Sector-specific advisory for
complex environments

APRA-regulated entities operate under the most prescriptive cyber security obligations in the Australian economy. CPS 234 requires maintained information security capabilities, documented testing programmes and prompt notification of material incidents — and APRA's supervisory intensity has increased significantly since 2020.

Beyond regulatory compliance, financial services organisations face sophisticated, well-resourced threat actors motivated by financial gain and data theft. The combination of regulatory pressure and threat actor attention makes this sector one where security programme quality has direct material consequence.

Book a Financial Services Briefing →

Government entities operate under the most structured security framework in Australia — the Information Security Manual and the ASD Essential Eight maturity model. For systems handling classified data, IRAP assessment by an authorised assessor is mandatory. Our government practice includes cleared, IRAP-certified advisors who understand the specific requirements of Commonwealth and state agency environments.

The SOCI Act has expanded the definition of critical infrastructure to include many government-adjacent entities — data storage, financial market infrastructure and communications systems. Understanding where SOCI obligations apply, and what they require, has become an essential part of government security programme design.

Book a Government Briefing →

Healthcare organisations hold the most sensitive personal information in the Australian economy — and face a threat landscape that has intensified dramatically since 2022. The Medibank and Optus breaches demonstrated that health data is a high-value target, and that the consequences of a breach extend far beyond the organisation itself into the lives of the people whose data is held.

The operational dependency of healthcare on connected systems — patient records, medical devices, clinical decision support — means that a security incident does not just create data risk. It creates patient safety risk. This changes the calculus of security investment in ways most healthcare boards are still catching up with.

Book a Healthcare Briefing →

The Security of Critical Infrastructure Act has expanded significantly since 2022 — the definition of critical infrastructure now covers 11 sectors including data storage, financial market infrastructure and defence industry. Operators of critical infrastructure assets are subject to mandatory risk management programme obligations, incident notification requirements and — in the most serious cases — government step-in powers.

Critical infrastructure operators also face the most sophisticated threat actors in the Australian threat landscape — state-sponsored adversaries with specific targeting interest in energy, water and transport systems. The convergence of OT and IT environments has created new attack surfaces that traditional IT security frameworks were not designed to address.

Book a Critical Infrastructure Briefing →

Professional services firms hold extraordinarily sensitive client data — legal privilege, transaction documents, strategic plans, financial records and personal information — often for clients who are themselves subject to APRA, ASX or government security requirements. Enterprise clients are increasingly conducting security due diligence on their professional service providers as a condition of engagement.

The threat to professional services is not just data theft. Business email compromise, invoice fraud and ransomware targeting billing systems are all prevalent in this sector — and the reputational consequence of a breach in a firm built on client trust is qualitatively different from almost any other sector.

Book a Professional Services Briefing →

Technology companies face a dual security challenge. They must manage their own security obligations — protecting their infrastructure, their customer data and their IP — while simultaneously demonstrating to enterprise customers that their security posture meets the standards those customers require as a condition of procurement.

SOC 2 Type II and ISO 27001 have become de facto requirements for enterprise SaaS procurement. The organisations that invest in achieving these attestations early create a genuine competitive advantage — while those that defer find themselves excluded from enterprise deals or facing costly emergency certification programmes when a major customer demands it.

Book a Technology Sector Briefing →