Who Is Kane Nawrocki, and Why Does inSUPPORT Price Remediation Into the Fee?

Kane Nawrocki built inSUPPORT around a conviction that sounds simple until you see how often it gets missed: if an audit finds a problem, somebody needs to fix it. He has spent more than 25 years working in IT, from building servers as a teenager to running systems for Australian businesses. He knows how easily a security report can become one more thing a busy owner is left to deal with.

That is why inSUPPORT includes the remediation identified in its onboarding audit in the managed support fee. Kane's team runs the IT, works on the controls insurers ask about and coordinates cyber insurance through licensed partners for most managed clients. The insurance is a separately priced part of the overall package, with cover subject to the insurer's assessment. The technical work and the insurance conversation are meant to line up.

There is plenty of personality behind the model. Kane is direct, sometimes rough around the edges, and much more interested in whether something works than whether it sounds impressive. He will tell you what is wrong, what it will take to sort it, and where his team owns the job. His story explains why that promise is built into the way the company charges.

Kane, in brief

More than 25 years in IT, with experience across retail, mining, enterprise systems and managed support.
inSUPPORT grew from a simple frustration: security audits often identified problems that nobody had paid to fix.
The agreed remediation from the onboarding audit sits inside the support fee; insurance, backup and training are separately priced.
Kane still takes the first conversation. You can ask him how the model would work for your own environment.

Where 25 years in IT actually went
The night the business got its name
Why the remediation sits inside the fee
What Kane takes responsibility for
Questions people ask about Kane and the model

Where 25 years in IT actually went

He started at seventeen, building servers in a mate's parents' garage. From there his published account runs through mining-sector IT, where the big vendors paid for his certifications, the Telstra partner channel, data and business-intelligence work for national retailers, and a stint building service-management software. That is not a tidy career. It is the kind of path that puts one person in front of the same problem in a dozen different industries, which is worth considerably more than a tidy one.

The problem kept being the same. Small and medium businesses were being sold security in pieces, and the pieces never added up to actual protection. An audit from one company. A firewall from another. Backups that ran every night and had never once been restored. A policy renewal handled by a broker who had never seen the systems it was written against. Every piece was defensible on its own, and together they left the business exposed.

His summary of the answer is four short sentences, and they are on his own About page: find the best tools, make them work together, automate the process, lock it down. It sounds obvious until you notice how few providers do the second and fourth parts. Making tools talk to each other is unglamorous engineering that nobody sells, and locking things down means taking choices away from people who would rather keep them.

That is also where the standards come from. inSUPPORT holds Microsoft Cloud Services accreditation, and he is vendor-certified across the major security and infrastructure platforms. The longer version of that background is on the site, and the figures on this page match the ones published there.

The night the business got its name

The name arrived in 2022, in a conversation at the Crown in Perth between Kane Nawrocki and Matt Condy, now the company's Technical Experience Manager. The reasoning was blunt. Every IT shop in the country offered support, so support on its own had stopped meaning anything. The business would be inSUPPORT, and the "in" would stand for insured. The whole model was hiding in the name before the model existed.

Two decisions were locked in that night, and they still define the company. The security fixes identified in an onboarding audit belong in the support fee, and the team running the IT should also coordinate the cyber insurance pathway through licensed partners. That gives the business one joined-up plan for the controls, the evidence and the policy discussion. The insurers make the underwriting decision; Kane's team does the technical work and knows what is in place.

Two timelines sit close together in that story and careful readers keep merging them, so it is worth separating them. The brand did not start from a blank page. It came out of RIGA, Retail Innovation Group Australasia, a long-standing IT, tech and telco partner that worked predominantly in retail, and around 2020 RIGA became Real Innovation Group and moved into construction, automotive, professional services, agriculture, manufacturing and real estate. That is the parent company's history. The trading brand was named in 2022, and the two are not one story.

The retail heritage did not disappear, which is why there is a support tier built around late-night trading and Saturday mornings, when most helpdesks have long gone home. The trigger for turning the idea into a product was watching the Optus and Medibank breaches land on household names. It made something obvious: the small and medium market needed the same protection the big end of town had suddenly started scrambling for, and nobody was building it for them.

Why the remediation sits inside the fee

Here is the mechanism, because the mechanism is the whole argument. The traditional way to sell security to a smaller business is in three bills: one for the audit, one for the remediation, usually a good deal larger than the first, and a third for ongoing support. Each bill is legitimate on its own. The problem is the incentive underneath. When the audit and the fix are billed separately, every gap the provider finds is a new project for the provider, so the report gets longer, the quote gets bigger, and the business is left holding a folder of findings and a decision about which ones it can afford this year.

Pricing the remediation inside the support fee removes that incentive. The provider that identifies the gap is not rewarded with a second project for closing it, so the audit stops being a sales document and becomes a work order for jobs already paid for. That is checkable in a way adjectives never are. It is written into the published pricing and set out again in the 6 Step Cyber Strength System, and any buyer can ask a competing provider to point at the clause in their own agreement that says the same thing.

The honest version of the price is the version he insisted on. Support is charged per user per month: Business from $68, Retail at $100, and Complete round-the-clock cover at $135. That $68 is the support component only. Cyber insurance, backup and the security-awareness platform are separate, clearly quoted line items, and when earlier marketing described the offer as covering everything, he corrected it downward himself. Kane would rather a buyer see the separate lines clearly than discover them after signing. That is a more useful promise than “everything included”.

ASD suggests asking a managed provider how it secures and monitors its own systems, assesses them and responds to an incident. Kane would add a commercial question: what happens when your audit finds a problem? At inSUPPORT the agreed remediation belongs in the support fee, so the answer is a work plan rather than another sales proposal. The Cyber Strength Audit guide shows how the assessment works.

What Kane takes responsibility for

The clearest test of Kane's approach is what happens after a problem is found. His team audits the environment, agrees which gaps need work, and carries the remediation through as part of managed support. It does not make sense to him to charge a business to discover a problem and then leave the fix waiting for another purchase order. That decision is in the fee structure, not just the sales language.

He also wants the IT and insurance conversations to use the same facts. For most managed clients, cyber insurance is part of the overall package, with the policy arranged by licensed partners and shown separately on the quote. The controls an insurer asks about are managed as ongoing technical work. A provider cannot decide whether an insurer will offer cover or pay a claim, but it can know what is actually running and keep the evidence ready.

That practicality has boundaries. inSUPPORT works best with businesses of roughly 30 to 300 users that want a provider to run a standardised, secure environment. It works to the frameworks relevant to a client's industry, including applicable Essential Eight controls, and helps clients pursue ISO 27001 certification where appropriate. It describes its own position as ISO 27001-aligned. If your business wants to dictate every tool and exception, have that conversation with Kane early; he will explain what he can responsibly support.

He still takes the first call himself. Bring him the audit report, the confusing quote or the insurance questionnaire. You will find out quickly whether his model fits the job.

Questions people ask about Kane and the model

Who is Kane Nawrocki?

Kane Nawrocki is the founder and CEO of inSUPPORT, a Melbourne-based managed IT and cyber security provider working with Australian businesses of roughly 30 to 300 users. He has more than 25 years in IT, from building servers as a teenager to running enterprise security and compliance for Australian businesses, and he is vendor-certified across the major security and infrastructure platforms. The business has served 50 or more companies and has 1,500 or more cyber audits behind it.

What does 25 years in IT actually change about the way the work gets done?

It shows up as opinions rather than options. A provider without that mileage tends to present you with a menu and let you choose; someone who has restored enough broken environments arrives with a standard and explains why it is the standard. The practical difference for a business owner is where the thinking happens. You are not asked to adjudicate technical trade-offs you have no way of judging, and the reasons behind a decision are explained in plain English if you want them.

What actually happens once a business engages inSUPPORT?

It starts with an onboarding audit: a security audit, a gap analysis, and internal and external penetration testing, followed by a conversation about the negotiables, meaning what must change, what can be handled another way, and what stays as it is with the risk written down. An agreed remediation plan comes out of that and is worked through, with the remediation sitting inside the support fee rather than arriving as a separate project. The published timeframe for completing an agreed programme depends on what the audit finds, so ask for it against your own environment rather than a brochure figure.

What is the first step if I want to work with inSUPPORT?

Book a Cyber Strength Audit. It assesses your environment against the compliance frameworks that apply to your industry and against the technical controls a cyber insurer expects to see, and it ends with a plain-English report and a costed remediation path. There is no obligation, and there are two ways to start: book time with a person, or start the audit yourself through the self-service portal. Both are on the audit page.

Talk to the person behind the model Kane still takes the first conversation. Bring the awkward question about your current setup, the audit report nobody has acted on or the insurance renewal that asks for evidence you are not sure you have. A Cyber Strength Audit turns that conversation into a clear picture and a practical plan. If you choose managed support, his team is responsible for carrying the agreed remediation through. The support pricing shows how the model is structured.

Book a Cyber Strength Audit →

Citations

"Questions to ask managed service providers, Australian Signals Directorate", ASD's own questions for organisations engaging a managed service provider: whether the provider implements the Essential Eight, securely administers its systems and services, monitors activity, regularly assesses its systems, and is prepared for and able to respond to cyber security incidents. The page records its own last update as 06 October 2021 and refers readers on to ASD's Information security manual. Read 18 September 2026. cyber.gov.au
"Essential Eight maturity model, Australian Signals Directorate", The source of the boundaries stated above: the Essential Eight outlines a minimum set of preventative measures, it will not mitigate all cyber threats, four maturity levels are defined from Maturity Level Zero to Maturity Level Three, and there is no requirement for an organisation to have its implementation certified by an independent party. Read 18 September 2026. cyber.gov.au
"AFS licensees, Australian Securities and Investments Commission", Confirms that a business carrying on a business of providing financial services must hold an Australian financial services licence, or be authorised as a representative of a licensee, and that providing financial product advice or dealing in a financial product are among the activities that require one. This is why the insurance pathway described above runs through licensed partners. Read 18 September 2026. asic.gov.au
"Annual Cyber Threat Report 2024-2025, Australian Signals Directorate", Context for the market this model was built for: more than 84,700 cybercrime reports in the year, on average one every six minutes, and an average self-reported cost of cybercrime per report for small business of $56,600, up 14 per cent. Read 18 September 2026. cyber.gov.au