The Practice
Where innovation meets resilience.
One fractional CISO at the centre, specialist teams around them. Start with the engagement, then add the capabilities and deliverables your board needs.
01 · The engagement
Fractional CISO‑as‑a‑Service
A senior Australian CISO inside your executive team, without the full-time hire. They own cyber strategy, report to the board in the language of risk, and bring in our specialists when the work calls for it.
- Board reporting, cyber-risk dashboard and KPI pack Board
- Cyber strategy, roadmap and 90-day threat horizon Strategy
- Regulator and audit liaison: APRA CPS 234, ISO 27001, SOC 2 GRC
- Vendor and third-party risk oversight Supply chain
- Incident command, with a 24-hour on-call retainer Response
- Healthcare, telco, payments and digital identity coverage Sector
02 · Systemic risk review · Advisory
Where one failure becomes everyone’s.
Red-team-forged consultants trace how a single compromise, outage or bad update would travel through your suppliers, platforms and business services. Then they tell the board which dependencies could take the whole organisation down.
Most risk reviews stop at the first failure. Ours follow the chain, from first-order impact through to the second, third and fourth-order effects that decide whether you get through the week and keep the customer. Auditors check that each control exists. Red-teamers ask what happens when one fails, and where the damage goes next.
How we trace it
- 1st order
The direct hit
A supplier is breached, a platform goes down or a bad update ships.
What fails?
- 2nd order
Dependent services stop
Payments, check-in, the call centre, payroll. Staff fall back to manual workarounds.
Which services stop, and for how long?
- 3rd order
Others feel it
Customers, counterparties and regulators: missed settlements, broken service levels, notifiable breaches, impact tolerances exceeded.
Who outside the building is harmed, and what do we owe them?
- 4th order +
The world after
Peers on the same supplier fall at once. Insurers reprice, lawsuits follow, rules change and trust wears down. Attackers exploit the confusion.
Are we still trusted in it?
- Cascade map: first to nth-order effects for each critical business service Red team
- Critical business services and dependency map, including fourth parties CPS 230
- Concentration and single-point-of-failure analysis Concentration
- Attack-path review across business services, not just individual systems Red team
- Scenario stress tests: supplier breach, cloud outage, faulty update Scenarios
- Independent review of existing risk assessments and resilience programs Assurance
- Board brief on systemic risk, with tolerances and priorities at each order of effect Board
03 · Capabilities
Web2 to Web3, under one CISO.
Web2 security
AI & Robotics Risk Governance
Foundation-model audits, industrial-robot kill-switch design and wearable hardening.
Zero Trust & Network Architecture
Identity-centric access that removes implicit trust and shrinks the attack surface.
Post-Quantum & Digital Identity
Quantum-resistant encryption roadmaps and decentralised identity infrastructure.
Incident Response & Readiness
Tabletops, workshops and live drills built on real attacks.
GRC & Digital Transformation
Governance and risk built into cloud migrations and API rollouts, not added after.
Web3 security
Treasury & Digital-Asset Custody
Custody design, multi-sig policy, on-chain analytics and secure payment rails.
Blockchain Security Audits
Protocol and smart-contract review with compliance in view.
DeFi & DAO Governance
Risk-adjusted on-chain governance design and treasury KPIs.
Wallet Tracing & Fraud Prediction
Forensics, clustering, sanctioned-address monitoring and ML anomaly scoring.
Decentralised Identity & Credentials
Private for the user, audit-ready for KYC, AML and cross-domain trust.
Regulatory Mapping
AUSTRAC, FATF Travel Rule, MiCA and SEC guidance for Web3 ventures.
04 · Deliverables
What you can commission.
Illustrative outputs, each scoped and quoted per engagement. Open a practice area to see what it produces.
01Strategic Advisory5 deliverables
- Board-level cyber-risk dashboard and KPI pack
- Executive 90-day threat horizon brief
- M&A and investment cyber due-diligence matrix
- Post-quantum readiness roadmap
- Digital-asset treasury risk framework and MPC custody playbook
02Governance, Risk & Compliance6 deliverables
- ISMS roadmap, from scoping to board sign-off
- ISO 27001 and SOC 2 readiness with audit packs
- Privacy-by-design data-flow mapping and compliance review
- Secure SDLC and DevSecOps uplift guide
- Fraud-risk controls catalogue for payments and fintech
- Security posture review for cyber-insurance underwriting
03Vendor & Supply-Chain Assurance3 deliverables
- Security vendor compliance review: SLAs, attestations, certifications
- Tool rationalisation plan that cuts spend without weakening controls
- Third-party risk scoring and continuous-monitoring dashboard
04Product & Platform Assurance4 deliverables
- Secure-by-design product architecture
- Product security assurance paper: threat model, control mapping, customer attestation
- Secure-by-design playbooks for SaaS and embedded products
- Zero-trust API gateway reference implementation
05Technical Assessments & Testing6 deliverables
- Red-team and purple-team campaigns with a C-suite debrief
- Penetration testing: network, cloud, mobile, IoT
- AI and LLM safety assessment: prompt injection, model drift
- Broadcast and wireless RF threat audit: 5G, satcom, LPWAN
- Firmware reverse-engineering and IoT attack-surface map
- FHE proof-of-concept and performance study
06Identity & Trust Architecture4 deliverables
- Identity and access-control design: RBAC, ABAC, PBAC
- Decentralised identity blueprint: DID and verifiable credentials
- End-to-end trust architecture across identity, cryptography and policy
- Zero-trust reference model and implementation runbook
07Incident & Resilience5 deliverables
- 24-hour CISO-on-call retainer and war-room support
- Post-breach audit and resilience review
- Crisis communications playbook for board, media and customers
- Business-continuity and disaster-recovery tabletop
- Ransomware negotiation and recovery strategy
08Systemic Risk5 deliverables
- Cascade map of first, second, third and nth-order effects
- Critical business services and fourth-party dependency map (CPS 230)
- Concentration and single-point-of-failure analysis
- Scenario stress tests: supplier breach, cloud outage, faulty update
- Board systemic-risk brief with impact tolerances
05 · Signature engagement · Partner network
Heist Design.
We plan the attack the way a real crew would, with partner-network experts who advise Hollywood on hacker films. Then we run it against your organisation, so your leaders feel the threat instead of reading about it.
Partner identities disclosed under NDA on engagement
- ReconHeist scenario script and attack storyboard: reconnaissance, the inside angle, the getaway.
- The jobFull-scope campaign across physical, social and digital.
- The roomBoard war-game: a live-narrated heist tabletop.
- AfterPost-heist debrief and resilience roadmap.
06 · Emerging Tech Lab
We break it before it ships.
Cryptographers, telecoms engineers, AI red-teamers and hardware specialists prototype, emulate adversaries and validate new technology before it goes live.
- Quantum-safe VPN prototype and benchmarks PQC
- Wearable-tech security hardening kit Edge
- DeFi smart-contract threat model and exploit simulation DeFi
- Autonomous-robot kill-switch design and validation Robotics
Engage