Controls that exist
in the account, not
only in the document
The gap between a documented control and a deployed one is where breaches and audit findings both live. We close it by making the control and its evidence the same artefact.
Four situations, one underlying problem
In each case the security policy is fine. The distance between the policy and the running configuration is the issue.
An audit finding with a date attached
An assessor has identified gaps against ISO 27001, the Essential Eight or CPS 234, and the remediation window is shorter than the change process usually takes.
Standing access nobody has reviewed
Twenty-plus people with administrative privileges granted over three years, no expiry, and no record of what that access is actually used for.
Alerts nobody acts on
GuardDuty and Security Hub enabled and generating findings into a channel that everyone has muted, because the signal-to-noise ratio was never tuned.
A customer security questionnaire
An enterprise deal stalled behind a 300-question assessment that needs an engineer to answer, every time, for every prospect.
What a security engagement covers
Assessment first, always. Remediating before you have measured is how organisations spend a quarter fixing their third-most-important problem.
Posture assessment
An evidence-based read of the current state against the framework that applies to you, with findings scored on risk and remediation effort rather than listed alphabetically by service.
- Automated configuration analysis across accounts
- Identity and privilege usage analysis from CloudTrail
- Findings ranked into fix-now, plan, batch and accept
Identity and access
IAM Identity Center federated to your identity provider, permission sets designed against observed usage, time-bound elevation for privileged operations and session recording where it matters.
- Standing access replaced with just-in-time elevation
- Permission sets derived from 60 days of real usage
- Workload identity without long-lived credentials
Detection engineering
Turning findings into signal: tuned detections, suppression for known-good patterns, routing to the team that can act, and response runbooks that have been rehearsed.
- GuardDuty, Security Hub and CloudTrail Lake tuning
- Detection-as-code with version-controlled rules
- Incident response runbooks and tabletop exercises
Evidence automation
Control evidence generated from AWS Config, pipeline runs and Terraform state, so the quarterly pack is a build artefact rather than a fortnight of screenshots.
- Continuous control measurement and drift alerting
- Evidence generated on demand for any period
- Security questionnaire answer library maintained
What we design against
We are not an assessor or an auditor. We build to the standard your assessor will apply, and produce the artefacts the assessment needs.
| Framework | Applies to | What we deliver |
|---|---|---|
| Essential Eight | Government, and increasingly enterprise | Control implementation mapped to maturity levels, measured continuously |
| APRA CPS 234 | APRA-regulated entities | Control-to-code mapping with generated evidence |
| APRA CPS 230 | APRA-regulated entities | Critical operation mapping, tested tolerance levels |
| ISO 27001 | Any organisation seeking certification | Technical control implementation and evidence automation |
| SOC 2 | SaaS and service providers | Trust services criteria implementation on AWS |
| ISM / IRAP-informed | Government workloads | Architecture aligned to ISM controls, structured for assessment |
Where a formal assessment is required we work alongside your chosen assessor rather than performing the assessment ourselves.
Preventative beats detective
A Service Control Policy that makes a misconfiguration impossible is worth more than an alert telling you it happened at 2am on Saturday. We push controls as far left as they will go, then detect what remains.
Read: Essential Eight in code- Guardrails that block, rather than policies that advise
- Encryption and logging enforced at the organisation level
- Immutable infrastructure, so patch currency is a build property
- Signed images with admission control at deployment
- Backups with immutability and automated restore testing
- Every exception documented, time-bound and reviewed
Measure it before you remediate it
A posture assessment takes four weeks and ends with findings ranked by risk against effort — so the remediation budget goes to the gaps that actually matter.