Insights.
Short technical write-ups from real work.
Reference guides
AI cyber defence
The Voluntary AI Safety Standard's 10 guardrails
The 10 guardrails map onto ISO/IEC 42001 clauses and the six essential practices.
AI cyber defence
ISO 42001 requirements clause by clause, and the audit evidence
ISO/IEC 42001 carries its requirements in clauses 4 to 10 and 38 Annex A controls.
Offensive testing
Penetration testing cost in Australia, and how to get a quote
Market prices run from about $5,000 for one web application to $45,000 for external and internal combined.
Defensive & advisory
What a vCISO retainer costs in Australia
The market sells four retainer shapes, from about $2,500 a month to $20,000 and above.
Defensive & advisory
SharePoint permissions to fix before you turn on Microsoft 365 Copilot
SharePoint permissions decide which shared files Copilot puts in front of each user.
Defensive & advisory
What Australian cyber insurers check before they quote you
A cyber proposal form asks binary questions about controls that are never binary.
Software engineering
RBAC vs ABAC, and where the permission check belongs
One decision shapes authorisation: whether the question is answered in one place or in every handler.
Compliance readiness
What a government tender means when it asks for the Essential Eight
Each Australian government buyer asks for a different security artefact.
Breach remediation
Deciding whether to rebuild or restore after ransomware
After containment you decide which parts of the environment you are willing to trust again.
Defensive & advisory
An incident severity matrix you can use
Four severity levels set the first actions, the internal escalation and the external notification clock.
Secure development
Shipping AI-written code without shipping its mistakes
AI-generated code fails in eight recurring places, each with a check a developer can run.
Offensive testing
Choosing the right security assessment: what each type answers
Seven assessment types differ on what they find, what they miss and what you receive.
Compliance readiness
The Australian cyber compliance map: what applies to your business
The Privacy Act, the NDB scheme, SOCI, CPS 234 and PCI DSS each bind a different set of businesses.
Self-serve tools
All toolsCompliance readiness
Essential Eight self-check
Secure development
AI-built app risk check
Breach remediation
Breach notification helper
Secure development
Security headers check
Defensive & advisory
Incident cost estimator
Defensive & advisory
Cyber insurance answer check
Offensive testing
Penetration test scope builder
Compliance readiness
Security questionnaire translator
Defensive & advisory6 October 2026
Entra ID privileged access: PIM, admin roles and break-glass accounts
Four decisions carry privileged access, and two monitored emergency accounts answer the last one.
Compliance readiness6 October 2026
How an Essential Eight assessment is run, and what the assessor tests
An assessment runs four ASD stages, rates every control against seven outcomes and grades the evidence.
Breach remediation6 October 2026
What an incident response retainer should include in Australia
A retainer fixes who responds, how fast, with what access and under whose authority.
Compliance readiness6 October 2026
IRAP assessment for a SaaS vendor: what government buyers check and how to prepare
An IRAP assessment reviews a system against the ISM, and the buying agency's authorising officer decides.
Compliance readiness6 October 2026
ISO 27001 readiness: the gap assessment, the Statement of Applicability and the first audit
Scope, gap assessment, risk treatment and the Statement of Applicability come first, then operating history.
Defensive & advisory6 October 2026
What a Microsoft 365 security review checks, setting by setting
The review reads six configuration areas and ranks the changes against the licences you hold.
Defensive & advisory6 October 2026
Questions to ask an MDR provider before you sign
The questions that separate MDR providers cover visibility, analyst authority, response time and exit.
AI cyber defence21 September 2026
What a board should ask about AI risk before a rollout
A board asks for a system register, named owners, failure-mode risks and quarterly movement.
AI cyber defence21 September 2026
Verifying a payment request when the voice is cloned
Confirm bank detail changes on a number the request never touched.
AI cyber defence21 September 2026
Guardrails and audit trails before an AI feature ships
An AI feature ships with guardrails, an audit trail, tenant isolation and a test that tried to break it.
AI cyber defence20 September 2026
AI tools, data leakage and the Privacy Act
Pasting a customer record into an AI product counts as a use or a disclosure under APP 6.
AI cyber defence19 September 2026
Least privilege for AI agents with tool access
An agent holds only the tools its task needs, under a credential issued to the agent.
AI cyber defence19 September 2026
What prompt injection testing actually finds
Each finding names the entry point, the planted instruction and what that instruction reached.
AI cyber defence19 September 2026
Shadow AI discovery in a Microsoft 365 tenant
Three records name the AI tools staff already use: Entra consent grants, Cloud Discovery, Global Secure Access.
AI cyber defence19 September 2026
What an AI security assessment checks
The assessment returns an AI tool inventory, a dated usage policy and a risk register with named owners.
Defensive & advisory11 September 2026
How to build an inventory of internet-facing assets
The inventory lists every domain, public IP, certificate and hosted service against a named owner.
Defensive & advisory11 September 2026
What a read-only Azure security assessment can prove
Reader access proves what a tenant is configured to do, without changing the environment.
Breach remediation11 September 2026
What a closure pack proves before breach remediation sign off
A closure pack names the root cause, the deployed fix, the cleared variants and a failed re-test.
Software engineering13 August 2026
Case study: Xero as the bank truth behind a law firm and a fund licensee
Two integrations run on Xero's Accounting API: GRM LAW's trust reconciliation and Stone Leaf Capital's bank-feed sync.
Compliance readiness20 July 2026
How to answer a vendor security questionnaire without stalling the deal
The reviewer cross-checks your answers against each other and against everything public.
Defensive & advisory18 July 2026
What to check in an Entra ID app registration security review
App registrations and service principals authenticate as themselves, with no user and no MFA claim.
Offensive testing16 July 2026
What is a penetration test attestation letter, and what stays in the report?
The attestation letter states what was tested and when, and the full report stays inside the organisation.
Software engineering9 July 2026
An audit ledger nobody can quietly edit
We run an append-only audit ledger in production for GRM LAW.
Secure development9 July 2026
A content-security policy that blocks something
A policy contains script injection once it refuses inline script and trusts a per-response nonce.
Compliance readiness9 July 2026
What an Essential Eight self-assessment takes
Each Essential Eight strategy tests something specific, and only some evidence stands up to an assessor.
Software engineering9 July 2026
Tenant isolation that survives a bad query
PostgreSQL row-level security carries the tenant boundary in clinical software.
Compliance readiness8 July 2026
SMB1001 or Essential Eight: which should you do first?
The Essential Eight measures technical hardening and SMB1001 certifies whole-of-business practice.
Offensive testing6 July 2026
What an API penetration test finds that a web application test misses
An API engagement tests authorisation across tenants, mass assignment, old versions and machine tokens.
Defensive & advisory3 July 2026
Alerts worth waking up for: detection without a SOC
A small team runs a short list of alerts somebody will act on, and deletes the rest.
Breach remediation30 June 2026
What to do when your vendor has a data breach
A supplier breach leaves you holding the legal obligation and almost none of the visibility.
Software engineering26 June 2026
Patching without breaking production: a field guide
Triage, deployment rings, rollback and standing windows make patching fast and routine.
Defensive & advisory22 June 2026
What Australian director duties require a board to show about cyber risk
A board produces a record of the questions it asked, the answers it got and what changed.
Compliance readiness19 June 2026
Privacy by design starts with collecting less data
Collecting less personal data cuts breach impact, retention risk and the compliance load.
Software engineering16 June 2026
Shadow IT and the SaaS you cannot see
Identity logs, DNS records and expense reports find the SaaS nobody sanctioned.
Offensive testing12 June 2026
Red team or penetration test: which do you need?
A penetration test measures a system, and adversary simulation measures whether anyone detects an intruder.
Secure development9 June 2026
AI coding agent security starts with what it can already reach
A coding agent runs with the launcher's credentials and takes instructions from whatever it reads.
Software engineering5 June 2026
Microsoft Entra conditional access that holds
Entra conditional access is default allow, so a sign-in matching no policy walks in.
Compliance readiness2 June 2026
Ransomware and the question of paying
Paying a ransom carries a 72-hour report, insurer conditions and a decision nobody rehearsed.
Secure development29 May 2026
What a human reviewer catches that a scanner misses
Static analysis finds patterns, and a reviewer who understands the system finds the rest.
Secure development26 May 2026
Who should own the Azure tenant when someone else builds your system
Account custody decides who can revoke access and who can produce the audit trail.
Defensive & advisory22 May 2026
What a web application firewall cannot do
A WAF stops the request patterns it knows and cannot see a flaw in application logic.
Compliance readiness19 May 2026
The Privacy Act for software teams
The APPs turn into schema, logging, region and product decisions somebody makes in code.
Compliance readiness15 May 2026
What an ISO 27001 auditor checks, and how to prepare
The auditor samples evidence, and the Statement of Applicability commits you to every control it includes.
Compliance readiness12 May 2026
What a SOC 2 report tells you
The opinion, the period, the scope, the carve-outs and the exceptions decide what a SOC 2 proves.
Compliance readiness8 May 2026
What you must do when personal data leaks
An eligible data breach starts an assessment clock and sets who you must tell.
Offensive testing5 May 2026
Social engineering has left the inbox
Attackers ring the helpdesk, text personal phones and bomb users with push prompts.
Defensive & advisory1 May 2026
Backups that survive ransomware as well as disk failure
Immutability, offline copies and tested restores decide recovery.
Secure development28 April 2026
The API key you shipped to every customer
A key compiled into a mobile binary or a frontend bundle is published the day it ships.
Software engineering24 April 2026
Shifting security left without slowing delivery down
Secret scanning, dependency checks and IaC gates hold once they block only what matters.
Offensive testing21 April 2026
What a mobile app penetration test covers
A mobile engagement covers three pieces of work usually quoted as one.
Defensive & advisory17 April 2026
Zero trust for a fifty-person company: where to start
Identity carries the perimeter, device health the second signal, and standing privilege comes out.
Defensive & advisory14 April 2026
The VPN appliance on your perimeter is now the target
The appliance that authenticates remote staff sits exposed and resists monitoring.
Offensive testing10 April 2026
A penetration test is not a vulnerability scan
Automated scanning stops where human testing begins, and buyers pay for one expecting the other.
Offensive testing7 April 2026
Scoping a penetration test properly
The scope fixes most of a penetration test's value before testing starts.
Defensive & advisory3 April 2026
The Azure storage account that was public all along
Azure storage account defaults leave data reachable from the internet until somebody decides otherwise.
Offensive testing31 March 2026
How to security test an LLM feature already in production
The instructions that break a model feature arrive in documents, ticket text and retrieved records.
Secure development27 March 2026
Broken object level authorization: IDOR in real apps
The app checks that a user is logged in and never checks that the record is theirs.
Offensive testing24 March 2026
Password spraying still works
Spraying one password across every account sidesteps a lockout policy that counts failures per user.
Defensive & advisory21 March 2026
Do you need to back up Microsoft 365, and what does it already keep
Retention timers in SharePoint, OneDrive, Exchange and Teams decide whether recovery is possible.
Defensive & advisory19 March 2026
The logging you will want in a breach
Five properties decide whether logs can answer how an attacker got in and what they touched.
Software engineering16 March 2026
Offboarding: the access that outlives the employee
Shared logins, API keys, OAuth grants and SaaS accounts outlive the leaver whose account you disabled.
Breach remediation13 March 2026
How long Microsoft keeps the logs you will need after a breach
Retention defaults in Entra ID, the unified audit log and Azure decide which events still exist.
Software engineering11 March 2026
Secrets management past the .env file
A secret manager, managed identity and short-lived credentials replace what the .env file cannot do.
Defensive & advisory9 March 2026
What a guest account can see in your Microsoft 365 tenant
The defaults decide how much of the organisation one partner invitation exposes.
Software engineering6 March 2026
Hardening Microsoft 365 on the licences you already have
The controls that stop commodity account takeover ship in every Microsoft 365 tier and default loose.
Offensive testing3 March 2026
How attackers move laterally in a Windows network
Credential reuse chains one compromised laptop to domain control, and a few controls cut the chain.
Software engineering28 February 2026
What encryption at rest protects you from
Disk and database encryption stop a stolen drive and do nothing about an application query.
Defensive & advisory25 February 2026
What belongs in an incident response plan
A plan that works under pressure is short, names real people and settles the hard decisions early.
Secure development23 February 2026
What an enterprise buyer means when the contract says SAML single sign-on
An SSO clause hands your customer's identity team authority over who holds an account in your product.
Offensive testing20 February 2026
What to measure in a phishing simulation
Report rate and time to report predict the real outcome.
Defensive & advisory17 February 2026
Token theft: when attackers skip the password entirely
An attacker holding a valid session token never sees a login page.
Software engineering14 February 2026
The Azure database that is reachable from the internet by design
A managed database, cache or vault arrives with a public endpoint and a firewall in front.
Secure development12 February 2026
Threat modelling without the theatre: a working method
A small team keeps threat modelling with one diagram, drawn trust boundaries and STRIDE as a prompt list.
Defensive & advisory9 February 2026
The anatomy of a business email compromise
Business email compromise ends with a payment the victim authorised, weeks after the first login.
Secure development6 February 2026
Turning penetration test findings into work your engineers will finish
A report is ordered by severity, and a codebase changes by root cause.
Defensive & advisory4 February 2026
The first hour of an incident
Isolate without powering off, preserve the record, make three calls.
Compliance readiness1 February 2026
What a security schedule in a customer contract commits you to
A security schedule carries a notification clock in hours, an audit right, flow-downs and a deletion certificate.
Secure development28 January 2026
When the package name is the attack
Typosquats, dependency confusion and invented package names turn one wrong install into code execution.
Compliance readiness26 January 2026
How long you must keep customer data, and when keeping it becomes the risk
The Privacy Act states no retention period, and a stack of other statutes pulls against it.
Defensive & advisory23 January 2026
Why MFA still gets bypassed, and what stops it
Session token theft, AiTM kits and push fatigue bypass MFA, and conditional access closes each one.
Secure development19 January 2026
Reviewing AI-generated code before it ships
Generated diffs carry invented dependencies, inline secrets and missing authorisation checks.
Secure development14 January 2026
Supply chain risk in your dependencies
A dependency review checks lockfile discipline, provenance and the SBOM before a package reaches CI.
Want this kind of engineering on your systems?
Brisbane head office.