Security leadership without building an internal security function.

Ongoing security leadership for organisations that need somebody to own cyber risk but do not require a full-time CISO.

A vCISO engagement can cover security strategy, risk management, policies, board reporting, incident preparation and oversight of technical remediation. We also conduct standalone security posture assessments, Azure reviews, Entra ID reviews and incident-readiness exercises. The purpose is straightforward: establish where the organisation stands, decide what deserves attention first and maintain a security program that keeps moving.

Security posture assessment

A structured gap analysis against the Essential Eight and CIS Controls.

What you get

Current position mapped to recognised controls
Exposures identified and ordered by priority
A remediation roadmap with effort estimates

vCISO: fractional security leadership

Security strategy, policy, board reporting and incident readiness on a defined cadence.

What you get

A security lead on a regular cadence
Security strategy, policies and a risk register kept current
Board reporting in business risk terms

Azure cloud security review

A review of identity, network, secrets and logging configuration across your Azure tenant.

What you get

Identity, network, secrets and logging review of the tenant
Misconfiguration and over-privilege findings
A remediation plan tied to Azure-native controls

Entra ID & Microsoft 365 identity security

Review and hardening of the Entra ID and Microsoft 365 tenant your business signs in to.

What you get

Conditional access and MFA coverage review, including break-glass accounts
Privileged-role and app-consent audit across the tenant
Offboarding and recovery review, so a lost admin account cannot lock the business out

Managed exposure monitoring

Scheduled external scans of your internet-facing systems using Assay, our scanning platform, with each result reviewed by an engineer before it is reported.

What you get

Assay scans of your external footprint on a standing schedule, each run diffed against the last
A written monthly position: what changed, what matters and what to fix first
Evidence suitable for an insurer or customer, and remediation by us where required

Detection & response advisory

A review of whether an attack would be detected, and what the response would be.

What you get

A review of logging and alerting coverage
An incident response playbook written for your team
A tabletop exercise to test it

How it is shaped

An ongoing monthly retainer, or a one-off assessment to start.

Questions, answered

Who does the advisory work?: Engineers who design, build, and run production software. Black Shard builds and secures software: Aurii, plus the compliance and operations portal GRM LAW runs on and the staff portal Stone Leaf Capital operates from. The person reviewing your Azure tenant secures the same platform daily, and the person writing your incident response playbook is one of the engineers who would triage an incident in our own systems. The advice comes from people who carry production responsibility.
How do you handle our data and access during an engagement?: Least privilege, from day one. We ask for the minimum access the work requires and nothing more. The practices we hold ourselves to apply to client material as much as our own: encryption in transit and at rest, a deliberately small set of third parties, Australian regions for the services that host client data, and a defined incident handling path that meets the Privacy Act's notification obligations. An Azure cloud security review reads your identity, network, secrets, and logging configuration; the same least-privilege rule sets the access we ask for to run it.
What do we get at the end?: A written document you can act on. A posture assessment comes back with where you stand mapped to the Essential Eight and CIS Controls, what is exposed, what to fix first, and a prioritised roadmap costed by effort. An Azure review lands the same way, with misconfiguration and over-privilege findings tied to the Azure-native controls that close them. An engineer confirms every finding before it reaches the page; raw tool output is not forwarded. It is written so your board can act on it, not just your engineers.
Do you verify that fixes landed?: On advisory work, verification is built into the cadence rather than bolted onto the end. Under a vCISO retainer a named security lead keeps strategy, policies, and the risk register current, and reports progress to the board. Where an engagement includes fixed-scope offensive testing, a re-test of the fixed findings is included, so closure is demonstrated rather than assumed. A one-off assessment gives you the roadmap; an ongoing retainer is how it keeps getting worked.
How is a posture assessment different from a penetration test?: A posture assessment is a structured gap analysis: your controls measured against the Essential Eight and CIS Controls, with a prioritised roadmap out the other side. A penetration test is an attack: we probe applications, networks, and people and prove what is exploitable. They answer different questions. The assessment tells you where your security program is weak; the test tells you what an attacker can do today. The natural sequence is to start with the assessment to set direction, then commission testing on the surfaces the roadmap flags. Black Shard runs both.
Do you work with organisations outside Brisbane?: Yes. Black Shard is a national firm with its head office in Brisbane, and delivers Australia-wide. Advisory work suits remote delivery: a posture assessment, an Azure tenant review, board reporting, and a tabletop exercise all run without anyone on a plane. Client data stays in Australian regions on the services that host it, and the Privacy Act obligations that govern it are the same ones we design to ourselves. The engineers reviewing your environment are the engineers running ours.
How much does a security assessment or vCISO retainer cost?: We do not publish prices, because cost is driven by scope. What we can tell you is the shape of the engagement: a posture assessment runs as a one-off, advisory continues as an ongoing monthly retainer, and offensive testing is a fixed-scope engagement with a defined target and timeframe, plus a re-test. Compliance work runs as a defined program with milestones toward your certification or audit date. If you want a figure, send the brief.
What happens after the report is delivered?: The roadmap becomes the plan. You can take the report and run remediation in-house; the findings come with fixes, so that is a legitimate path. Or move to an ongoing retainer, where a named security lead on a regular cadence keeps strategy, policies, and the risk register current, with reporting your board can act on. Detection and response advisory closes the loop the same way: the incident response playbook we write is pressure-tested in a tabletop exercise with your team.

The rest of the firm.

Tell us where your security program stands.

Brisbane head office. Work delivered across Australia.

Open a briefinfo@blackshard.com.au