Insights.
Short technical write-ups from real work.
Reference guides
Offensive testing
What a penetration test costs in Australia
Cost follows scope, and there is no standard rate card. Broad Australian market ranges by engagement type, the handful of decisions that actually move the number, and why the cheapest quote in your inbox is usually a vulnerability scan sold as a penetration test.
Defensive & advisory
What a vCISO costs in Australia
vCISO quotes contradict each other because they price different shaped engagements. What actually moves the number, the models the Australian market sells, broad ranges to sense-check a proposal against, when a retainer earns its cost over ad-hoc consulting, and the questions worth asking before you sign.
Defensive & advisory
What to fix in SharePoint before you turn on Microsoft 365 Copilot
Copilot grants nobody new access and removes the effort of finding, which turns old SharePoint permission defects into visible answers. The signals that mark a risky site, the difference between containing an exposure and fixing it, and the stopgap that can no longer be switched on after 31 July 2026.
Defensive & advisory
What Australian cyber insurers check before they quote you
A cyber proposal form asks binary questions about controls that are never binary in a real environment. The recurring questions, the evidence that answers each one, and how a declaration gets tested against system timestamps after a loss.
Software engineering
RBAC vs ABAC, and where the permission check belongs
Authorisation is one question with four parts, and the decision that shapes everything after it is whether that question gets answered in one place or re-answered in every handler. Two reference tables compare the models and the layers a check can sit in.
Compliance readiness
What a government tender means when it asks for the Essential Eight
A map from Australian government buyer to the security artefact they actually want, what each one evidences and fails to evidence, and how to answer a schedule asking for something you do not yet have.
Breach remediation
Deciding whether to rebuild or restore after ransomware
Once containment holds, the question is which parts of the environment you are willing to trust again. A decision table for clean, selective rebuild or full rebuild, the order credentials get rotated in, and what has to be true before anyone declares normal operation.
Defensive & advisory
An incident severity matrix you can use
Most incident plans skip the decision that shapes every other decision: how bad is this. A four-level severity matrix for Australian businesses, with first actions, internal escalation and the external notification clocks per level.
Secure development
Shipping AI-written code without shipping its mistakes
AI coding tools produce working applications in the same confident tone whether the security is right or wrong. A guide to the eight places AI-generated code typically fails, the pre-ship checks a competent developer can run, and the point where a professional review is warranted.
Offensive testing
Choosing the right security assessment: what each type answers
Seven assessment types compared on what they find, what they cannot, and what you receive, plus how to match them to your maturity, sequence them over a year, and read a proposal before signing.
Compliance readiness
The Australian cyber compliance map: what applies to your business
One reference table mapping the Privacy Act, the NDB scheme, the SOCI Act, CPS 234, PCI DSS and the voluntary assurance frameworks to the businesses they bind, with a workable order for tackling them.
Self-serve tools
All toolsCompliance readiness
Essential Eight self-check
Twenty-four questions against the eight strategies. See where you stand.
Secure development
AI-built app risk check
Shipped something AI-assisted? Sixteen questions before it holds real data.
Breach remediation
Breach notification helper
Walk the Notifiable Data Breaches test the way the OAIC frames it.
Secure development
Security headers check
Paste your response headers. Get a straight read on what is missing.
Defensive & advisory
Incident cost estimator
Put your own figures in and see what a bad week costs.
Defensive & advisory
Cyber insurance answer check
Twenty-two control questions, answered the way a proposal form asks them.
Offensive testing
Penetration test scope builder
Answer the scoping questions once and send the same brief to every provider.
Compliance readiness
Security questionnaire translator
Paste the questions. See what each one is asking for and what evidence answers it.
Defensive & advisory11 September 2026
What a read-only Azure security assessment can prove
A read-only Azure security assessment, run with Global Reader in Entra ID and Reader at subscription scope, proves what the tenant is configured to do. It shows who holds which privilege, which conditional access policies apply to which accounts, what the control plane exposes to the internet, where secrets are meant to live, and whether telemetry is being collected. It does not prove that a control holds against an attempt, or that the software behind an open port is safe. Those questions need a credentialled or attacker-perspective test. The read-only phase establishes those facts without changing the environment and identifies which findings warrant testing.
Breach remediation11 September 2026
What a closure pack proves before breach remediation sign off
A closure pack is the set of artefacts that shows an incident is finished: the root cause named as a defect someone can change, the fix deployed and reviewed, the same defect cleared wherever else it appears, and a re-test in which the original finding could not be reproduced. A named person with authority signs that position and accepts whatever risk remains. The pack is read by your insurer, by customers whose contracts carry notification and evidence clauses, and by the legal advisers running the assessment under the Privacy Act's Notifiable Data Breaches scheme.
Offensive testing22 August 2026
What a penetration test costs in Australia
Cost follows scope, and there is no standard rate card. Broad Australian market ranges by engagement type, the handful of decisions that actually move the number, and why the cheapest quote in your inbox is usually a vulnerability scan sold as a penetration test.
Defensive & advisory22 August 2026
What a vCISO costs in Australia
vCISO quotes contradict each other because they price different shaped engagements. What actually moves the number, the models the Australian market sells, broad ranges to sense-check a proposal against, when a retainer earns its cost over ad-hoc consulting, and the questions worth asking before you sign.
Software engineering13 August 2026
Case study: Xero as the bank truth behind a law firm and a fund licensee
Two production integrations on Xero's Accounting API: the three-way trust reconciliation behind GRM LAW's end-of-month compliance, and the hourly bank-feed sync that keeps Stone Leaf Capital's fund ledger current.
Defensive & advisory28 July 2026
What to fix in SharePoint before you turn on Microsoft 365 Copilot
Copilot grants nobody new access and removes the effort of finding, which turns old SharePoint permission defects into visible answers. The signals that mark a risky site, the difference between containing an exposure and fixing it, and the stopgap that can no longer be switched on after 31 July 2026.
Defensive & advisory27 July 2026
What Australian cyber insurers check before they quote you
A cyber proposal form asks binary questions about controls that are never binary in a real environment. The recurring questions, the evidence that answers each one, and how a declaration gets tested against system timestamps after a loss.
Software engineering25 July 2026
RBAC vs ABAC, and where the permission check belongs
Authorisation is one question with four parts, and the decision that shapes everything after it is whether that question gets answered in one place or re-answered in every handler. Two reference tables compare the models and the layers a check can sit in.
Compliance readiness23 July 2026
What a government tender means when it asks for the Essential Eight
A map from Australian government buyer to the security artefact they actually want, what each one evidences and fails to evidence, and how to answer a schedule asking for something you do not yet have.
Breach remediation21 July 2026
Deciding whether to rebuild or restore after ransomware
Once containment holds, the question is which parts of the environment you are willing to trust again. A decision table for clean, selective rebuild or full rebuild, the order credentials get rotated in, and what has to be true before anyone declares normal operation.
Compliance readiness20 July 2026
How to answer a vendor security questionnaire without stalling the deal
The reviewer on the other side of the sheet is testing four things and cross-checking your answers against each other and against everything public. A working method for answering, including how to answer no in a way a buyer accepts, and the artefact pack that closes most rows before the sheet arrives.
Defensive & advisory18 July 2026
What to check in an Entra ID app registration security review
App registrations and service principals authenticate as themselves, with no user and no multi-factor claim for a conditional access policy to evaluate. A review of that plane asks which app-only permissions are granted, which credentials can use them, who can quietly add another one, and what the tenant settings do about the next grant.
Offensive testing16 July 2026
What a penetration test attestation letter has to say, and what stays in the report
The report and the attestation letter answer different questions, and sending the wrong one either stalls a deal or hands a stranger a working attack path into your own systems. What each has to state, and how to re-rank severity against your real exposure.
Defensive & advisory14 July 2026
An incident severity matrix you can use
Most incident plans skip the decision that shapes every other decision: how bad is this. A four-level severity matrix for Australian businesses, with first actions, internal escalation and the external notification clocks per level.
Secure development13 July 2026
Shipping AI-written code without shipping its mistakes
AI coding tools produce working applications in the same confident tone whether the security is right or wrong. A guide to the eight places AI-generated code typically fails, the pre-ship checks a competent developer can run, and the point where a professional review is warranted.
Offensive testing12 July 2026
Choosing the right security assessment: what each type answers
Seven assessment types compared on what they find, what they cannot, and what you receive, plus how to match them to your maturity, sequence them over a year, and read a proposal before signing.
Compliance readiness10 July 2026
The Australian cyber compliance map: what applies to your business
One reference table mapping the Privacy Act, the NDB scheme, the SOCI Act, CPS 234, PCI DSS and the voluntary assurance frameworks to the businesses they bind, with a workable order for tackling them.
Software engineering9 July 2026
An audit ledger nobody can quietly edit
Why mutable audit tables collapse under scrutiny, and the append-only audit ledger pattern, machine-enforced on every state change, that we run in production for GRM LAW.
Secure development9 July 2026
A content-security policy that blocks something
Why default-permissive content-security policies block nothing, and the engineering behind a CSP that actually contains script injection.
Compliance readiness9 July 2026
What an Essential Eight self-assessment takes
The practitioner view of self-assessing against the ASD Essential Eight: what each strategy really tests, what evidence stands up, and how to sequence an uplift without freezing delivery.
Software engineering9 July 2026
Tenant isolation that survives a bad query
PostgreSQL row-level security as the tenant isolation layer in clinical software: the policy pattern, the operational cost, and why WHERE clauses are not a model.
Compliance readiness8 July 2026
SMB1001 or Essential Eight: which should you do first?
The Essential Eight measures technical hardening and SMB1001 certifies whole-of-business practice. For most smaller Australian businesses the two are best done in sequence.
Offensive testing6 July 2026
What an API penetration test finds that a web application test misses
A browser-driven test exercises the API through the one path the interface allows. This sets out what a separate API engagement adds: the authorisation matrix across roles and tenants, mass assignment, versions nobody retired, GraphQL cost limits, and tokens issued to machines.
Defensive & advisory3 July 2026
Alerts worth waking up for: detection without a SOC
Small teams need a short list of alerts someone will genuinely act on. How to pick them, tune out the noise, and delete the rest.
Breach remediation30 June 2026
What to do when your vendor has a data breach
A supplier breach leaves you holding the legal obligation and almost none of the visibility. What to put in writing on day one, what you can contain unilaterally, how to assess when the vendor will not confirm anything, and who notifies when more than one entity holds the data.
Software engineering26 June 2026
Patching without breaking production: a field guide
The flaw that gets exploited is usually one with a fix already published. A working system of triage, rings, rollback and standing windows makes patching fast and boring.
Defensive & advisory22 June 2026
What Australian director duties require a board to show about cyber risk
Cyber risk reaches directors through the ordinary care and diligence duty, and the Australian decision on point judged adequacy on expert evidence, not the licensee's own assessment. What a board has to produce is a record of the questions it asked, the answers it received, and what changed.
Compliance readiness19 June 2026
Privacy by design starts with collecting less data
Collecting less personal data cuts breach impact, retention risk and compliance load. A field note on data minimisation under the APPs, retention schedules that execute, and delete-by-default engineering.
Software engineering16 June 2026
Shadow IT and the SaaS you cannot see
Unsanctioned SaaS holds company data whether or not anyone can see it. Field notes on finding it through identity logs, DNS and expense reports, reining in OAuth grant sprawl, and why a fast sanctioning path works better than a ban.
Offensive testing12 June 2026
Red team or penetration test: which do you need?
A penetration test measures the security of a system. Adversary simulation measures whether your organisation can detect and stop an intruder, and most buyers need the first before the second.
Secure development9 June 2026
AI coding agent security starts with what it can already reach
A coding agent runs with the credential set of whoever launched it, and it takes instructions from whatever it reads, so a dependency README, a ticket comment and a tool description are all places an instruction can be planted. What an agent holds, how injected instructions reach it, and which boundaries genuinely bound it.
Software engineering5 June 2026
Microsoft Entra conditional access that holds
Entra's policy engine is default allow: a sign-in that matches no conditional access policy walks straight in. A field note on building a policy set with no seams.
Compliance readiness2 June 2026
Ransomware and the question of paying
A ransom demand puts an unrehearsed decision in front of the business. What the law says about paying, who must be told within 72 hours, what the insurer will require, and the preparation that means the decision is never made under pressure.
Secure development29 May 2026
What a human reviewer catches that a scanner misses
Static analysis is fast and cheap but cannot judge intent. Where automated scanning helps, where it cannot, and the serious flaws only a reviewer who understands the system will find.
Secure development26 May 2026
Who should own the Azure tenant when someone else builds your system
Account custody decides who can revoke access and who can produce the audit trail. The accounts that matter on a custom build, what least privilege for the builder should look like, and an exit test that proves ownership in an afternoon.
Defensive & advisory22 May 2026
What a web application firewall cannot do
What a WAF actually stops, the classes of serious flaw it cannot see, and how to use it as a layer over secure code rather than a substitute.
Compliance readiness19 May 2026
The Privacy Act for software teams
The Privacy Act sets outcomes and engineering decisions determine whether you meet them. How the APPs translate into schema, logging, region and product choices, and where reform is heading.
Compliance readiness15 May 2026
What an ISO 27001 auditor checks, and how to prepare
Certification audits fail on evidence, however good the documents. Where the auditor samples, what the Statement of Applicability commits you to, and how to make Stage 2 uneventful.
Compliance readiness12 May 2026
What a SOC 2 report tells you
A vendor's SOC 2 is evidence only if someone reads it properly. Where the opinion, period, scope, carve-outs and exceptions sit in the report, and the questions no SOC 2 answers.
Compliance readiness8 May 2026
What you must do when personal data leaks
When personal information is exposed, the Privacy Act sets a clock running. What an eligible data breach is, the assessment obligation, who you must tell, and the preparation that makes the day survivable rather than chaotic.
Offensive testing5 May 2026
Social engineering has left the inbox
Phishing filters watch the inbox while attackers ring the helpdesk, text personal phones and bomb users with push prompts. A field note on the channels email controls never see, and the verification culture that stops them.
Defensive & advisory1 May 2026
Backups that survive ransomware as well as disk failure
What ransomware actually does to your recovery position, and the properties, immutability, offline copies and tested restores, that decide whether you pay or restore.
Secure development28 April 2026
The API key you shipped to every customer
Any secret compiled into a mobile binary or bundled into frontend JavaScript is published the day you ship it. Field notes on how keys get extracted, what attackers do with them, the backend-for-frontend pattern, and the scoping, rotation and monitoring that contain the ones that must ship.
Software engineering24 April 2026
Shifting security left without slowing delivery down
Security gates fail when developers stop believing them. A field note on secret scanning, dependency checks and IaC gates that block only what matters.
Offensive testing21 April 2026
What a mobile app penetration test covers
A mobile engagement is three pieces of work usually quoted as one: the shipped package, what the app leaves on a device you do not control, and the API behind it. What each layer finds, what to hand the tester before the start date, and why remediation through a store review queue needs a server-side plan.
Defensive & advisory17 April 2026
Zero trust for a fifty-person company: where to start
Identity as the perimeter, device health as the second signal, standing privilege stripped out. The pragmatic zero trust path for an SMB, mostly on licensing you already own.
Defensive & advisory14 April 2026
The VPN appliance on your perimeter is now the target
The edge device that authenticates your remote workforce is highly exposed and hard to monitor. A field note on the appliance exploitation wave, the compensating controls, and when retirement is the better call.
Offensive testing10 April 2026
A penetration test is not a vulnerability scan
Buyers frequently pay for a scan when they need a test. Where automated scanning stops and human testing begins, with a scoping guide for both.
Offensive testing7 April 2026
Scoping a penetration test properly
Most of a penetration test's value is fixed before testing starts. What a useful scope contains, the scoping mistakes that waste an engagement, and the questions a good scoping call asks.
Defensive & advisory3 April 2026
The Azure storage account that was public all along
Azure storage accounts are reachable from the internet by default, and nobody is asked to decide otherwise. Why the defaults expose data, and how to close them without breaking production.
Offensive testing31 March 2026
How to security test an LLM feature already in production
The instructions that break a shipped model feature arrive in uploaded documents, ticket text and retrieved records, so a test plan that only fuzzes the chat box misses them. Where to plant payloads, why the retrieval index is an authorisation boundary, and what a pass means when the system is not deterministic.
Secure development27 March 2026
Broken object level authorization: IDOR in real apps
Broken object level authorization is the serious flaw we report most: the app checks that a user is logged in but not that the record belongs to them. How it happens and how to test for it.
Offensive testing24 March 2026
Password spraying still works
Spraying one common password across every account sidesteps lockout policies that only count failures per user. A field note on the passwords that fall, the endpoints without MFA, and how to measure your exposure without locking staff out.
Defensive & advisory21 March 2026
Do you need to back up Microsoft 365, and what does it already keep
Microsoft holds your deleted data for a defined number of days, and the defaults decide whether recovery is possible at all. The documented timers across SharePoint, OneDrive, Exchange and Teams, and the four cases that settle whether you need a separate copy.
Defensive & advisory19 March 2026
The logging you will want in a breach
Most environments log for uptime, and uptime logs cannot answer an investigation. A field note on the five properties that decide whether anyone can answer how an attacker got in and what they touched.
Software engineering16 March 2026
Offboarding: the access that outlives the employee
Disabling the directory account is the easy part of offboarding. A field note on the shared logins, API keys, OAuth grants and SaaS accounts that outlive a leaver, and the quarterly hunt that finds them.
Breach remediation13 March 2026
How long Microsoft keeps the logs you will need after a breach
The documented retention defaults across Microsoft Entra ID, the Microsoft 365 unified audit log and Azure platform logs, the licence seams that decide which events exist at all, and why upgrading after an incident recovers nothing.
Software engineering11 March 2026
Secrets management past the .env file
The .env file fails at distribution, rotation and revocation. Storage is not the failure. A field note on secret managers, managed identity, short-lived credentials and finding what has already leaked into git history.
Defensive & advisory9 March 2026
What a guest account can see in your Microsoft 365 tenant
The defaults decide how much of your organisation a single partner invitation exposes. What a guest can read, who is allowed to invite one, what inbound trust commits you to, and the partner access that creates no directory object at all.
Software engineering6 March 2026
Hardening Microsoft 365 on the licences you already have
The controls that stop commodity account takeover ship in every Microsoft 365 tier, and most of them default loose. What to set on Business Premium and below, and the short list that genuinely needs enterprise licensing.
Offensive testing3 March 2026
How attackers move laterally in a Windows network
The path from one compromised laptop to full domain control is a chain of credential reuse. This is how that chain gets built, and the few controls that reliably cut it.
Software engineering28 February 2026
What encryption at rest protects you from
Disk and database encryption stop a stolen drive and a copied backup, and they do nothing about a query your application is willing to run, which is the path almost every real exposure takes.
Defensive & advisory25 February 2026
What belongs in an incident response plan
Most incident response plans were written to satisfy an auditor and fail the first time someone opens them under pressure. The useful ones are short, name real people, and settle the hard decisions in advance.
Secure development23 February 2026
What an enterprise buyer means when the contract says SAML single sign-on
An enterprise single sign-on clause hands your customer's identity team authority over who holds an account in your product and how fast it stops working. What to build for SAML and OpenID Connect, the assertion validation that keeps one customer out of another customer's workspace, what SCIM has to do about leavers, and the credentials that survive enforcement.
Offensive testing20 February 2026
What to measure in a phishing simulation
Why report rate and time to report are the numbers that predict how a real phishing campaign ends.
Defensive & advisory17 February 2026
Token theft: when attackers skip the password entirely
Attackers increasingly arrive holding a valid session cookie or OAuth token and never see a login page. A field note on how tokens get stolen, what they are worth, and the binding, monitoring and revocation work that limits the damage.
Software engineering14 February 2026
The Azure database that is reachable from the internet by design
A managed database, cache or vault arrives with a public endpoint and a firewall in front of it, so private is a decision somebody has to make. What the allow Azure services rule really admits, why a private endpoint can still carry traffic over the public path, and the order that closes it without an outage.
Secure development12 February 2026
Threat modelling without the theatre: a working method
Threat modelling that a five-person team will actually keep doing: one honest diagram, boundaries drawn where trust changes, and STRIDE run as a prompt list rather than a ceremony.
Defensive & advisory9 February 2026
The anatomy of a business email compromise
Business email compromise ends with a payment the victim authorised themselves. A field note on the quiet weeks before that transfer, the controls that break the chain, and what the first day after discovery should look like.
Secure development6 February 2026
Turning penetration test findings into work your engineers will finish
A report is ordered by severity because that is how a tester writes it, and a codebase changes by root cause. The re-sort, the rule that keeps a class shut once you close it, and the closure record a retester can check without asking you.
Defensive & advisory4 February 2026
The first hour of an incident
The instinct in a suspected breach is to wipe, reboot and reset. In the first hour, isolate without powering off, preserve the record, and make three calls in the right order.
Compliance readiness1 February 2026
What a security schedule in a customer contract commits you to
A security schedule is an operative term of the contract, live for the whole term and usually past it, carrying a notification clock measured in hours, an audit right, a flow-down to every provider you use, and a deletion certificate somebody has to sign. This sets out what each clause family obliges, the evidence that discharges it, and where suppliers land.
Secure development28 January 2026
When the package name is the attack
Typosquats, dependency confusion and AI-invented package names all turn one wrong install command into code execution on a developer laptop or CI runner. What each attack looks like, and the checks that catch it before the install runs.
Compliance readiness26 January 2026
How long you must keep customer data, and when keeping it becomes the risk
The Privacy Act states no retention period anywhere, only a test for when disposal falls due, and a stack of other statutes pulls against it. How to reconcile both into one schedule, where deletion silently fails, and what proves it ran.
Defensive & advisory23 January 2026
Why MFA still gets bypassed, and what stops it
Most MFA bypasses never attack the factor itself. A field note on session token theft, AiTM kits, push fatigue and the conditional access work that actually stops account takeover.
Secure development19 January 2026
Reviewing AI-generated code before it ships
AI assistants produce fluent code with systematic security gaps: invented dependencies, inline secrets, missing authorisation checks and confidently wrong cryptography. A reviewer's posture for diffs where much of the code was generated.
Secure development14 January 2026
Supply chain risk in your dependencies
A compromised npm or PyPI package runs on your CI runner with your deploy tokens long before it reaches production. Field notes on lockfile discipline, provenance, SBOMs and what a dependency review actually checks.
Want this kind of engineering on your systems?
Brisbane head office. Work delivered across Australia.