A cyber security company in Brisbane.

Offensive testing, security advisory, compliance readiness, incident response and secure software builds, delivered from our Brisbane head office and Australia-wide.

Black Shard is an Australian software engineering and cybersecurity firm with its head office on Eagle Street in Brisbane. The security practices cover offensive testing, defensive advisory, breach remediation, compliance readiness and secure software builds. The firm also designs, builds and operates production software for clients.

Engagements usually start with one practice: a penetration test, a posture assessment, a compliance gap review. Where a finding requires engineering, Black Shard can build the fix.

Practices

Offensive testing establishes what is exploitable. Defensive advisory maintains the risk register and board reporting between tests. Breach remediation contains an incident and fixes what allowed it. Compliance readiness prepares evidence for the frameworks customers and insurers ask about. Secure builds apply the same review to new systems before they ship, and the engineering practice underneath builds the fix where one is needed.

Offensive testing: penetration testing, red teaming, phishing simulation
Defensive advisory: vCISO services, posture assessments, Azure and Entra ID security reviews, attack surface monitoring
Breach remediation: incident response, root-cause remediation, Notifiable Data Breaches support
Compliance readiness: Essential Eight uplift, SMB1001 certification readiness, ISO 27001 groundwork, Privacy Act uplift
Secure builds: secure code review, threat modelling, security architecture
Software engineering: custom builds and the production systems the firm operates

Offensive testing and defensive advisory

The offensive practice delivers penetration testing in Brisbane and Australia-wide, run against OWASP and ASD guidance. Red teaming runs against a defined objective. Phishing simulation measures how staff respond to a controlled campaign. Findings are reproduced before they are reported, each carries remediation detail, and a re-test is included on fixed-scope offensive work.

Defensive advisory covers a vCISO on a regular cadence who owns the risk register and briefs the board, posture assessment against the Essential Eight and CIS Controls, Azure and Entra ID security review of the tenancy, and attack surface monitoring of what changes between tests.

Compliance readiness and breach remediation

Compliance readiness covers Essential Eight uplift, SMB1001 certification readiness, ISO 27001 groundwork and Privacy Act uplift. Black Shard prepares the evidence and closes the gaps; the certification or audit itself sits with the accredited body.

Breach remediation covers containment and triage, root-cause analysis of the code, configuration or infrastructure behind the incident, remediation, a re-test of the remediated surface, and support with the Notifiable Data Breaches assessment under the Privacy Act.

Systems we build and operate

Black Shard designs, builds and operates production software in regulated industries. GRM LAW, a Brisbane law firm, runs on an operations and compliance portal in which every state change is written to an append-only audit ledger. Stone Leaf Capital operates a staff portal Black Shard built, with a sealed compliance audit log structured around the firm's AFSL perimeter. Aurii, clinical software Black Shard built and operates, isolates tenant data with PostgreSQL row-level security on Azure in Australia. Black Shard is also a Xero developer partner, listed on the Xero App Store.

Black Shard holds SMB1001:2026 Gold, independently issued and verifiable on the public CyberCert registry. OWASP, the ASD Essential Eight and the frameworks above are methodologies we test and build against.

Delivery in Brisbane

Black Shard's head office is on Eagle Street in Brisbane, and every practice is delivered Australia-wide from it. For Brisbane organisations, scoping, internal network testing, board briefings and debriefs can run in person. Elsewhere the same engagements run remotely, with the same reports and the same re-tests.

What does cyber security cost?

There is no rate card, because the practices cover different shapes of work: a fixed-scope penetration test, a standing vCISO retainer, a milestone-driven compliance programme, an incident that cannot be sized until it is triaged. Cost is driven by the practice, the attack surface or system count in scope, the framework involved, and whether on-site work in Brisbane is included.

Send a brief to info@blackshard.com.au with whichever of those you know, and scoping starts from there.

Questions, answered

How do we choose a cyber security company?: Ask what the deliverable is, whether findings are reproduced before they are reported, whether a fix and a re-test are included, whether the firm operates production systems of its own, and whether the certifications claimed are held by the legal entity and verifiable.
What does a cyber security engagement cost?: There is no published figure. Cost follows scope, driven by the practice, the attack surface or system count, the framework involved, and whether on-site delivery in Brisbane is included. Send a brief to info@blackshard.com.au and scoping starts from the detail you have.
What does an engagement look like, day to day?: Scoping first, so both sides agree what is in and out before anything is touched; then the work, whether a test, a review or a build; then a report or briefing with remediation detail for each finding; and, where it applies, a re-test. Standing engagements such as a vCISO retainer run on an agreed cadence.
Do you only work with Brisbane businesses?: No. Black Shard is an Australian firm headquartered in Brisbane, and every practice is delivered Australia-wide. Brisbane organisations have the option of in-person scoping, on-site testing and an in-person debrief.
If a security review finds a problem, do you also fix it?: Yes, where that is what you want. Black Shard designs, builds and operates production software, and can engineer the fix for a finding it reported.

Tell us what you need built, reviewed or secured.

Brisbane head office. Work delivered across Australia.

Open a briefinfo@blackshard.com.au