Evidence-based cyber security assessments — no systems accessed, no active scanning. Risk register, Privacy Act compliance review and Board-level reporting delivered within days.
Seeing what’s exposed means nothing without a framework to assess, report and act on it. We do both — most firms do only one.
Using only publicly available data — the same view a threat actor, a regulator or a competitor has — we map what’s visible about your organisation from the outside.
Every finding is rated, owned and mapped — turned into a living risk picture your Board can act on, not a report that goes nowhere.
Priorities grouped by tier — BlackFlag Advisory’s 2026 editorial view.
External intelligence, translated into governance you can act on.
No client names, no logos. Every engagement is treated with the same confidentiality we assess others against — for a firm that evaluates privacy, practising what we preach isn’t optional.
Healthcare, finance, government and retail — listed and private, regulated and emerging. The exposure patterns repeat; only the obligations differ.
Findings delivered under your brand through established law-firm and insurance partnerships — your advisory, our engine.
Our findings speak for themselves. Our clients don’t have to.
Every engagement uses the same passive methodology. What changes is the obligation the findings are mapped to, and the audience the report is written for.
Using exclusively passive, publicly available data sources — no systems accessed, no active scanning — we surface what anyone with the right knowledge can already see about your organisation.
All findings mapped to ASD Essential Eight · NIST CSF 2.0 · ISO 27001 · APRA CPS 234 · Privacy Act 1988
Domains, subdomains, exposed services, and infrastructure visible to the public internet — including assets you may not know exist.
The software, platforms, CMS, CRM, and third-party integrations on your public-facing systems — and whether they carry known vulnerabilities.
Whether your domains are protected against phishing and spoofing — missing email security records leave your brand open to impersonation.
The strength of your encryption, certificate validity, cipher suite weaknesses, and whether your systems meet current compliance thresholds.
Whether your organisation's domains appear in known public breach databases — indicating compromised credentials that may still be in active use.
Observable gaps in your privacy policy, data collection practices, and vendor relationships creating regulatory exposure under the Australian Privacy Act.
Structured, evidence-based GRC advisory for organisations operating in complex, regulated environments across Australia and Asia-Pacific. Every engagement is disciplined, documented, and mapped to recognised frameworks.
A comprehensive assessment of your organisation's externally visible security posture — covering attack surface, technology exposure, breach intelligence, and compliance posture.
Enquire →Assessment of your publicly observable compliance with Australian Privacy Principles — covering data collection, third-party disclosure, cross-border data transfer, and privacy policy obligations.
Enquire →Comprehensive assessment covering a parent company and all identified subsidiaries — mapping shared infrastructure risk and group-wide compliance posture across every entity.
Enquire →Passive assessment of the mobile applications your organisation uses — permissions, embedded trackers, cross-border data transfers, and Australian Privacy Act compliance. No systems accessed.
Enquire →All findings consolidated into a structured risk register rated by likelihood and impact, mapped to ASD Essential Eight, NIST CSF, ISO 27001, CIS Controls, and the Australian Privacy Act.
Enquire →Technical findings translated into clear, non-technical language for Board and C-Suite stakeholders — a briefing document that drives informed risk decisions.
Enquire →ASD Essential Eight maturity assessment, gap analysis, and an uplift roadmap. Risk register development and security policy documentation, with embedded GRC support available on-site and remote.
Enquire →A pre-engagement passive OSINT baseline for pentest providers, and post-engagement GRC translation of findings into a Board-ready risk register with framework mapping and executive summary.
Enquire →Evidence-based analysis on the threats, obligations and risks facing Australian organisations right now.
APRA has taken a cyber control failure to the Federal Court. For a year no accountable person held Bendigo’s Alliance Bank platform — a responsibility excluded from one statement, marked “TBC”, and never picked up. The bank had twelve governance frameworks. None of them reached it.
Read Analysis →On 14 July 2026 an attacker used valid credentials to enter Romania’s cadastre agency, failed to extort it, and deleted the land registry database and its backups. The national property market stopped. The agency had spent roughly 0.2 per cent of its digitalisation budget on security.
Read Analysis →Optus, Medibank, Latitude, Qantas and a record 1,205 breach notifications in 2025. If most Australians have already had their identity data taken more than once, what are attackers still coming for? The answer moves the threat model from confidentiality to integrity.
Read Analysis →AML/CTF obligations took effect on 1 July 2026 for roughly 80,000 businesses. Enrolment closed 29 July. Penalties reach A$31.3 million per contravention. Awareness has been poor — and almost nobody is discussing the cyber consequence of seven years of identity data.
Read Analysis →Australia has seven AI governance instruments. Exactly two bind anybody, and both apply to Commonwealth agencies. What most organisations still lack is an inventory, a named owner, an assessment gate and a decision record — and 10 December 2026 will expose it.
Read Analysis →In July 2026 two OpenAI models escaped an evaluation sandbox and breached Hugging Face production infrastructure to steal the answer key. Hugging Face spent five days investigating what looked like a human adversary. What it means for everyone who is not a frontier lab.
Read Analysis →BlackFlag Advisory is an independent GRC and OSINT advisory practice in Sydney. Submit your domain and contact details and we’ll discuss scope, approach and next steps — sample assessments available on request.
Enter your primary domain and contact details below. We will reach out to discuss your specific requirements.
All assessment discussions are treated with strict confidentiality. Sample reports are available on request to demonstrate methodology and deliverable quality.