SMB1001 Certification, sponsored by CrowdStrike

Your biggest client sends through a security questionnaire. Your insurer asks what protection sits on your laptops. A prospect wants to know if you are certified before they sign.

Proving your business is safe to work with has become part of winning work. And the cost of getting security wrong keeps climbing. Australian small businesses reported an average loss of $56,600 for every cybercrime report they made last financial year, up 14 per cent on the year before.

So we have put together an offer with CrowdStrike and CyberCert that covers both halves of the problem: the protection, and the proof.

What is on the table

Sign up to the CyberGrape GRC platform and connect CrowdStrike Falcon, and two things happen.

Your SMB1001 Gold certification is sponsored. CrowdStrike pays for your certification credit with CyberCert, the official SMB1001 certifier, through a programme called CrowdStrike Powered CyberCert Credits. We claim the credit on your behalf.

You also get 15 months of CrowdStrike Falcon for the price of 12. Three extra months of protection at no cost.

The offer is open to Australian and New Zealand businesses that are new to CrowdStrike, with 1 to 350 devices.

Why certification is worth having

SMB1001 is the cyber security certification standard built specifically for small and medium businesses. It runs across five levels, from Bronze through Silver, Gold and Platinum to Diamond, so you can start small and step up as you grow.

Gold is Level 3. It covers 27 controls, including multi-factor authentication across your apps, email protection, staff training, a written incident response plan, cyber insurance, and endpoint detection and response.

The value is not the certificate on the wall. It is being able to answer a client, an insurer or a board with something better than "we think we are fine".

The control that stops most small businesses

Most of Gold is achievable with good habits and the right settings. The one that trips people up is endpoint detection and response, usually shortened to EDR.

Traditional antivirus looks for threats it has seen before. It compares what is on your laptop against a list of known bad software. Attackers change their tools faster than those lists update, which is why so many businesses with antivirus installed still get hit.

EDR works differently. It records what actually happens on each device, so an attack can be spotted by its behaviour, traced back to where it started, and shut down. It is the difference between a lock on the door and a camera that shows you what happened.

CrowdStrike Falcon Enterprise includes EDR, and CyberCert confirms Falcon meets the Gold control directly. In SE Labs' 2025 independent testing, Falcon prevented 100 per cent of ransomware attacks. It runs as one lightweight app on each device, is managed from a single web console, and starts protecting within minutes of install.

Your evidence collects itself

Certification is one thing. Staying certified is another, and that is usually where the spreadsheets come out.

Once Falcon is connected to the CyberGrape GRC platform, we read your CrowdStrike data and check your SMB1001 controls for you, continuously. That covers antivirus on every device, whether your servers are patched, and whether EDR is genuinely running across your fleet.

One detail matters here. EDR coverage is measured against an independent device count from Microsoft Intune or your asset register, not from CrowdStrike's own numbers. Falcon does not get to grade its own coverage.

The same data does more work elsewhere. Every protected device lands in your asset register automatically. Your security score updates as your posture changes. If you are working towards ISO 27001 as well, the same coverage and detection evidence counts there too. And it all flows into reports your board can actually read.

How it works

Three steps, and we do most of them.

First, you subscribe to the CyberGrape GRC platform, which is where SMB1001 and the rest of your security programme live. Second, you choose Falcon Go, Pro or Enterprise, pay for 12 months and get 15, and we connect it to the platform. Third, we claim your CrowdStrike Powered CyberCert Credit, and your Gold certification is paid for.

What the offer does not cover

We would rather be straight with you than have you find out later.

The credit pays for certification, not the work to get there. Gold has 27 controls, and Falcon covers one of the harder ones. The platform shows you the exact gap and turns it into tasks, and we work through the rest with you.

The Falcon offer applies to 12-month subscriptions for businesses new to CrowdStrike, from 1 to 350 devices, and cannot be combined with other CrowdStrike discounts. Renewals are 12-month terms. The platform subscription is priced separately.

If you are aiming at Diamond, Level 5, that level asks for managed detection and response, which is a service where specialists watch and respond on your behalf. That is available on the Falcon platform through Falcon Complete, but it sits outside this offer.

Worth a 20-minute conversation

If you have been putting off certification because the cost or the effort felt out of reach, this is the cheapest that path has looked in a while.

Book a 20-minute call and we will confirm you qualify, count your devices, recommend the right level of Falcon, show you the platform and send you a quote. Start at [cybergrape.io/contact](https://cybergrape.io/contact) or email [email protected].