scan the QR code. If you can't scan, tap "enter a setup key manually" on the BSO screen to type in a code instead.
- Your app now shows a 6-digit code that changes every 30 seconds. Type the current code into BSO and select Verify & Activate Account.
That's it — your account is secure and active. From now on, each time you sign in you'll enter your password and then the current 6-digit code from your app.
Keep your phone handy and your app backed up. If you ever lose access to your authenticator, see "I've lost my authenticator app" in the FAQ — there's a safe recovery path.
Signing in
On the sign-in page:
- Enter your email and password, then continue.
- Enter the 6-digit code from your authenticator app.
You'll land on your dashboard. (If you started a paid plan during sign-up, you may be taken to the secure checkout first to finish that.)
2. Your dashboard
Your dashboard is the home screen and the quickest way to see how all your websites are doing. It's organised around companies (groups of websites) so that even with many sites, everything stays tidy.
What you'll see
A site-down alert (only if something's wrong). If any of your websites appear to be offline, a banner appears at the top listing them, with a link to investigate. If everything's healthy, you won't see this.
Company cards. Each company you've set up gets its own card, showing the company's name, a "Primary" badge on your main company, and how many websites it contains. Inside each card, every website has its own scan tile.
A scan tile for each website, showing:
- The website address
- A Scan button to run a fresh scan on demand (available on any website you pay for)
- The date of the latest scan, the security score, a status badge, and a "View Report →" link
- Four pillar cards that summarise the site at a glance:
- Security — how exposed the site is to attackers
- Performance — how fast the site loads
- Technology — what the site is built with, and whether anything's out of date
- SEO & Visibility — how well the site is set up to be found and understood by search engines
- Each pillar shows a simple status and a one-line plain-English summary.
- A Risks list highlighting the most important issues found
- A Scan history you can expand to see every past scan, each linking to its report (this only appears once a site has more than one scan)
An "Unassigned" bucket. If you add a website but haven't yet placed it into a company, it lands in an amber "Unassigned" group as a safety net, with a reminder to assign it (see Chapter 3).
An Essential Eight row on each company card. What it shows depends on where that company stands:
- Not licensed — a short note that Essential Eight isn't included in your current plan, with a Learn more → button explaining how to add it.
- Licensed, no assessment yet — an invitation to begin, with Start assessment →.
- Assessment under way or finished — the current stage, how many of the eight strategies are met, and a Continue or View report button.
See Chapter 7 for what Essential Eight is and how licensing works.
Live updates. When a scan is running, the dashboard refreshes itself every few seconds so you can watch the result come in without reloading the page.
3. Adding and organising your websites
In Biz Secure Online, each website you monitor is called a domain, and domains are grouped into companies. Most people start with one company (created automatically from your business name at sign-up) and add a few domains to it. If you manage sites for several distinct businesses or brands, you can create more companies to keep them separate.
Adding a website (domain)
Go to Domains in the menu and select Add Domain. In the pop-up:
- Enter the website address.
- Choose the company it belongs to (it defaults to your first company).
- Choose how often it should be scanned — daily, weekly, or monthly. Options your plan doesn't include are shown as "Upgrade required."
Select add, and your website is now monitored. Its first scan will run according to the schedule you chose.
Why scan frequency matters. More frequent scans mean you find out about new problems sooner. A free account is scanned monthly. Any website you pay for can be set to daily, weekly or monthly — chosen per website, so a critical site can run daily while a brochure site runs monthly. See Chapter 10.
The Domains page at a glance
The Domains page lists all your websites in a table (or as cards on a phone), showing for each one:
- The address
- A status badge — Online, DOWN, Scanning…, Pending…, Failed, No scans yet, or Inactive (which means the site is over your plan's limit — see below)
- The latest security score
- An uptime figure (how reliably the site has been online)
- A small "last 8 checks" strip of dots, giving you an instant read on recent availability
- The date of the next scheduled scan
Editing or removing a website
- Edit lets you change a website's company and/or its scan frequency.
- Delete removes the website and all of its scan history (you'll be asked to confirm, because this can't be undone).
- A website marked Inactive (because it's beyond your plan's limit) can still be deleted, but won't be scanned until you free up a slot or upgrade.
Organising websites into companies
Go to Settings → Companies to manage your company groups. Here you can:
- Create a new company
- Rename a company
- Delete a company (only if it has no websites in it, and never your last one)
- Move websites between companies using the dropdown next to each one (you can also send a site back to "Unassigned")
A few rules keep things tidy:
- Your Primary company is your anchor — it can be renamed but never deleted, and you'll always have at least one company.
- A company name must be 4–50 characters, include at least two letters or numbers, and avoid unusual control characters. (This keeps names looking clean on dashboards and reports.)
You'll also see a small read-only summary of your account's allowances here — your plan, the number of team member seats included, and your Essential Eight company licences. Each company shows an E8 Licensed or E8 Available badge, and licensed companies offer Release licence (Chapter 7 explains what that does, and why it is not a casual action).
Companies matter more than they used to. A company is now the unit of compliance as well as a folder for websites: each company gets its own Essential Eight assessment, its own evidence, and its own report. If you assess two businesses, they need to be two companies.
4. Running scans
A scan is a thorough automated check of one website. Biz Secure Online runs scans two ways:
- Scheduled scans run automatically on the frequency you set for each website (daily, weekly, or monthly). You don't have to do anything — results simply appear, and you'll get an email when a scheduled scan finishes (see Chapter 13).
- On-demand scans let you run a check right now, rather than waiting for the next scheduled one. Use the Scan button on a website's tile (on the dashboard) or its row (on the Domains page). On-demand scanning is available on any website you pay for.
While a scan runs, its status shows as "Scanning…" and the dashboard updates automatically. A typical scan takes a short while to complete; when it's done, the tile fills in with the new score and findings, and a fresh report is ready to view.
What gets checked. Every scan looks at your site's security exposure, performance and loading speed, the technologies it runs, its search-visibility setup, and whether it's online — all explained in the next chapter.
5. Understanding your report
The report is where Biz Secure Online turns a scan into something you can act on. It's written to be readable by anyone — each section has a "What does this section mean?" explainer that tells you what it is, why it matters, and how it could affect you. Open any website's latest scan from the dashboard or Domains page to see its report.
Here's what a report contains, top to bottom:
Header. The website address, when the scan ran, how long it took, and a Share Report button (covered in Chapter 6).
Executive summary. A short, plain-language overview of the most important findings, when available.
Site status. Whether your site is up or down, plus how reliably it's been online over time (its uptime percentage).
Security score and risk counts. A score out of 100 that sums up your site's security health, alongside counts of issues by seriousness — Critical, High, Medium, and Low — and the total number of issues found. Critical and High are the ones to tackle first.
Site performance. How quickly your site loads on mobile and desktop, key speed measurements (the things that affect how fast a page feels to a visitor), and the top opportunities to make it faster.
Open ports. "Ports" are the doors into the server that hosts your site. This section lists any that are open to the internet, rates the risk, and suggests what to do — closing unnecessary doors reduces the ways an attacker could get in.
SSL/TLS (your security certificate). This is what puts the padlock in the browser and encrypts traffic to your site. The report shows whether your certificate is valid, who issued it, when it expires, and an overall grade — so an expiring or weak certificate never takes you by surprise.
Detected technologies. The software your site is built with (for example, the platform, frameworks, and plugins). Knowing this helps you understand what needs keeping up to date.
Domain registration (WHOIS). Public registration details for your web address — who it's registered through, key dates, and the technical records that point your address to your site. Useful for spotting an approaching renewal or a misconfiguration.
SEO & visibility. How well your site is set up to be found and correctly displayed by search engines and social media — page titles and descriptions, social sharing previews, and common issues that can hold your visibility back.
WordPress details (if your site uses WordPress). The WordPress version, theme, and a list of plugins, with any known-vulnerable ones flagged — plus a warning if your site is leaking usernames. Keeping WordPress and its plugins updated is one of the most effective things you can do for security.
Web application firewall notice (if detected). A note if your site is sitting behind bot or attack protection.
Security issues. The full list of findings, sorted with the most serious first, each with an explanation.
AI prompts for resolving issues. Ready-to-use prompts you can copy and paste into an AI assistant (such as ChatGPT or Claude) to get step-by-step help fixing a specific finding. A convenient shortcut if you or your web person want guided remediation.
No PDF download — share a link instead. Scan reports are shared as a secure web link rather than a downloaded file. See Chapter 6. (Essential Eight compliance reports are different — those do offer a PDF, covered in Chapter 9.)
6. Sharing reports and branding them
Sharing a report
Open a report and select Share Report. Biz Secure Online creates a public web link to that report and copies it to your clipboard automatically. Anyone you send the link to can view the report in their browser — no Biz Secure Online account needed. This is handy for sending results to a client, a colleague, or your web developer.
Making reports your own (white-label branding)
If you'd like shared reports to carry your business's name and logo rather than ours, go to Settings → White-label. Here you can:
- Upload your logo (PNG, JPG, SVG, or WebP image, up to 500 KB)
- Enter your business details — name (required), tagline, website, contact email, phone, and address
A live preview shows how your report header will look. Once set, your branding appears on every report you share, so they look like they came straight from your business.
7. Essential Eight compliance — what it is, and how to get it
What the Essential Eight is
The Essential Eight is a cyber security framework from the Australian Signals Directorate (ASD). It sets out eight practical measures that block most common attacks — ransomware, phishing, business email compromise, unauthorised access and data theft. Each measure has maturity levels, from ML0 (not aligned) up to ML3.
Biz Secure Online covers Maturity Level 1, which is the level most small and medium organisations should reach first. That is 48 individual controls across the eight strategies. Maturity Levels 2 and 3 appear in the portal marked "coming soon" and cannot be selected.
What the portal gives you
A guided self-assessment. You work through all 48 controls at your own pace, recording what your business actually does, attaching evidence, and rating how strong that evidence is. At the end you get a signed report with a shareable link.
Be clear on what this is. The portal helps you assess your own organisation, and the report says so on its face. That is genuinely useful for insurers, tenders and boards. It is not the same thing as an assessment conducted by someone independent of your business. If you need that, it is a consulting engagement — talk to us.
What you'll need
| Plan | None required. Essential Eight is sold on its own — you do not need to be paying for website scanning. |
| Licence | At least one Essential Eight company licence. This is the only requirement. |
| Time | Realistically a few sittings. Your progress is saved as you go, and nothing expires. |
| Information | Who your IT is run by, how staff sign in, how machines are patched and backed up, and who has administrator access. |
Buying a licence
Go to Settings → Subscription and find the Essential Eight Compliance panel. Choose how many companies you want to license using the stepper, and continue to the secure checkout. Pricing is per company, per month, shown in your own currency.
Your first purchase includes a 14-day free trial — the button reads "Start 14-day free trial". The trial is offered once per account; after that the button reads "Buy company licences".
How licences attach to companies
A licence sits in a pool until it is used. It attaches to a specific company the moment you activate that company's first assessment, and it stays there. The Subscription panel shows "N of M in use" and lists every company as Licensed or Available.
To move a licence to a different company, go to Settings → Companies and use Release licence. Read that screen carefully:
⚠️ Releasing a licence permanently deletes that company's Essential Eight findings, evidence, exceptions and reports. The portal asks you to download a CSV copy first and then to type the company's name to confirm. There is no undo.
Changing your website subscription does not affect Essential Eight. They are separate subscriptions, so you can stop paying for scanning and keep your compliance work, assessments and evidence intact. Cancelling Essential Eight itself is a deliberate, separate action from the Essential Eight section of Settings → Subscription — it makes you export a copy and type a confirmation phrase before it will proceed, because it permanently deletes your assessment data.
If you can't see it yet
Open Compliance in the menu and the portal will tell you exactly what's missing:
-
No company licence yet — an "Add Essential Eight compliance" card with the price and a Set up Essential Eight button. There is no plan to upgrade to first.
-
You're an invited team member — "Essential Eight is not set up for your organisation yet". Ask your account owner; only they can buy licences.
Choosing which company to assess
Compliance always works on one company at a time. If your company switcher is set to All companies, the Compliance area shows a chooser instead of the workflow — pick a company and it opens that company's assessment. Companies with work already under way are highlighted.
Each company can have one active assessment at a time. If you try to start a second, the portal tells you rather than letting you split your effort across two.
8. Running an assessment — the workflow, step by step
Compliance has its own left-hand menu, headed ESSENTIAL EIGHT. The steps below match it. A green dot means that step is complete; amber means it needs attention. Findings, Evidence and Exceptions stay greyed out until the assessment is activated.
Your assessment moves through these stages:
| Stage | What it means |
|---|---|
| Open | Created. You're defining scope and sampling. Nothing is locked. |
| In progress | Activated. Scope is locked; you're recording findings and evidence. |
| Under review | All checks actioned. Ready to sign off. |
| Completed (informal) | Finished as an internal pre-audit snapshot, without a signed report. |
| Reported | Signed off. The report is final. |
| Archived · On hold · Withdrawn | Closed states. |
Step 1 — Create the assessment
Select + New assessment. A four-step wizard walks you through Basic info → Organisation → Scope preview → Review:
- Basic info — a name for the assessment, the target maturity level (ML1), and your assessment window. The window defaults to today plus six weeks; it is a planning aid, not a deadline the portal enforces.
- Organisation — read-only confirmation of the company being assessed.
- Scope preview — an explanation of what comes next.
- Review — check it over and select Create assessment.
Your typing on step 1 is saved in your browser tab, so navigating away won't lose it.
Step 2 — Scope
The Scope Worksheet is where you describe what is being assessed. Each box takes one item per line:
- Business units — the parts of the business in scope
- Sites and locations — offices, sites, or "remote / home-based"
- Domains and online services — websites and cloud services
- Asset inventory — counts of workstations, servers, mobile devices and user accounts
- Exclusions — anything deliberately left out, each with a justification of at least 20 characters
Select Save scope. Nothing advances automatically; use the left menu to continue.
Be honest about exclusions. An exclusion with a real reason is a normal part of a defensible assessment. An exclusion with a vague reason is the first thing a sceptical reader will pick at.
Step 3 — Sampling
Sampling approach confirms how much of your estate you examined. At Maturity Level 1 the portal uses 100% coverage — every asset in scope, not a sample. The justification sentence is written for you from your asset counts and updates as you adjust them. Select Save sampling.
Step 4 — Activate
Activation is the point of no return for your scope, so the portal asks you to confirm three things in an Activate assessment dialog:
- Scope is defined ✓
- Sampling is confirmed ✓
- Who is conducting this assessment? — choose whether you are external to or an employee of the company being assessed, and give the responsible party's name.
The dialog also tells you whether an assessor credential is on file for you (see Assessor profile below). If none is, the assessment is permanently recorded as a self-assessment — that cannot be changed afterwards.
⚠️ Activating the first assessment for a company uses one Essential Eight licence and locks it to that company. The dialog says so before you commit.
Activation locks your scope, sampling and declaration, and moves the assessment to In progress.
Step 5 — Record your findings
Findings lists all 48 controls, grouped by the eight strategies. Open a control and record:
The outcome. Six choices, each with a one-line explanation:
| Outcome | Use it when |
|---|---|
| Effective | The control is in place and working. |
| Alternate Control | You do something different that achieves the same protection. Raises an exception — see below. |
| Ineffective | The control exists but isn't doing its job. |
| No Visibility | You cannot tell one way or the other. |
| Not Implemented | The control isn't in place. |
| Not Applicable | The control doesn't apply to your environment. Needs a justification. |
Controls you haven't reached yet sit at Not Assessed. That is the starting state, not something you choose, and it is what the readiness check counts as outstanding.
A justification. Say what you actually do and how you know. There is a ✦ Draft with AI button beside the field that writes a first draft once you've picked an outcome; it fills the box and flags itself with "AI-drafted — review and edit before saving." Always read and edit it. It is a starting point written from the control's requirements, not a statement about your business, and the report marks AI-assisted justifications with a badge.
AI drafting is always on. Compliance → Settings shows it as Always on; there is no way to switch it off. Nothing is drafted unless you press the button.
Evidence quality. A field labelled Self-assessed evidence quality — Excellent, Good, Fair, Poor or None. (If your assessment was activated by someone with a declared credential, it reads Assessor-rated evidence quality instead.) This is your judgement, not a calculation — the portal does not work it out from what you attached.
Grade honestly. If you mark a control Effective on Poor evidence, the portal asks you to tick an extra box acknowledging the residual risk, and the report shows it. A report that overstates your position is worth nothing to the person reading it.
Select Save finding. Findings are append-only — each save is recorded, so there's a full history of how an answer changed.
Step 6 — Attach evidence
Evidence is attached from the control itself, in the Supporting Evidence section. Select + Add URL and give:
- the link — to a policy document, a configuration screenshot in your own storage, a vendor console, anything a reader could check
- a short description, e.g. "MFA policy document"
Notes on how this works:
- Evidence is a link, not a file. There is no upload — you point at a document you host.
- Up to 20 items per control.
- Items inherit the evidence-quality rating you gave the finding; there's no per-item rating.
- Dismiss removes an item, and asks you for a reason.
Scan evidence arrives on its own. Findings from your BSO website scans attach themselves to the relevant controls and appear in plain English — for example "No critical or high vulnerabilities detected" alongside the date it was scanned. Five controls are covered this way, mainly the patching ones. Scan-ingested items cannot be dismissed, because they are a record of what was observed rather than something you asserted.
The Evidence menu item gives you a read-only view of everything across the whole assessment, grouped strategy by strategy. Add and remove from the control pages; browse here.
Step 7 — Exceptions
An exception records a place where you protect yourself differently from the way the framework describes. You raise one by choosing Alternate Control on a finding, which opens an inline panel asking for:
- the compensating control — what you do instead
- residual risk before and after it
- how long it should stand, in months, and a review date
The exception is created as a Draft. On the Exceptions page you then Submit for approval →, and finally Approve exception. You can Withdraw an exception at either stage; that cannot be undone.
Approval today is a simple in-tool confirmation. By approving, you're confirming the compensating control reduces the risk to a level you accept. A formal step-up authentication ceremony is planned but is not built yet, and the portal says so on the screen.
Step 8 — Readiness check
Readiness is a completeness check with three gates:
- All controls recorded — every in-scope control has a finding. Not Applicable counts; Not Assessed doesn't.
- All exceptions submitted — nothing left in Draft.
- All exceptions resolved — nothing left waiting for approval.
Each gate has a link that takes you to whatever is outstanding. When all three are green, Complete assessment becomes available and moves the assessment to Under review.
⚠️ These gates check that you have finished, not that you have passed. All three green means every control has an answer — it does not mean you met Maturity Level 1. Your actual maturity is on the report.
9. Your Essential Eight report — signing off and sharing
What the report contains
| Section | What's in it |
|---|---|
| Maturity determination | Whether ML1 was achieved, with strategies met and controls effective |
| Basis of assessment | Who assessed, their relationship to the organisation, and any declared credential |
| Assessment scope | Business units, locations, domains, asset inventory and exclusions |
| Sampling approach | Your coverage statement and when it was confirmed |
| The eight strategies | Met / Not Met / Incomplete for each, expandable to every control, its justification, evidence quality and evidence links |
| Exceptions | Each exception in full, with its status |
Signing off
Select Sign off → to open the sign-off ceremony. It shows your maturity determination and a summary, then asks you to tick a single declaration:
- as a self-assessment — that the findings accurately reflect your organisation's security posture to the best of your knowledge
- as a credentialed assessment — that you conducted the assessment and the determinations are your own
Select Sign off assessment. This cannot be undone. The assessment becomes Reported and the report is final.
Finishing informally instead
If you're using the assessment to find out where you stand rather than to produce something for a third party, use Finish as informal on the report while it is Under review. The assessment is marked Completed (informal), and the report carries an amber banner making clear it is an internal snapshot and not a signed assessment — a printed copy is watermarked as well. You can Reopen assessment later to keep working, or to sign it off properly.
Sharing the report
Every assessment gets a share link when it is activated. On the report you'll see a Share link row with Copy and Regenerate. Anyone with the link can read the report in a browser without a Biz Secure Online account.
Two things to know:
- The link does not expire. It works until you change it. (This is different from your scan report links, which do expire.)
- Regenerate is how you revoke it. Generating a new link immediately breaks every copy you have already sent out, including ones sitting in someone's inbox. That is the point of it — but it is all or nothing.
Downloading a PDF
Download PDF expands the whole report, hides the portal's menus, and opens your browser's print dialog — choose Save as PDF as the destination. Any report that has not been signed off is watermarked as informal when printed.
If you didn't reach ML1
A signed assessment that fell short of Maturity Level 1 offers Start review assessment → on the Overview. This creates a fresh assessment that carries over everything you already passed as 🔒 Locked, so you only re-work what didn't meet the mark. Two limits: it's available for two months after sign-off, and there is one review per signed assessment. Review assessments don't consume another licence.
Your assessor profile
Compliance → Settings → Assessor profile lets you record the name that appears on reports, your firm, and a professional credential with a reference and a public verification link.
Credentials are declared, not verified. Biz Secure Online records what you enter and the report states plainly that it is a declaration. Anyone reading the report can follow the verification link and check it themselves. Do not describe a completed course as an accreditation, and note that ASD does not accredit or certify individual Essential Eight assessors.
10. Plans and billing
There are no plans to choose between. You start free, and you pay for the websites you want watched. Prices are shown in your local currency (Australian dollars, British pounds, US dollars, or euros) — the figures below are Australian-dollar examples, and you'll see your own currency in the app and at checkout.
Free
$0 — no card, no time limit
- 1 website
- Monthly scans
- Site-down monitoring, speed test, and full web reports
- Public report sharing and white-label branding
- Email notifications
- 5 stored reports
- The Microsoft 365 connector
Websites
$13.99 per website / month — no minimum
- Buy one website or fifty, at the same price each
- Daily, weekly or monthly scanning, chosen per website
- On-demand scanning (the Scan button)
- 15 stored reports per website
- Adjust your website count up or down at any time
How pricing works. Your cost is driven by how many websites you monitor — not by any "account type". There is no minimum and no tier to move up. Scan frequency is yours to choose on every website you pay for; a free account is monthly only. "Stored reports" is how many past reports we keep per website before older ones roll off.
The other two things you can buy
Both live on Settings → Subscription:
Essential Eight Compliance. Licensed per company, per month, and sold on its own — you do not need to buy any websites first. A stepper picks how many companies you want to license, and the panel shows how many are in use and which companies hold them. Your first purchase includes a 14-day free trial. See Chapter 7.
Worth knowing. Your free website is scanned monthly, and what it finds attaches itself to the controls it evidences. But Maturity Level 1 asks for internet-facing patches within two weeks, and a monthly scan interval is longer than that window — it will find the issues, but it cannot evidence how quickly you responded. Weekly or daily scanning can.
Team members. Five are included as soon as you pay for a website. Beyond that you buy additional seats, priced per seat per month. The panel shows "Using X of Y team members (5 free + N purchased)". You can't reduce paid seats below the number currently in use — remove the people first. See Chapter 11.
Prices for both are shown in your own currency at checkout.
Managing your subscription
Go to Settings → Subscription to:
- See your current plan — websites used and allowed, scan frequencies, report retention, and renewal status
- Buy websites, or change how many you pay for (you'll be taken to our secure checkout)
- Downgrade (you'll be asked to confirm)
- Manage billing — opens the secure billing portal where you can update your card, view invoices, or cancel
- Adjust your website count with a simple stepper (1–50, no minimum); pricing updates live and is prorated
- Buy or adjust Essential Eight licences and team seats
Payments are handled by our payment provider's secure checkout — Biz Secure Online never sees or stores your card details.
⚠️ Cancelling Essential Eight deletes your assessment data. This is a deliberate, separate action — use Cancel Essential Eight compliance in the Essential Eight section of Settings → Subscription. It makes you download a CSV copy of each company's data and type a confirmation phrase before it will go ahead, and it tells you exactly how many assessments will be destroyed. Take the export.
⭐ Changing your website subscription does not touch Essential Eight. They are separate subscriptions. You can stop paying for scanning entirely and keep your compliance work intact.
11. Working as a team
Availability: Five team members are included once you pay for at least one website; additional seats are bought on Settings → Subscription. ⚠️ An account holding only an Essential Eight licence cannot buy extra seats today — it still gets the five free ones.
As your needs grow, you can invite other people to help monitor your websites and work on compliance. Biz Secure Online uses two simple roles:
- Owner — that's you, the account holder. The Owner manages companies, websites, billing, branding, and the team. There is exactly one Owner per account.
- Member — someone you invite to help. Members can view the websites and reports for the companies you assign them to, and run on-demand scans on any website you pay for. Members cannot add or remove websites, change scan frequency, manage companies, or touch billing — those stay with the Owner. Members also receive scan-complete and site-down/recovery email alerts for the companies they're assigned to, just as the Owner does.
What a member sees in Settings: the Profile tab only. Companies, Team, White-label and Subscription are the Owner's.
Members and Essential Eight. A member inherits the account's entitlement. If you've licensed a company, members assigned to that company can work through the assessment with you. If you haven't, they see a message telling them to ask the account owner — they can't buy a licence themselves.
Inviting a member
Go to Settings → Team (visible to the Owner). Then:
- Enter the person's email address.
- If you have more than one company, choose which company they should join.
- Send the invite. They'll receive an email with a link that's valid for 14 days.
Invites go out one at a time. Every member must belong to at least one company.
If you're on the Free plan, you'll see a prompt to upgrade instead of the invite form — team members are a paid-plan feature.
What your team sees
The member list shows everyone on your account with their role (Owner or Member), their status (Active, Invited, or Expired), and the companies they're assigned to. For each member you can:
- Resend an invitation that hasn't been accepted yet
- Change which companies they can access
- Remove an active member, or cancel a pending invitation
Accepting an invitation
When someone receives an invite, what happens depends on whether they already use Biz Secure Online:
- If they already have an account, they're asked to sign in (if they aren't already) and accept — then they immediately see the company they've been added to.
- If they're new, they go through a short sign-up — just their name and a password (the email is already filled in) — followed by the same quick 2FA setup all accounts use. They don't set up their own company or billing; they simply join yours.
12. Managing your account
Switching to a new phone (resetting your authenticator)
If you're changing phones, do this before you wipe the old one. Go to Settings → Profile → Two-Factor Authentication and select Reset Authenticator:
- Confirm your current password.
- Scan the new QR code with the authenticator app on your new phone (or copy the setup key manually).
- Enter the 6-digit code and select Confirm New Authenticator.
All your other active sessions are signed out when you do this, which is deliberate — if someone else had a session open, it ends.
If you've already lost access to your authenticator, use the "Lost access to your authenticator?" link on the sign-in screen instead. You'll get an email with a safe recovery path.
Changing your password
Settings → Profile. Enter your current password and a new one. As with an authenticator reset, this signs out your other sessions.
Closing your account
Settings → Profile → Close your account. What this does depends on who you are:
If you're the account owner, it permanently deletes the organisation. The screen shows you live counts before you commit — companies, monitored domains, security scans and reports, shared report links (which stop working), Essential Eight assessments, and team members who will lose access. Your subscriptions are cancelled and billing stops. Paid invoices are retained for the period Australian tax law requires. Your team members are emailed and lose access immediately, but their own logins are not deleted.
If you're a team member, it closes your login only. None of the organisation's data is touched — the domains, scans and assessments belong to the account owner.
Take a copy first. Owners are offered a Download CSV button for each company holding Essential Eight data, plus one for older assessments that predate per-company records — that export is the only way to keep those. Scan reports aren't exported in bulk; open the ones you want from the dashboard and use your browser's Print → Save as PDF.
Closing requires three things together: your password, your authenticator code, and typing the phrase DELETE MY ACCOUNT. Then Permanently close my account. You'll get a confirmation email.
13. Troubleshooting and FAQ
My website shows as "DOWN" — what does that mean? Biz Secure Online couldn't reach your site at the last check. You'll also get an email alert. It could be a genuine outage, maintenance, or a temporary network blip. The dashboard's "last 8 checks" dots and the uptime figure help you see whether it's a one-off or ongoing. When the site comes back, you'll get a "back online" email.
What emails will I receive? Biz Secure Online emails you when a site goes down, when it recovers, and when a scheduled scan finishes (with a link to the new report). If you're part of a team, members assigned to a company receive these same alerts for that company's websites. You'll also get standard emails for password resets, team invitations, and two-factor reset requests. Note that the scan-complete email is sent for scheduled scans; an on-demand scan you run yourself won't email you, since you're already watching it.
I've lost my authenticator app / got a new phone — how do I sign in? On the sign-in screen, after entering your password, use the "Lost access to your authenticator?" link. You'll get an email to safely set up a new authenticator. (If you still have access to your old phone and just want to switch devices, you can also re-set your authenticator from Settings → Profile without losing access in between.)
How do I change my password? Go to Settings → Profile, enter your current password and a new one. For your security, changing it signs out your other sessions.
A website is marked "Inactive" — why? It's beyond your current plan's website limit. Upgrade your plan or remove another website to bring it back into active monitoring. Inactive websites aren't scanned, but you can still delete them.
Can I download a report as a PDF? Reports are shared as a secure web link rather than a PDF download. Use Share Report to generate a link you can send to anyone.
Why does a scan take a little while? Each scan runs a thorough series of checks across security, performance, technology, and visibility. The dashboard updates automatically when it's finished, so you can carry on with other things in the meantime.
What is the "Essential Eight / Compliance" feature? It's a guided self-assessment against the Australian Signals Directorate's Essential Eight framework, at Maturity Level 1. It's live now, sold on its own with a company licence — no scanning subscription required. Chapters 7 to 9 cover it in full.
Why can't I see Compliance? Either you haven't licensed a company yet, or you're an invited team member on an account that hasn't set it up. Open Compliance and the portal will tell you which. See Chapter 7.
Can I download my Essential Eight report as a PDF? Yes. Download PDF on the report opens your browser's print dialog — choose Save as PDF. Reports that haven't been signed off print with an "informal" watermark.
Does my shared Essential Eight report link expire? No. It works until you regenerate it, and regenerating breaks every copy you've already sent. Your scan report links are separate and do expire.
Can I upload evidence files? Not at the moment. Evidence is a link plus a description — point at a document you host, and anyone reading the report can follow it. Findings from your BSO scans attach themselves automatically.
Can I turn the AI drafting off? No. Nothing is drafted unless you press ✦ Draft with AI, but there's no setting to remove the button. Anything it writes is marked for review before you save it, and the report labels AI-assisted justifications.
I finished every control — does that mean I passed? No. The readiness check confirms you've answered everything, not that you met Maturity Level 1. Your actual result is the maturity determination on the report.
Can I assess two businesses on one account? Yes, as separate companies, each with its own licence. Compliance works on one company at a time — use the company switcher.
Who can I contact for help? Use the Help & FAQ links in the menu and footer to reach our support and frequently-asked-questions pages on the Biz Secure Online website. Inside the compliance area there's also a Help & Glossary page explaining the eight strategies, the outcomes, the evidence-quality ratings and the assessment stages.
This handbook describes the Biz Secure Online portal as at the August 2026 release. Everything in it is live today. We keep the product improving, so some details may change — your in-app screens are always the final word.