Cyber security services

Strategy, delivery and the years afterwards.

End-to-end cyber security across IT, OT and cloud – for the organisations that run critical infrastructure.

Most cyber engagements stop at a strategy document or a technology implementation. We cover the full lifecycle: the risk assessment, the target state, the delivery, the transition into operations, and the governance that keeps posture aligned to a threat landscape that does not hold still.

How we work Selected engagements

Delivering complex programmes

Cyber-capable in-house personnel

ICS

Industrial control systems certified

How we work

Strategy, delivery and management – under one accountability.

We deliver end-to-end cyber security covering strategy, implementation and ongoing management, which is what gives holistic coverage without gaps. Well-defined methods, accelerators and governance tools, and continuous improvement through regular reassessment.

End to end

Comprehensive, not episodic

We deliver strategy, implementation and ongoing management as one engagement, which closes the gaps that appear when each phase is bought separately. The measure is whether capability actually reaches operations – not whether a project closed.

Adaptive by design

Built to be revised

A security posture set once is a posture already ageing. Our strategies are built to evolve against new and emerging threats, with regular reassessment as a scheduled activity rather than an incident response.

IT, OT and cloud

Including the systems that move things

Enterprise security, cloud platform protection and industrial control systems. Our people hold ICS-specific training and work to IEC 62443, NIST SP 800-82 and MITRE ATT&CK for ICS, not just the enterprise frameworks.

The cyber lifecycle

Eight stages. Three phases. No handover where the risk sits.

Cyber work is bought in three phases – strategy, delivery, management. This is how those phases actually run, with eight stages that each produce evidence before the next one starts.

01 – Risk and threat assessment

Establish what is actually exposed, across both the enterprise and the plant.

02 – Target state and strategy

Define the destination across people, process and technology – then justify it.

03 – Scope, business case and approval

Turn a strategy into a funded, auditable project scope with every item traced to source.

04 – Secure design and architecture

Security architecture applying SABSA, with controls traced to business risk rather than to a product catalogue.

05 – Implementation and integration

Deploy the capability into an estate that is already running, integrated into the existing infrastructure.

06 – Testing and assurance

Prove each control does what the requirement said it would, with evidence that survives an audit.

07 – Transition to operations

Transition delivered capability into operations with runbooks, remediation trackers and knowledge transfer so it remains operable.

08 – Ongoing management and improvement

Keep posture aligned to a threat landscape that does not hold still, through regular reassessment cycles.

Selected engagements

Critical infrastructure, resources and energy.

Each engagement is described in the terms the organisation measured it by. Where a client is identified by sector rather than name, that is by agreement.

Critical infrastructure

Cyber scope from 200-page business case

A scope development agent converted a PAM business case into a governance-ready project scope in under four hours, surfacing 14 hidden regulated requirements with full traceability across six instruments including the SOCI Act 2018 and Essential Eight.

Energy and utilities

Multi-year cyber transformation, IAM uplift

A two-year Phase I engagement defined the cyber target state across people, process and technology. The programme has continued as a multi-year IAM transformation, with architecture, change and cyber practices working on the same programme.

Oil and gas

Security operations centre establishment

Project management and business analysis for a cyber security vendor engagement programme and security operations centre relocation. Included agile DevOps team setup, change management, stakeholder communications and full project documentation.

Service domains

Six domains, across IT, OT and cloud.

Organised around what organisations bring us. Three commitments run through all of them.

End to end

Strategy, delivery and management under one accountability — the gaps between those three are where most cyber programmes actually fail.

IT and OT

Enterprise security and industrial control systems, with ICS-specific training and standards rather than enterprise controls applied to a plant.

Evidence and traceability

Ratings with written rationale, scope traced to source, remediation tracked to an owner, and an evidence pack that survives an audit.

Six domains — select any one to see the detail.

“We have a list of security products and a risk register, and no strategy that connects either of them to what the business actually needs protected.”

We start from risk across both IT and OT, then define a target state across people, process and technology that is aligned to organisational objectives and the governance frameworks the organisation is already held to. The strategy is built to be revised, because a posture set once is a posture already ageing.

Services
Robust, adaptive cyber security strategy development Comprehensive risk assessment across IT and OT environments Target state definition across people, processes and technology Proactive strategy for threat prevention, detection and response Alignment of cyber strategy to business requirements and governance frameworks Cyber risk level determination and rating rationale Business cases and investment approval requests for cyber investment
Standards and credentials
NIST Cybersecurity Framework 2.0 ISO/IEC 27001 ISO 31000 ASD Essential Eight SOCI Act 2018
Delivery Model

Strategy engagements, independent risk assessment, and business case development for a cyber investment decision.

“Our security investment is a product portfolio. I cannot explain to the board which business risk each item addresses, or what we are still exposed to.”

We apply the SABSA framework so security architecture starts from business objectives and risk appetite and works down to controls — which is what makes it defensible to a board and auditable afterwards. Designs are aligned to the client’s own technology standards and enterprise architecture rather than to a reference architecture.

Services
SABSA-based security architecture aligned to business risk Solution architecture documents for security capability Network, application, endpoint and cloud security design Information and data security architecture Security risk assessment of project and solution designs Security governance and policy alignment Alignment of security design to client technology standards
Standards and credentials
SABSA Security Architecture Framework ASD Information Security Manual CIS Critical Security Controls v8 ISO/IEC 27001
Delivery Model

Security architecture engagements, independent security risk assessment of a design, and embedded security architecture on a programme.

“Access accumulates. People change roles, leave, come back as contractors — and our entitlements have never been reconciled to any of it.”

IAM uplift is a people and process problem wearing a technology badge. We work across all three: the architecture, the entitlement model and the operating process that keeps it true. On multi-year transformation programmes we provide the business analysis and architecture that carries IAM control uplift from design through to operations.

Services
Identity and access management architecture and control uplift IAM uplift across people, process and technology Entitlement modelling, privileged access and segregation of duties Privileged access management scope, design and implementation support Business analysis for multi-year IAM transformation programmes Access governance and recertification process design
Standards and credentials
Identity & Access Management AZ-500 platform protection ASD Essential Eight SABSA
Delivery Model

IAM architecture and business analysis, privileged access programme delivery, and embedded capability on a multi-year transformation.

“We get a security report each month whose quality depends entirely on who wrote it, and we cannot tell whether our posture is improving.”

We establish and relocate security operations centres, and we run cyber threat intelligence as a governed cycle — eighteen named artefacts from charter through to lessons learned. That means exposure analysis joined to real asset data, ratings with written rationale, remediation tracked to an owner, and an evidence pack at closeout.

Services
Security operations centre establishment and relocation Cyber threat intelligence reporting cycle establishment and operation Vulnerability exposure analysis joined to asset and CMDB data Security hunting query sets and monitoring analysis Compromise assessment Cyber management reporting to executives and boards Remediation tracking and residual risk acceptance registers
Standards and credentials
Microsoft Security Operations Associate Cisco Cyber Ops Associate MITRE ATT&CK NIST Cybersecurity Framework 2.0
Delivery Model

Operations centre establishment, managed threat intelligence reporting, and establishment of a reporting cycle the client then runs.

“Our corporate security programme does not reach the plant, and the people who run the plant do not accept a control set designed for an office network.”

Operational technology cannot be secured with enterprise assumptions — availability and safety outrank confidentiality, and a patch window may not exist. Our people hold ICS-specific training and work to IEC 62443, NIST SP 800-82, AESCSF and MITRE ATT&CK for ICS, engaging operations on their own terms.

Services
Cyber risk assessment across operational technology environments ICS and OT security architecture and control design Segmentation and secure remote access for control environments Critical infrastructure obligation mapping under the SOCI Act 2018 AESCSF alignment for energy sector participants OT-aware monitoring, detection and response design Engagement with operations and engineering on control acceptance
Standards and credentials
IEC 62443 NIST SP 800-82 MITRE ATT&CK for ICS AESCSF v2 CISA ICS training (100W, 210W series)
Delivery Model

OT security assessment, ICS architecture engagements, and critical infrastructure obligation programmes.

“We have funded a multi-year cyber programme. What I need is someone who can actually land it — across vendors, agile teams and an operations group that has to run it afterwards.”

We provide the project management, business analysis and delivery leadership that carries cyber capability from approval into operations: requirements definition, vendor engagement programme management, agile and DevOps team setup, change management and stakeholder communications, then a transition that operations actually accepts.

Services
Cyber programme and project management, and delivery leadership Functional and non-functional requirements definition Vendor engagement programme management DevOps and agile team establishment Design thinking inception workshops and full project documentation Change management and stakeholder communications Transition of delivered capability into operations within schedule and budget
Standards and credentials
PRINCE2 Prosci Agile and DevOps delivery AZ-500
Delivery Model

Programme and project delivery, embedded business analysis, and team augmentation into a client-led cyber programme.

Start a conversation

Know where you stand before someone else establishes it for you.

Whether it is a strategy that needs to survive a board, an obligation you have to evidence, an IAM estate nobody has reconciled, or a programme that has to reach operations – talk to the people who would do the work.

Email us +61 8 9324 1020