See your organisation the way an attacker already does.
Evidence-based cyber security assessments. No systems accessed, no active scanning. A rated risk register, framework mapping and Board-level report — delivered within days.
A quick, passive look at what your organisation shows the public internet. Nothing on your side is touched.
Get your detailed gap report — every finding explained, rated and mapped to the frameworks that apply to you. Confidential, no obligation.
We’ll be in touch within 24 hours with your detailed gap report for {{ scanned }}.
From exposure to action, in three steps.
Seeing what is exposed means nothing without a framework to assess, report and act on it. We do both — most firms do only one.
Observe
We map what a threat actor, regulator or competitor already sees — using public data only.
Map
Every finding is rated, owned and mapped to the obligations that apply to you.
Report
A living risk register and a plain-language Board briefing your directors can act on.
What a threat actor already knows about your organisation
Credential and secret exposure, supply-chain footprint, forgotten assets, exposed management interfaces, email spoofing posture, TLS hygiene and known CVEs.
Passive OSINT assessment →GRC is not a document. It is a cyber posture.
Regulatory change, AI governance, Board oversight, operational resilience (CPS 230), identity and access governance, incident readiness and independent assurance.
GRC advisory →Seven assessments. One methodology.
What changes is the obligation your findings are mapped to, and who the report is written for.
Average cost of a data breach in Australia — a record high.
Breaches reported to the OAIC in 2024 — the highest annual total on record.
Maximum penalty per serious Privacy Act breach under the 2024 amendments.
Latest analysis
10 December. Is your privacy policy ready?
The OAIC has stopped warning and started checking. From 10 December 2026, businesses must disclose where software makes, or helps make, decisions that significantly affect people.
Read analysis →ASD ISM, June 2026. Every control, compared.
The Govern function doubled, twenty-nine controls were added, one was removed — and not one of June’s twenty new controls maps to the Essential Eight.
Read the comparisonReady to see what we find?
Submit your domain and contact details and we’ll discuss scope, approach and next steps. Sample assessments available on request.
We’ll be in touch within 24 hours.
Discretion isn’t a marketing position. It’s how we operate.
Confidential by design
No client names, no logos. Every engagement gets the confidentiality we assess others against.
Across every sector
Healthcare, finance, government and retail. The exposure patterns repeat; only the obligations differ.
White-label ready
Findings delivered under your brand through law-firm and insurance partnerships. Partnerships →
One methodology. Eight obligations.
Every engagement uses the same passive methodology. What changes is the framework the findings map to, and the audience the report is written for.
Which obligation do you carry?
{{ rec.why }}
All assessments
What does not change
GRC is not a document. It is a cyber posture.
Most Australian organisations have a GRC framework on paper. Very few have one that functions under scrutiny — from regulators, insurers, or a breach investigation.
Three functions, managed together — but genuinely distinct.
Governance
Who decides risk appetite, who owns security outcomes, and how the Board knows it is working.
Risk management
Identify, assess, treat, monitor — with explicit decisions recorded against each risk.
Compliance
Meeting the Privacy Act, CPS 234, ISO 27001, SOC 2 and NIST — with evidence, not assertion.
Frameworks we map to
One report covering every framework you are obligated or expected to meet.
What your Board receives
A structured document your Directors can read, act on, and present to insurers, regulators or clients. Delivered within five business days.
Request an assessment →Intelligence
{{ feat.excerpt }}
Read analysis →Add cyber GRC to your practice — without hiring for it.
We partner with law firms, insurers, accounting practices and advisory firms who need specialist cyber GRC capability, delivered under a model that works for your business.
Start a partnership conversation →Three ways to work together
Referral
You introduce the client. We scope, deliver and report — treating your name as if it is on the cover.
Shared engagement
We deliver the cyber evidence; you deliver the legal, financial or insurance advice built on it.
White-label
Findings delivered under your brand. Your advisory, our engine.
Who we partner with
Law firms
Privacy, breach response and Tranche 2 matters that need independent technical evidence.
Law firm partnerships →Insurers & brokers
External security reviews for underwriting, renewal and portfolio risk.
Insurer partnerships →Accountants & advisory
Cyber GRC for clients facing new regulatory and Board-level obligations.
Advisory partnerships →Start a partnership conversation.
Tell us about your firm and what you’re looking for. No commitment — a conversation between professionals.
We look from the outside. You see what’s really there.
Every fee agreed in writing before we start. No hourly rates and no variation without your agreement. Every package comes with a sample extract so you know what you receive.
{{ k.name }}
{{ k.best }}
+{{ it.t }}
Privacy Readiness Assessment
Our GRC Assessment, extended with an automated decision-making readiness check — so you know where your privacy policy stands before the new APP 1 obligations apply.
See what you receive before you commit.
Extracts from real assessments, anonymised. Pick one to see the structure, findings and Board-ready format.
{{ w }}
{{ smp.cta }}
Compare packages
| Included | Surface | GRC | Website + App | Group |
|---|---|---|---|---|
| External attack surface & email security | ✓ | ✓ | ✓ | ✓ |
| Credential breach exposure | ✓ | ✓ | ✓ | ✓ |
| Privacy Act compliance review | — | ✓ | ✓ | ✓ |
| Structured risk register | — | ✓ | ✓ | ✓ |
| Board-level executive summary | — | ✓ | ✓ | ✓ |
| ISO 27001 & framework mapping | — | ✓ | ✓ | ✓ |
| Mobile app assessment | — | — | ✓ | — |
| Multi-entity coverage | — | — | — | ✓ |
| Delivery | 3 days | 5 days | 7 days | 7–10 days |
Common questions
What is not covered by the published price?+
Additional domains are $350 ex GST each and additional mobile apps $950 ex GST each. Multi-Entity Group includes up to 5 domains and 1 app. Your fixed fee is confirmed in writing before any work starts.
Do you access our systems or network?+
No — never. Every assessment uses passive OSINT and publicly available data only. This is not a penetration test.
Is this suitable for cyber insurance requirements?+
Yes. Many insurers now require evidence of an external security review. The risk register and framework mapping are designed to satisfy it.
How do I pay?+
We invoice once scope is confirmed; payment is by bank transfer. Nothing is payable upfront.
Fifteen minutes to scope it properly.
A short, confidential call to establish what is in scope, which obligations apply, and what the engagement would cost. No obligation.
{{ bookDone }} We’ll confirm your Microsoft Teams session within 24 hours.
{{ doc.h1 }} {{ doc.h1Accent }}
{{ doc.standfirst }}
{{ doc.sub }}
A quick, passive look at what your organisation shows the public internet. Nothing on your side is touched.
Get your detailed gap report — every finding explained, rated and mapped to the frameworks that apply to you. Confidential, no obligation.
We’ll be in touch within 24 hours with your detailed gap report for {{ scanned }}.
Start a partnership conversation.
Tell us about your firm and what you’re looking for. No commitment — a conversation between professionals.
{{ doc.ctaH }}
{{ doc.ctaP }}
A real assessment extract. Read it before you commit.
An extract from an actual BlackFlag Advisory mobile application assessment, anonymised. This is what arrives, in the format it arrives in.
App, developer and all identifying details are fictionalisedExecutive summary
{{ p }}
Application profile
Permissions analysis
{{ p }}
{{ pm.name }}{{ pm.label }}Tracker & SDK analysis
{{ p }}
Key findings
Australian Privacy Principles compliance
{{ p }}
| APP | Principle | Status | Finding |
|---|---|---|---|
| {{ rw.app }} | {{ rw.principle }} | {{ rw.status }} | {{ rw.finding }} |
Remediation roadmap
Ready to assess your organisation’s apps?
This is what a Passive Mobile App GRC Assessment delivers. No systems accessed. Board-ready report.
Is your GRC genuine or just a tick box?
Ten questions — the ones a regulator, an insurer or a breach investigation would actually ask. Answer honestly; nothing is sent anywhere.
{{ gq.resultBody }}
Answer at least 8 questions to see your result.
Every page
{{ sitemapLead }}
{{ g.name }}
{{ g.count }}Ready to see what we find?
Before you rewrite your privacy policy, see what’s actually running.
From 10 December your privacy policy must disclose where computer programs make, or substantially support, decisions that significantly affect people. The OAIC published its final guidance on 30 September and reads it broadly: rule-based tools, spreadsheets and generative AI all count. It can now issue infringement notices for policies that fall short.
BlackFlag Advisory is an independent cyber and GRC practice based in Sydney.
The evidence your policy needs
A remediation roadmap
Fixed fee for a single business. Report within 5 business days of scope confirmation.
Group, listed or multi-brand? From $5,450 ex GST for up to 5 domains and 1 app.
Group fee for up to 5 domains and 1 app. Each additional domain $350, each additional app $950. Fixed fee confirmed in writing before any work starts.
What the law now requires
All three must apply
What your policy must state
Where it expects to find it
Human review is not a safe harbour unless staff actively question the output and record why.
What happens after you book
Book
A short form. No payment now.
Scope confirmed
Within 1 business day, by email, with your fee and invoice. Groups receive their fixed group fee to accept first.
Report delivered
Within 5 business days for a single business; group timing is set in your quote. Includes the remediation roadmap.
Walkthrough
Optional 30-minute session to take your team through the findings.
What the findings look like
Each finding names the APP requirement, what we observed from public sources and what your policy needs to say. Client details are removed. Full sample reports are on the pricing page.
Before you book
Will anything touch our systems?+
No. The assessment is passive. We only look at what is publicly available: your websites, apps, published policies and public records. Nothing is scanned, logged into or tested.
Do you fix the gaps for us?+
No. We tell you what to fix, who should own each fix, how to close it and roughly how long it will take. Your own team or IT provider do the work. If you want, we re-assess afterwards to confirm every gap is closed.
We are already updating our privacy policy. Why do we need this?+
A policy can only disclose what the business knows is running. We show what is actually running on your public websites, apps and careers pages, so nothing is missed.
Who sees the findings?+
Only the people you name. Reports are confidential and are never published or used in our research.
How does payment work?+
Nothing is payable when you book. We confirm scope and fee within 1 business day and send the invoice with that confirmation, payable by bank transfer.
{{ prBookH }}
{{ prBookLead }} Book by 2 December to have your report before 10 December. Passive only: nothing touches your systems. Invoice on scope confirmation, paid by bank transfer.
Fixed fee confirmed in writing within 1 business day, before any work starts.