About Cliffside
Brutally honest cybersecurity.
Not harsh. Just willing to tell you what you need to hear.
Why Cliffside
Cliffside is the answer to a frustration.
Adri Leite started in security in 1999 on a penetration testing team in São Paulo and spent the next fifteen years watching security get bought one technology at a time: each product answered the last incident, and none of them fitted together. In 2014 he founded Cliffside as a security architecture practice, to start from the whole picture instead.
Architects look at the whole system before they touch any part of it. Cliffside still works that way.
Founded in Sydney in 2014. Certified to ISO/IEC 27001:2022 for Cliffside's own management system, audited by the same standard the team audits clients against.
The people
The people you will actually deal with.
Practitioners, not presenters. The senior person you meet in the first conversation is the one who does the work, backed by a bench of architects, penetration testers and senior consultants.
Every penetration tester holds OSCP or a CREST certification. Every auditor is an ISO 27001 Lead Auditor. Architecture work is led by SABSA and CISSP holders.
Certifications
Our team holds these certifications.
Personal certifications held by individual Cliffside consultants, not certifications of Cliffside itself.
CISSPISC2 
CCSPISC2 
CPSACREST 
CRTCREST 
SABSA FoundationThe SABSA Institute
Also heldIRAP Assessor (ASD) · OSCP, OSCE, OSWE and OSWP (OffSec) · ISO/IEC 27001 Lead Auditor and Lead Implementer, ISO/IEC 42001 Lead Implementer (BSI) · CISA (ISACA)
The next generation
Students see cyber from the inside.
Cliffside runs a placement programme with Macquarie University and the University of Sydney that puts students inside real engagements rather than a training room. Interns work beside senior consultants, see how architecture and assurance decisions are actually made, and are expected to ask why. Some of them stay.
It runs both ways. They arrive without the industry's habits and ask the questions it stopped asking. Training the next generation of practitioners is part of how Cliffside works, not a programme bolted on the side.
Placements run through the universities, not through Cliffside, so we cannot take applications directly. If you are studying, ask your faculty or careers office whether your university has a placement partnership with Cliffside.
On the record
Five stars, in public.
Every Google review is public, attributed and unedited. Read all of them, including any that turn up that we would rather you did not.
Engaged Cliffside to go a few pen tests. Internal, External and web application pen test. They did a wonderful job, and found issues that the previous "renowned" company had missed completely. Because of their support and honest advice, our security posture is much better than what it was six months back. Would absolutely recommend their services. Great value for money is an added bonus.
Cliffside conducted a thorough penetration test and security architecture review and produced a report that was packed with actionable items and in priority order. This made it super clear to us what we needed to work on. Shout out to Adriano, Ajay, and Param who were super responsive and easy to work with throughout the engagement. Highly recommend them if you're serious about your cybersecurity.
Certified by BSI. Certificate IS 834275.
Benchmark Security Awards, Industrial & Energy Security Partners category.
Business NSW Business Awards.
Clients and sectors
Who we work with.
ASX-listed companies, government agencies and major financial institutions. Mid-to-large Australian organisations that answer to a regulator or a board.
Advice, delivery and technology
Platforms we partner with.
Where we recommend a product we sell or manage, we explain the requirement it addresses, validate its fit, name its limitations and the risks that remain, disclose our commercial role, and stay accountable for the services we deliver around it.
Our eight commitments →