Every package includes a sample report extract so you know exactly what you receive before you commit. Passive only — no systems accessed, no active scanning.
Click any report below to see an extract of what a BlackFlag Advisory assessment delivers. All client details are anonymised.
Meridian Finance Group commissioned this assessment ahead of their annual cyber insurance renewal. Their insurer had requested evidence of a current external security review as a condition of maintaining existing coverage terms. With a group structure spanning four operating entities across consumer lending, investment management, and property finance, the Directors also sought a consolidated view of the group's external risk exposure ahead of a scheduled Board risk committee meeting.
Meridian Finance Group acted on the Critical and High findings within 14 days of receiving this report. Forced credential reset was implemented across all staff accounts. CMS plugin patches were applied within the ASD Essential Eight 48-hour window for Critical vulnerabilities. Exposed assets were taken offline and access controls were reviewed and hardened across the group. The insurer accepted the assessment report as evidence of due diligence and renewed the policy at the existing premium — a saving of approximately $18,000 against the projected increase. The Board risk committee received the executive summary as a standalone briefing document at their next scheduled meeting.
ConnectField Pro is a field service management application used by 47 field technicians to log job records, capture client signatures, photograph completed work, and access the customer database. The passive assessment identified significant compliance concerns — the application requests permissions substantially in excess of what its stated function requires, embeds six third-party trackers including two advertising SDKs with no disclosed purpose, and transfers data to servers in the United States and Singapore without adequate disclosure.
| APP | Principle | Status |
|---|---|---|
| APP 1 | Open & transparent management | FAIL |
| APP 3 | Collection of solicited personal information | FAIL |
| APP 5 | Notification of collection | FAIL |
| APP 6 | Use or disclosure of personal information | FAIL |
| APP 8 | Cross-border disclosure | FAIL |
| APP 11 | Security of personal information | PARTIAL |
| APP 12 | Access to personal information | FAIL |
| APP 4 | Dealing with unsolicited information | PASS |
Following receipt of this report the client suspended organisational use of ConnectField Pro pending vendor response, notified their Board of the material privacy risk, and engaged legal counsel to assess OAIC notification obligations. A replacement application with a compliant privacy posture was identified and approved within 30 days. The assessment directly prevented the continued processing of client personal information through a non-compliant application — and gave the Board documented evidence of due diligence.
This law firm commissioned a combined GRC, website, and mobile app assessment following a procurement request from a major ASX-listed client who required evidence of the firm’s cyber security posture as a condition of renewing their panel arrangement. The firm’s managing partners also sought an independent baseline ahead of a planned ISO 27001 certification programme. The firm’s client-facing mobile app — used for matter updates, document sharing, and secure messaging — had never been independently assessed.
The firm’s managing partners received the Board-ready executive summary within five business days of commissioning. The report was presented to the firm’s risk committee and used as the basis for an immediate remediation programme. The mobile app was withdrawn from the App Store within 48 hours of the report being received pending removal of the undisclosed SDK. The ASX-listed client accepted the BlackFlag Advisory assessment report as satisfying their procurement due diligence requirement, and the panel arrangement was renewed. The firm has since engaged BlackFlag Advisory on a quarterly monitoring retainer ahead of their ISO 27001 certification programme.
This Australian bank commissioned a combined external GRC, website, and mobile banking app assessment ahead of their scheduled APRA CPS 234 self-assessment submission. The Board sought an independent, evidence-based view of the bank’s externally visible security posture to validate their internal assessment and identify any gaps before submission. The bank’s mobile banking application had undergone internal testing but had not previously been assessed by an independent external party. The assessment was conducted entirely through passive open-source methods — no systems were accessed, no credentials provided, and no active scanning was performed.
The executive summary was delivered to the Board within five business days. The Board resolved to treat three of the five Critical findings as notifiable under APRA CPS 234 paragraph 36 and prepared the required APRA notification with the assistance of the bank’s legal counsel. The mobile banking app was immediately reviewed by the development team and the advertising SDKs were removed in the subsequent release. The BlackFlag Advisory report was incorporated into the bank’s CPS 234 self-assessment submission as the independent external evidence required under the standard. APRA accepted the submission without request for further information. The bank has engaged BlackFlag Advisory on a twice-yearly assessment cycle.
The table below shows exactly what each assessment includes so you can self-qualify before you enquire.
A standalone assessment of any mobile application your organisation uses, deploys, or is evaluating — mapped against the Australian Privacy Principles and assessed for data exposure risk.