Industries
Same threats. Different rules, different stakes.
A ransomware crew doesn't care which sector you're in. Your regulator, customers and board do. We work mostly with five kinds of organisation, and start each engagement from the obligations and pressures of that sector, not from a generic template.
Financial services and superannuation
Show APRA a capability, not a binder.
Banks, insurers, super funds and the fintechs that serve them work under supervisors who now expect evidence that controls work, not just that they're written down. CPS 234 has been in force since 2019; CPS 230 adds operational resilience and service-provider oversight. We help you test control effectiveness the way a supervisor would, set up reporting directors can stand behind, and connect your critical operations to the security controls that protect them.
Health and aged care
Clinical systems can't stop for a patch window.
Health organisations hold the most sensitive personal information there is, run clinical and building systems that can't simply be switched off, and usually have small IT teams stretched across many sites. We focus on the controls that matter most in that setting: identity and privileged access, segmentation between clinical, corporate and medical-device networks, backup and recovery that has actually been tested, and incident plans that account for Privacy Act notification.
NSW Government
Annual reporting that reflects reality.
NSW agencies report against the NSW Cyber Security Policy each year. The gap between a declared maturity level and a provable one shows up quickly when someone samples the evidence. We cover the policy end to end for agencies and their suppliers: mandatory requirements, Essential Eight maturity, controls assessment, the annual report and the program behind it. Our controls-assessment experience means we know which evidence survives scrutiny and which doesn't.
Critical infrastructure
A risk program your board can put its name to.
Under the SOCI Act, responsible entities for certain critical asset classes must keep a written risk management program and report on it each year, with board approval. Cyber is one of the hazards it has to cover, and it often leads straight to operational systems that were never designed to be networked. We build these programs from scratch and support the ones already running, and our OT practice works on the plant-floor systems they depend on.
SaaS and technology
Security that gets the contract signed.
For a growing software company, security usually first shows up as a questionnaire from a large customer. Then another. Then a request for ISO 27001 or SOC 2 before the next renewal. Done badly, that turns into a paperwork project that slows engineering down. Done well, it's a sales asset. We help SaaS teams build a security program that matches how they actually ship software, get to certification without stalling delivery, and answer customer due diligence quickly and honestly.
Your sector isn't listed?
The obligations may be different, but the method isn't. We also work with manufacturers and other industrial operators on OT security, and with Australian defence suppliers on CMMC.
