When a client faces a Privacy Act inquiry, a procurement question, or a Board request they can't answer — you refer. We assess. You receive a referral fee and your client gets a result. No overlap with your legal services.
Your practice covers governance, regulation, and compliance — but not the technical assessment that sits underneath it. That's where we come in.
Your client is responding to an OAIC inquiry or preparing for the 2024 Privacy Act amendments. They need an evidence-based assessment of what's actually exposed — not an opinion.
Pre-acquisition due diligence increasingly includes cyber posture. A passive OSINT assessment gives your client a clear picture of the target's external exposure without alerting the market.
Directors need to demonstrate they've exercised due care on cyber risk. A Board-ready GRC assessment gives them documented evidence of the organisation's external posture.
When APRA, the OAIC, or a sector regulator asks questions, your client needs evidence — not assurances. Our assessments provide sourced, framework-mapped findings.
Government and enterprise procurement increasingly requires GRC evidence. A structured assessment with framework mapping satisfies the requirements your client can't produce internally.
After a breach, your client needs to understand what was visible before the incident. A passive assessment reconstructs the external picture without interfering with forensics.
No technical expertise required from your side. No client confusion. No overlap with your legal services.
The client calls you. You don't provide cyber assessments — and you shouldn't have to. You refer them to BlackFlag Advisory. We deliver a passive OSINT assessment within 7 days. The client gets the evidence their insurer needs. You receive a referral fee. No scope creep, no technical involvement, no conflict.
Directors need to demonstrate due care. Your client has no internal cyber assessment capability. You refer them to us. We produce a Board-ready report — framework-mapped, risk-registered, plain English. The directors have documented evidence. You've added value without stepping outside your practice.
The following is drawn from a real passive OSINT assessment conducted in 2026. Company details have been anonymised.
The company’s website contained no published privacy policy. Instead, the only privacy-related link redirected to a third-party whistleblower platform’s own privacy statement — which has no relevance to the company’s data collection practices. For an ASX-listed organisation in the healthcare sector, handling clinical and patient-adjacent data, this represents a direct APP 1 failure under the Privacy Act 1988.
The assessment also identified infrastructure hosted in the United States with no observable APP 8 cross-border disclosure arrangements, three WordPress admin panels accessible at default paths, and no Content Security Policy header.
On the positive side, email authentication was strong — DMARC p=reject, four DKIM selectors, SPF -all enforced. TLS 1.3 configured and a WAF in place. No credential exposure identified.
This is the kind of finding a privacy lawyer acts on immediately. The company’s legal counsel had no visibility of the gap until an external assessment surfaced it.
The following is a reduced extract from a real BlackFlag Advisory assessment conducted in 2026. Company details have been anonymised. The full engagement includes a complete risk register, framework mapping, remediation roadmap, and Board-level executive summary.