See your organisation the way an attacker already does.
Evidence-based cyber security assessments. No systems accessed, no active scanning. A rated risk register, framework mapping and Board-level report — delivered within days.
A quick, passive look at what your organisation shows the public internet. Nothing on your side is touched.
Get your detailed gap report — every finding rated and mapped to the frameworks that apply to you. Confidential, no obligation.
We’ll be in touch within 24 hours with your detailed gap report for {{ scanned }}.
From exposure to action, in three steps.
Seeing what is exposed means nothing without a framework to assess, report and act on it. We do both — most firms do only one.
Observe
We map what a threat actor, regulator or competitor already sees — using public data only.
Map
Every finding is rated, owned and mapped to the obligations that apply to you.
Report
A living risk register and a plain-language Board briefing your directors can act on.
What a threat actor already knows about your organisation
Credential and secret exposure, supply-chain footprint, forgotten assets, exposed management interfaces, email spoofing posture, TLS hygiene and known CVEs.
Passive OSINT assessment →GRC is not a document. It is a cyber posture.
Regulatory change, AI governance, Board oversight, operational resilience (CPS 230), identity and access governance, incident readiness and independent assurance.
GRC advisory →Seven assessments. One methodology.
What changes is the obligation your findings are mapped to, and who the report is written for.
Average cost of a data breach in Australia — a record high.
Breaches reported to the OAIC in 2024 — the highest annual total on record.
Maximum penalty per serious Privacy Act breach under the 2024 amendments.
Latest analysis
ASD ISM, June 2026. Every control, compared.
The Govern function doubled, twenty-nine controls were added, one was removed — and not one of June’s twenty new controls maps to the Essential Eight.
Read the comparisonReady to see what we find?
Submit your domain and contact details and we’ll discuss scope, approach and next steps. Sample assessments available on request.
We’ll be in touch within 24 hours.
Discretion isn’t a marketing position. It’s how we operate.
Confidential by design
No client names, no logos. Every engagement gets the confidentiality we assess others against.
Across every sector
Healthcare, finance, government and retail. The exposure patterns repeat; only the obligations differ.
White-label ready
Findings delivered under your brand through law-firm and insurance partnerships. Partnerships →
One methodology. Eight obligations.
Every engagement uses the same passive methodology. What changes is the framework the findings map to, and the audience the report is written for.
Which obligation do you carry?
{{ rec.why }}
All assessments
What does not change
GRC is not a document. It is a cyber posture.
Most Australian organisations have a GRC framework on paper. Very few have one that functions under scrutiny — from regulators, insurers, or a breach investigation.
Three functions, managed together — but genuinely distinct.
Governance
Who decides risk appetite, who owns security outcomes, and how the Board knows it is working.
Risk management
Identify, assess, treat, monitor — with explicit decisions recorded against each risk.
Compliance
Meeting the Privacy Act, CPS 234, ISO 27001, SOC 2 and NIST — with evidence, not assertion.
Frameworks we map to
One report covering every framework you are obligated or expected to meet.
What your Board receives
A structured document your Directors can read, act on, and present to insurers, regulators or clients. Delivered within five business days.
Request an assessment →Intelligence
{{ feat.excerpt }}
Read analysis →Add cyber GRC to your practice — without hiring for it.
We partner with law firms, insurers, accounting practices and advisory firms who need specialist cyber GRC capability, delivered under a model that works for your business.
Start a partnership conversation →Three ways to work together
Referral
You introduce the client. We scope, deliver and report — treating your name as if it is on the cover.
Shared engagement
We deliver the cyber evidence; you deliver the legal, financial or insurance advice built on it.
White-label
Findings delivered under your brand. Your advisory, our engine.
Who we partner with
Law firms
Privacy, breach response and Tranche 2 matters that need independent technical evidence.
Law firm partnerships →Insurers & brokers
External security reviews for underwriting, renewal and portfolio risk.
Insurer partnerships →Accountants & advisory
Cyber GRC for clients facing new regulatory and Board-level obligations.
Advisory partnerships →Start a partnership conversation.
Tell us about your firm and what you’re looking for. No commitment — a conversation between professionals.
See what we find. Then decide.
Fixed scope, fixed price, quoted before we start. No hourly rates and no variation without your agreement. Every package comes with a sample extract so you know what you receive.
{{ k.name }}
{{ k.best }}
Privacy Readiness Assessment
Our GRC Assessment, extended with an automated decision-making readiness check — so you know where your privacy policy stands before the new APP 1 obligations apply.
See what you receive before you commit.
Extracts from real assessments, anonymised. Pick one to see the structure, findings and Board-ready format.
{{ w }}
{{ smp.cta }}
Compare packages
| Included | Surface | GRC | Website + App | Group |
|---|---|---|---|---|
| External attack surface & email security | ✓ | ✓ | ✓ | ✓ |
| Credential breach exposure | ✓ | ✓ | ✓ | ✓ |
| Privacy Act compliance review | — | ✓ | ✓ | ✓ |
| Structured risk register | — | ✓ | ✓ | ✓ |
| Board-level executive summary | — | ✓ | ✓ | ✓ |
| ISO 27001 & framework mapping | — | ✓ | ✓ | ✓ |
| Mobile app assessment | — | — | ✓ | — |
| Multi-entity coverage | — | — | — | ✓ |
| Delivery | 3 days | 5 days | 7 days | 7–10 days |
Common questions
What is not covered by the published price?+
Additional domains are $350 ex GST each and additional mobile apps $950 ex GST each. Group and supply-chain engagements are quoted after a short scoping call.
Do you access our systems or network?+
No — never. Every assessment uses passive OSINT and publicly available data only. This is not a penetration test.
Is this suitable for cyber insurance requirements?+
Yes. Many insurers now require evidence of an external security review. The risk register and framework mapping are designed to satisfy it.
How do I pay?+
We invoice once scope is confirmed; payment is by bank transfer. Nothing is payable upfront.
Fifteen minutes to scope it properly.
A short, confidential call to establish what is in scope, which obligations apply, and what the engagement would cost. No obligation.
{{ bookDone }} We’ll confirm your Microsoft Teams session within 24 hours.
{{ doc.h1 }} {{ doc.h1Accent }}
{{ doc.standfirst }}
{{ doc.sub }}
Get your detailed gap report — every finding rated and mapped to the frameworks that apply to you. Confidential, no obligation.
We’ll be in touch within 24 hours with your detailed gap report for {{ scanned }}.
Start a partnership conversation.
Tell us about your firm and what you’re looking for. No commitment — a conversation between professionals.
{{ doc.ctaH }}
{{ doc.ctaP }}
A real assessment extract. Read it before you commit.
An extract from an actual BlackFlag Advisory mobile application assessment, anonymised. This is what arrives, in the format it arrives in.
App, developer and all identifying details are fictionalisedExecutive summary
{{ p }}
Application profile
Permissions analysis
{{ p }}
{{ pm.name }}{{ pm.label }}Tracker & SDK analysis
{{ p }}
Key findings
Australian Privacy Principles compliance
{{ p }}
| APP | Principle | Status | Finding |
|---|---|---|---|
| {{ rw.app }} | {{ rw.principle }} | {{ rw.status }} | {{ rw.finding }} |
Remediation roadmap
Ready to assess your organisation’s apps?
This is what a Passive Mobile App GRC Assessment delivers. No systems accessed. Board-ready report.
Is your GRC genuine or just a tick box?
Ten questions — the ones a regulator, an insurer or a breach investigation would actually ask. Answer honestly; nothing is sent anywhere.
{{ gq.resultBody }}
Answer at least 8 questions to see your result.
Every page
{{ sitemapLead }}