Security that lets you leap forward.
We run cybersecurity, compliance, and risk operations for organisations operating under regulatory scrutiny. So your business moves faster than your threat model, your audit calendar, or the regulator chasing them both.
What our team is tracking right now.
What our analysts are watching across regulated Australian and APAC environments. Refreshed quarterly with the campaigns, TTPs, and high-priority CVEs that matter most to our clients.
- Scattered Spider — identity-based ransomware targeting managed service providersObserved in retail, insurance, SaaS
- APT29 / Midnight Blizzard — OAuth token theft against M365 tenantsActive in APAC government and CNI
- FIN7 — point-of-sale and e-commerce credential harvestingEscalated activity in AU retail and hospitality
- MFA fatigue & push-bombing at session establishment+34% quarter-over-quarter
- Help-desk social engineering for password resetsPrimary vector for Scattered Spider
- Living-off-the-land binaries in cloud workloadsAzure Automation, AWS SSM abuse
- CVE-2026-3401Ivanti Connect Secure — unauthenticated RCE, exploit observed in the wild
- CVE-2026-2198Citrix NetScaler — session hijacking via memory disclosure
- CVE-2026-0987VMware vCenter — authentication bypass, patch within 14 days
An operational security program, delivered as a service.
Most security firms sell point products and call it a program. We run the program for you — strategy, detection, response, compliance, and the boring parts in between. Six disciplines, one accountable team, one monthly number on your invoice.
Executive security leadership, without the $400K salary.
A Virtual CISO runs your security program end-to-end — strategy, board reporting, risk appetite, incident command, vendor oversight, and the dozen quiet decisions per week that keep a company out of a breach headline.
Board-grade reporting
Quarterly risk posture with real numbers — not RAG charts — your board will actually read.
Full framework ownership
ISO 27001, SOC 2, NIST CSF, Essential 8, APRA CPS 234, PCI DSS — mapped, managed, audit-ready.
Incident command in hours, not weeks
Named executive on your side the moment something goes wrong. No hourly billing games.
Two phone calls. Four systems compromised. Six days.
Under an unannounced engagement with a critical healthcare infrastructure operator, our offensive team ran a Scattered-Spider-style vishing simulation against the IT Service Desk and a frontline customer-facing function. Inside one working day, two pretexts landed access to the patient imaging portal, Microsoft 365, and the remote desktop environment, with MFA registered to our device.
Read the full case studyEvery framework your regulators and auditors expect.
Australian and APAC frameworks first — implemented, operated, and audit-ready. We hold the accreditations that let us assess against them, not just talk about them.
ISM & PSPF
Information Security Manual and Protective Security Policy Framework alignment
SOCI Act
Critical infrastructure obligations, RMP attestation, and CIRMP support
APRA CPS 230
Operational risk management and third-party service-provider controls
Privacy Act & APPs
Australian Privacy Principles, NDB scheme, and OAIC readiness
ISO/IEC 42001
AI management systems for organisations deploying or building AI
Securing the sectors that can't afford a headline.
Four sectors, one focus — organisations where security is driven by regulatory pressure, audit scrutiny, and operational risk. Built for the regulated and high-accountability environments that define the Australian mid-market.
Why high-growth teams pick us.
We're not the cheapest option in the market and we're not trying to be. We're the firm you bring in when the next audit, regulator, or incident can't go badly — and you need people who will treat your program like it's their own.
Built for scale-up complexity
Purpose-built for companies growing across regions, product lines, and regulatory regimes simultaneously. Senior-level expertise, no enterprise bloat.
One accountable team, end to end
vCISO, GRC, SIEM, pen testing, IT — all under one roof. One vendor, one contract, one team that knows your environment as well as you do.
Audit outcomes, not audit advice
We don't hand you a report and leave. We build the ISMS, write the policies, run the risk register, and walk beside you through every audit. 98% first-time pass rate.
Global coverage, local fluency
Multi-region delivery across AU, EU, UK, and US — with analysts who speak to your regulators in the language they expect: theirs.
CypherLeap has been a highly professional and reliable cybersecurity partner. Their team combines strong technical expertise with practical, business-focused advice and has consistently delivered high-quality outcomes across multiple security initiatives. We value their collaborative approach, responsiveness, and commitment to helping strengthen our security posture.
Ready to leap ahead on cybersecurity?
A 30-minute discovery call, a clear picture of your risk posture, and a specific path to get where you need to be. No sales theatre.