Insights.

Short technical write-ups from real work.

Software engineering13 August 2026

Case study: Xero as the bank truth behind a law firm and a fund licensee

Two production integrations on Xero's Accounting API: the three-way trust reconciliation behind GRM LAW's end-of-month compliance, and the hourly bank-feed sync that keeps Stone Leaf Capital's fund ledger current.

Reference guides

Defensive & advisory
What to fix in SharePoint before you turn on Microsoft 365 Copilot
Copilot grants nobody new access and removes the effort of finding, which turns old SharePoint permission defects into visible answers. The signals that mark a risky site, the difference between containing an exposure and fixing it, and the stopgap that can no longer be switched on after 31 July 2026.
Defensive & advisory
What Australian cyber insurers check before they quote you
A cyber proposal form asks binary questions about controls that are never binary in a real environment. This note walks the recurring questions, the evidence that answers each one, and how a declaration gets tested against system timestamps after a loss.
Software engineering
RBAC vs ABAC, and where the permission check belongs
Authorisation is one question with four parts, and the decision that shapes everything after it is whether that question gets answered in one place or re-answered in every handler. Two reference tables compare the models and the layers a check can sit in.
Compliance readiness
What a government tender means when it asks for the Essential Eight
A map from Australian government buyer to the security artefact they actually want, what each one evidences and fails to evidence, and how to answer a schedule asking for something you do not yet have.
Breach remediation
Deciding whether to rebuild or restore after ransomware
Once containment holds, the question is which parts of the environment you are willing to trust again. A decision table for clean, selective rebuild or full rebuild, the order credentials get rotated in, and what has to be true before anyone declares normal operation.
Defensive & advisory
An incident severity matrix you can actually use
Most incident plans skip the decision that shapes every other decision: how bad is this. A four-level severity matrix for Australian businesses, with first actions, internal escalation and the external notification clocks per level.
Secure development
Shipping AI-written code without shipping its mistakes
AI coding tools produce working applications in the same confident tone whether the security is right or wrong. A guide to the eight places AI-generated code typically fails, the pre-ship checks a competent developer can run, and the point where a professional review is warranted.
Offensive testing
Choosing the right security assessment: what each type actually answers
Seven assessment types compared on what they find, what they cannot, and what you receive, plus how to match them to your maturity, sequence them over a year, and read a proposal before signing.
Compliance readiness
The Australian cyber compliance map: what applies to your business
One reference table mapping the Privacy Act, the NDB scheme, the SOCI Act, CPS 234, PCI DSS and the voluntary assurance frameworks to the businesses they bind, with a workable order for tackling them.

Self-serve tools

Want this kind of engineering on your systems?

Australia-wide, from our Brisbane head office. Someone will contact you as soon as possible.

Open a brief info@blackshard.com.au