Insights & Resources
Security thinking
that tells you
what you need to hear.
Practical guidance from practitioners who hold the same certifications and do the same work as our clients. No vendor agendas. No theoretical checklists. Written to be genuinely useful.
ASIC’s Cyber Letter to AFS Licensees: The Practical Response.
On 8 May 2026, Commissioner Simone Constant told every AFS licensee and market participant to act now. The 12 actions, four governance expectations, the FIIG Securities anchor, and what boards must table and evidence.
ISO 27001 Pre-Certification Guide: the honest readiness roadmap.
Most organisations approach ISO 27001 with the wrong question. Eight sections covering gap analysis, ISMS scoping, Statement of Applicability, common mistakes, and what audit bodies don't tell you. Written by Lead Auditors certified since 2008.
Adopting AI Securely: A Risk-Based Approach.
What we learned using AI daily in a cybersecurity consultancy. Covers shadow AI, data sanitisation, ISO 42001, pen testing AI systems, the regulatory landscape, and a 10-control checklist for secure AI adoption.
APRA CPS 234: The Practical Compliance Guide.
The mandatory information security standard for all 680 APRA-regulated entities. Every obligation, enforcement record including Medibank's $250M capital charge, the 72-hour notification rule, and the 2025–2026 regulatory stack.
Third-Party Security Risk & the Vendor Attack Surface.
30% of all confirmed breaches now involve a third party. What the vendor attack surface is, how attackers use it, what CPS 234, CPS 230, the Privacy Act, and ISO 27001 require, and where TPRM programmes most commonly fail.
Essential Eight Maturity Level 3: What It Actually Takes.
Most organisations targeting the Essential Eight stop at ML2. Here is what genuinely achieving ML3 requires: all eight strategies, the hardest controls, and whether your organisation actually needs it.
CIRMP Under the Enhanced Rules: What the 2026 Changes Actually Require.
The enhanced CIRMP rules commenced 10 June 2026. Why the three-month segregation clause is a safe harbour and not a mandate, the Essential Eight uplift to maturity level two, the grace period dates most summaries get wrong, and what your board signs in September.
Energy & Critical Infrastructure: SOCI Cyber Resilience.
How energy organisations can meet SOCI obligations by building real operational resilience, not compliance theatre. Covers reporting clocks, delivery risk, and the Six Security Gates.
Australia’s Cyber Security Act 2024: What It Actually Requires.
Australia's first standalone cyber security law. All four pillars, penalties, mandatory ransomware payment reporting, limited-use protections, the CIRB, and how it overlaps with SOCI, Privacy Act, and CPS 234. Enforcement active January 2026.
ISO 27001 vs Essential Eight: Which Does Your Organisation Need?
They solve different problems. A practical decision framework for Australian organisations: which to pursue first based on your regulators, clients, insurers, and board.
ISO 27001 vs ISO 42001: Security and AI Governance.
Information security versus AI management. Where they overlap through the shared Annex SL backbone, where they genuinely diverge, whether you need both, and how to run them as one integrated system.
Managed Cybersecurity Services Australia: The Data-Driven Case.
$1.7 billion market. 30,000 unfilled roles. Six regulatory frameworks. The cost comparison between outsourced security ($260K–$1M) and equivalent in-house capability ($3.1M–$10.9M), with breach evidence, provider taxonomy, and evaluation criteria for Australian buyers.
Virtual CISO in Australia: When It Works and When It Doesn’t.
A full-time CISO in Sydney costs $250K–$400K+. A substantive vCISO engagement runs $60K–$120K a year. The harder question is whether fractional leadership can deliver the governance and accountability you actually need. When it can, when it can’t, and what the engagement looks like in practice.
Penetration Testing: What Most Reports Won’t Tell You.
Only 48% of pen test findings ever get remediated. The types, timing, provider selection, Australian regulatory mandates, and testing maturity model that separate useful testing from compliance theatre.
ISO 27001 Certification Cost in Australia: What Drives the Number.
Certification starts around A$40,000 for an SME and runs higher at scale, over 9 to 18 months. The cost drivers, the quotes to question, and how to stay independent of your certifier.
ISO 27001 Internal Audit Checklist: Every Clause, No Padding.
A practical internal audit checklist covering every clause, built by Lead Auditors. What certification and surveillance auditors actually look for, and how to prepare without theatre.
IRAP for Australian SaaS Vendors: What PROTECTED Actually Takes.
What a PROTECTED-level assessment means for your architecture, realistic cost and timeline, and how to prepare for an ASD-endorsed IRAP assessment without stalling your roadmap.
IRAP vs ISO 27001: Which Do You Actually Need First?
Where the two frameworks overlap, where they don't, and how to sequence the investment. The honest answer depends on who you sell to, not which certificate looks better.
Cloud Security Strategy: Beyond the Diagram.
Why most cloud security strategies fail at execution. Shared responsibility in practice, misconfigurations, identity sprawl, and what Australian organisations keep getting wrong.
Cyber Insurance in Australia: What Underwriters Actually Check.
The 10 controls insurers assess mapped to Essential Eight and ISO 27001. How to reduce premiums and avoid the 40% claim denial rate.
Insurance Cybersecurity: Make Vendor Risk Enforceable.
How insurance leadership teams can make vendor and delivery risk enforceable under APRA CPS 234 scrutiny.
The Six Security Gates Leadership Teams Can Enforce.
The Six Security Gates model gives leadership teams enforceable decision points with audit-ready evidence.
Cybersecurity for Government: A Strategic Approach.
A strategic approach to cybersecurity for Australian government agencies, covering threat detection, secure communications, and regulatory compliance.
Cybersecurity Audits in the Financial Sector.
Why cybersecurity audits are essential for Australian financial institutions, covering regulatory compliance, threat detection, and best practices.
The Importance of a Cybersecurity Audit for Businesses.
Why every Australian business needs regular cybersecurity audits: what auditors look for, common findings, and how to protect your data.
Retail Digital Transformation and Cybersecurity.
How to integrate robust cybersecurity into your retail digital transformation, covering data protection, customer trust, and resilience.
Cyber Security Audit Checklist for Retail.
An expert guide to cybersecurity auditing for retail, covering POS system security, access controls, and vulnerability scanning.
How to Secure Financial Data with a Cybersecurity Strategy.
How to secure financial data through effective cybersecurity architecture and risk management, covering threats and compliance.
Cloud Security Audit Checklist for Australian Businesses.
A comprehensive cloud security audit checklist covering audit scope, data protection, access controls, and compliance.
Understanding Types of Healthcare Phishing Attacks.
The specific types of phishing attacks targeting healthcare organisations, covering email phishing, spear phishing, and defences.
Cybersecurity Outsourcing for Small Enterprises in Australia.
When and how Australian small enterprises should outsource cybersecurity, covering managed services and choosing the right provider.
Cybersecurity Challenges for Small Businesses in Australia.
The real cybersecurity challenges facing Australian small businesses, and practical steps to address them.
Essential Cybersecurity Assessments for Australian Businesses.
The essential assessments every Australian business should conduct, from risk assessments and pen testing to compliance audits.
The 6 Cybersecurity Services Australian Businesses Actually Need in 2026.
The most important cybersecurity services Australian businesses should invest in for 2025.
Building a Flexible Cybersecurity Workforce.
How to build a flexible cybersecurity workforce, combining in-house talent with specialist support for robust resilience.
Lessons From a Year-Long Phishing Simulation Campaign.
Real data from a 12-month phishing simulation programme: click rates, reporting behaviour, and what actually changes risk.
How Security Architecture Saves You Money Long-Term.
Why investing in proper security architecture upfront builds genuine cyber resilience, and saves you money long-term.
Why Cloud Migration Makes You More Secure, Not Less.
Why migrating to the cloud actually strengthens your security posture, covering shared responsibility and native controls.
Not sure where to start?
Our security assessment gives you an honest picture of where you stand, across ISO 27001, APRA CPS 234, Essential Eight, and your broader security posture.