High severityProfessional services
Security for the firms that hold their clients’ affairs.
We test, harden and run the systems advisory, accounting and consulting firms keep client data in.
Professional services
The obligations in play.
An adviser holds a client’s financial position, identity documents and correspondence, usually in a Microsoft 365 tenant and a handful of cloud practice systems. One compromised inbox is enough to redirect a payment or expose a file.
AML/CTF tranche 2 adds program and due diligence obligations for accountants providing designated services, and larger clients now ask for evidence of controls before they share data.
Privacy Act 1988 and the APPs
Client personal and financial information under the Australian Privacy Principles, with the Notifiable Data Breaches scheme behind it.
AML/CTF Act, tranche 2
Accountants providing designated services have been reporting entities since 1 July 2026: programs, customer due diligence and records.
Tax Agent Services Act 2009
The Code of Professional Conduct obliges registered tax and BAS agents to keep client information confidential.
Client security questionnaires
Larger clients and government buyers ask advisers to evidence their controls before they share data.
Threat picture
What the sector is facing.
Notifiable data breaches, 2025
81of 1,205 notifications
Legal, accounting and management services made 81 of 1,205 notifications in 2025.
OAIC, Notifiable Data Breaches statistics for 2025, published 6 Jul 2026 - High severity
What we do
What you carry, and what we do about it.
Client files live in a Microsoft 365 tenant, one compromised inbox away from a redirected payment.
We review and harden the tenant your firm signs in to: Conditional Access and MFA coverage, privileged roles, app consent and offboarding.
Entra ID and Microsoft 365 reviewLarger clients ask for evidence of your controls before they send the work.
SMB1001 readiness turns the controls you run into a certificate on a public registry, and an Essential Eight assessment rates the hardening behind it.
SMB1001 certification readinessPortals, remote access and the website face the internet every day.
We test the hosts you expose, verify and re-rate every finding, and hand back a remediation programme with a re-test.
Penetration testingThe tenant, the devices and the accounts need running well, every week.
Managed ICT runs Microsoft 365 tenants, devices and support, under the same practice that secures them.
Managed ICT
Penetration testing
Networks, web apps, cloud and AI systems, with a written report and a re-test.
From A$4,950ex GSTMicrosoft 365 and Azure security review
Identity, Conditional Access and tenant settings, with written findings.
From A$3,500ex GSTSMB1001 readiness
Gap assessment, evidence pack and support through to your target tier.
From A$3,950ex GSTManaged ICT
Microsoft 365 tenants, devices and support, run by the people who secure them.
Motorsport and sport technology
Decision software for race weekends, from our Labs.
Automotive and trades
Workshop and dealer systems, and the security around customer and vehicle records.
Recruitment
Candidate intake, screening and placement workflows, built for an agency.
