Software engineering and cybersecurity services.
Black Shard works across software delivery and security. Some engagements start with a build. Others start with a penetration test, security assessment, compliance requirement or incident.
Where those areas overlap, the same team can carry the work through rather than handing it between separate vendors.
Cybersecurity
Penetration testing & red teaming
Penetration testing, red teaming and social-engineering assessments.
- Penetration testing
- Red teaming
- Phishing & social-engineering simulation
Explore offensive testing
Security advisory & vCISO
vCISO, security posture assessments, Microsoft Azure and Entra ID reviews, incident readiness and ongoing monitoring.
- Security posture assessment
- vCISO: fractional security leadership
- Azure cloud security review
- Entra ID & Microsoft 365 identity security
- Managed exposure monitoring
- Detection & response advisory
Explore defensive & advisory
Breach remediation & incident response
Technical investigation, containment, root-cause analysis and remediation.
- Incident containment & triage
- Root-cause analysis & remediation engineering
- Notifiable Data Breaches support
- Incident readiness
Explore breach remediation
Compliance & certification readiness
Essential Eight, SMB1001, ISO 27001 and Privacy Act uplift.
- Essential Eight uplift
- SMB1001 certification readiness
- ISO 27001 readiness
- Privacy Act / APP uplift
Explore compliance readiness
Secure development & code review
Secure code review, threat modelling and architecture review.
- Secure code review
- Security architecture & threat modelling
Explore secure development
AI cyber defence
AI penetration testing, Copilot security reviews, ISO 42001 readiness and defence against AI-enabled fraud.
- AI security assessment
- AI penetration testing
- Microsoft Copilot security review
- AI governance & ISO 42001 readiness
- Defence against AI-enabled attacks
- Secure AI engineering
Explore AI cyber defence
Before, between, and after an incident.
Before
Testing, review and compliance work ahead of an incident.
Between
Ongoing security leadership and external exposure monitoring.
After
Containment, remediation and verification of the affected surface.
Work outside these families.
These are the engagements we run most often. The systems we operate also required brand identities, editorial sites, deal-flow tooling, speech and OCR pipelines, outreach engines and compliance portals, so those were built as part of the same work. If it involves building, running or securing technology, ask.
One of those builds carries its own page. Xero integration services covers custom apps on the Accounting API, bank-feed and transaction sync, and the bank leg of a trust reconciliation for practices that report against a regulated ledger.
Open a briefSectors we operate in.
Most of these sectors run on systems we built and operate today.
Engagements sized to where you are.
From a one-off test to a standing engineering team. Scope, timeframe and price are agreed before work starts.
Fixed-scope engagement
Startups & SMB
A penetration test, review, or build with a clear target, timeframe, and deliverable.
Ongoing advisory / vCISO
Mid-market & enterprise
A standing security seat: strategy, review, and board-ready reporting on a regular cadence.
Compliance program
Regulated businesses
A milestone-driven program toward Essential Eight, SMB1001, ISO 27001, or Privacy Act readiness.
Embedded engineering
Product owners
A standing build team that designs, ships, and operates software under an ongoing engagement.
SMB1001:2026 Gold (Level 3), issued by CyberCert. Self-assessed against the ASD Essential Eight, the ASD ISM and CIS Controls v8.
Tell us what you need built, reviewed or secured.
A platform build, a penetration test, a posture assessment, a compliance program or an incident that needs remediating.