Fewer ways in
The gaps attackers try first, closed in order of risk.
Cyber security for the AI era
Cyber security and resilience for a time when attackers use AI. We close the gaps they look for first, test that your defences hold, and prepare your team to respond and recover, mapped to the rules you report under.
What is cyber resilience?
Cyber resilience is an organisation's ability to prevent most attacks, detect the ones that get through, and keep running and recover when something goes wrong. No organisation can rule out an attack. Resilience limits how far one gets and what it costs.
Why it matters
Attackers now work with AI
The Australian Signals Directorate says AI is helping attackers find and exploit weaknesses faster. In November 2025 the first reported espionage campaign run largely by AI agents was disclosed, and in October 2026 an open-source agent framework was used to attempt sign-ins to more than 2,250 Microsoft 365 tenants.
82,000+
Cybercrime reports to ASD in 2025-26, about one every six minutes.
ASD Annual Cyber Threat Report 2025-26
+20%
More cyber security incidents handled by ASD than the year before: over 1,500.
ASD Annual Cyber Threat Report 2025-26
A$93,500
Average self-reported cost of cybercrime for a business, up 16%.
ASD Annual Cyber Threat Report 2025-26
Intruders caught early
Logs and alerts that spot an intruder before data leaves.
Recovery rehearsed
Backups, playbooks and decisions tested before the day you need them.
Exposed software
Protection from newly disclosed flaws
Exploit attempts now begin within hours of a disclosure. When PHP2Shell, two critical PHP flaws that let an attacker run code on a web server without logging in, was announced in October 2026, attempts reached the millions within hours and ASD issued a Critical Alert. We prepare you for the next one.
Found
Every internet-facing system and the software behind it, including web servers, VPNs, firewalls and developer tools you host yourself.
Patched
Each one updated to a fixed release, or shielded by the vendor's interim settings until it can be.
Checked
Exposed servers searched for new accounts, planted files and unexpected connections.
Planned
A path off versions that no longer get fixes, such as PHP 8.2, whose security support endsended on 31 December 2026.
What we cover
The weaknesses behind the major attacks of the last four years, and the controls that hold against them.
Essential Eight uplift
Your maturity against ASD's Essential Eight, and a costed plan to the level your risk calls for.
Identity and access
Phishing-resistant sign-in, help desk checks and admin access that limit what one stolen login can do.
Ransomware readiness
Offline backups, tested restores and a playbook that covers the 72-hour payment report.
Third-party and SaaS risk
Vendor access, connected apps and software updates treated as privileged accounts: mapped, limited and watched.
Deepfake and payment fraud
Call-back and approval rules, so a cloned voice or face cannot move money or reset a password.
Logging and detection
The logs ASD recommends, kept long enough to investigate, with alerts someone acts on.
Compliance
Security and compliance together
Most organisations answer to more than one set of rules. We map each control to the obligations you report under, so one piece of work serves several of them.
Privacy Act and data breaches
Reasonable steps to protect personal information, and a breach response that meets the 30-day assessment rule.
Ransomware payment reporting
A report to ASD within 72 hours of any payment, for businesses with turnover of A$3 million or more.
Critical infrastructure (SOCI)
Incident reports within 12 or 72 hours, and a risk management programme built on a recognised framework.
APRA CPS 234 and CPS 230
Information security and operational resilience for banks, insurers and super funds, and their service providers.
ISO/IEC 27001 and SOC 2
Gap reviews and evidence ready for the auditor when customers ask for certification.
ISM and PSPF
Controls aligned to the Information Security Manual and the Protective Security Policy Framework, for agencies and their suppliers.
We provide technical and governance support and do not give legal advice. We are not an IRAP assessor or certification body: we prepare you for those assessments. AI governance and the 10 December 2026 disclosures
Ready for what comes next
The attacks coming next are already visible in recent incident reports.
AI-run intrusions
Open-source agent platforms that scan, break in and move through networks with little human direction.
Read the threat guide
Hijacked and runaway AI agents
Prompt injection that turns your own agents against you, and agents that reach systems nobody meant them to.
AI security testing
Harvest now, decrypt later
Encrypted data stolen today, to be read by a future quantum computer.
Quantum-safe readiness
Engagement
Cyber Resilience Review
Two to three weeks. We assess your Essential Eight maturity, identity and access, backups, third-party access and logging, run a ransomware tabletop exercise with your leadership team, and map the results to your obligations. You receive a board summary, a ranked fix list with effort and cost, and a 90-day uplift plan. Scope and fee are fixed in writing after a free call; help with the fixes is quoted separately. Prices in Australian dollars, excluding GST.
Can you stop every cyber attack?
No one can promise that, and it is worth being wary of anyone who does. What we can do is close the gaps attackers use most, shorten the time an intruder goes unnoticed, and make sure recovery does not depend on paying a ransom. Progress is measured against the Essential Eight maturity levels, so you can see it.
How are AI-driven cyber attacks different?
Mostly in speed and scale. AI helps attackers write convincing phishing in any language, clone voices and faces, and find and exploit weaknesses faster, and agent tools can run a whole intrusion with little human direction. The defences that hold are largely the ones that stop human attackers, applied more consistently: phishing-resistant multi-factor authentication, fast patching of internet-facing systems, least privilege for people, vendor integrations and AI agents, good logs and tested recovery. Our threat guide covers the incidents behind this.
Do we have to report a ransomware payment?
Under the Cyber Security Act 2024, businesses with annual turnover of A$3 million or more, and responsible entities for critical infrastructure assets, must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making it, or of learning it was made on their behalf. Check your position with your legal adviser.
Is this only for large organisations?
No. ASD suggests Maturity Level One of the Essential Eight may suit many small and medium businesses, and the review is scoped to your size. ASD's 2025-26 threat report put the average self-reported cost of cybercrime for a business at A$93,500 a report, up 16%, and for a medium-sized business at A$141,300, up 45%.
Do you work with our IT provider and existing tools?
Yes. We work alongside your IT team, managed service provider and the tools you already pay for, and every recommendation names who should own it.
Are you an IRAP assessor or certification body?
No. We prepare you for those assessments, gather the evidence and fix the gaps, and you engage the assessor or certification body of your choice. We do not give legal advice.
