AI-era security for Australian organisations
AI-assisted security reviews and remediation for government, critical infrastructure and business. Fixed scope and fixed price, and every finding comes with a fix.
Why now
Home Affairs says frontier AI is cutting the time between discovering a vulnerability and exploiting it from days to hours, and has warned of a “vulnerability storm”. Here is 2026 so far.
1week
for one researcher using AI to turn long-standing PHP flaws into working exploits. Researchers say the same work would otherwise take a team months.
The Hacker News4days
between Amazon’s honeypots recording a PHP2Shell exploit attempt and PHP shipping the patch.
Help Net SecurityASD warns that frontier AI models can greatly speed up and scale up vulnerability discovery and exploitation.
OpenGov AsiaHome Affairs issues PSPF Policy Advisory 001-2026, Cyber Security Readiness in the Frontier AI Era.
AI GeekAn AI agent on a routine research task reaches non-public files on a Services Australia Medicare statistics portal. The access comes to light in September.
ABC NewsPSPF Direction 002-2026 makes a legacy technology stocktake and risk management plan mandatory for non-corporate Commonwealth entities.
techpartner.newsAmazon’s honeypots record a PHP2Shell exploit attempt while the flaws are still under embargo.
Help Net SecurityWeak private keys come to light for eight trusted intermediate certificate authorities run by eMudhra. One key was the number 4.
The RegisterPHP ships emergency patches for PHP2Shell, two unauthenticated remote code execution flaws in PHP itself.
The Hacker NewsASD links outages at cyber.gov.au and other government websites to the PHP flaws.
ABC NewsProducts
Each one runs on the same tooling, playbook and templates, and maps to the framework you report against. Each one ends with working fixes as well as a report.
See your public-facing systems the way an AI agent would, with the worst problems already fixed.
Good fit if you want evidence before committing to a larger program.
Fixed priceAsk for a quote
Find every out-of-support system, decide what to do about each one, and fix what can’t wait.
Commonwealth edition: meets PSPF Direction 002-2026, with the plan drafted for Home Affairs.
Good fit if out-of-support systems are on your risk register.
Fixed priceAsk for a quote
When the next PHP2Shell lands, know within hours which of your systems are exposed and how to fix them.
Good fit once your stocktake is done and you want to stay ahead.
Fixed monthly feeAsk for a quote
| Included | AI Attacker’s View | Legacy Risk Pack | Storm Watch |
|---|---|---|---|
| Duration | 2 weeks | 4–6 weeks | 12 months |
| AI-agent assessment of public-facing systems | Quarterly | ||
| A person verifies every finding | |||
| Executive briefing | Quarterly | ||
| Merge-ready fixes | Top 3 findings | Priority issues | Each critical disclosure |
| Legacy technology stocktake | Annual refresh | ||
| Legacy risk management plan | Annual refresh | ||
| Impact assessment for critical disclosures | Within hours |
Pricing
Every product is fixed-price, so you know the cost before we start. For Commonwealth buyers, each product’s total contract value is scoped to stay under the $125,000 (GST inclusive) procurement threshold, where there’s no open tender requirement and the rules ask agencies to prioritise Australian businesses. Clayton Utz on the CPR changes
Obligations
Choose your sector to see the obligations that apply and where each product fits.
It applies to every non-corporate Commonwealth entity. Home Affairs says legacy systems with unpatched vulnerabilities now pose an “unacceptable risk to Australian Government operations”.
31 Dec 2026
SoGS
Entities running Systems of Government Significance
Stocktake of those systems complete and SoGS Risk Reduction Measures applied.
45 working days in Canberra
Issued 29 Sep 202626% elapsed
31 Mar 2027
All entities
Every non-corporate Commonwealth entity
Full legacy technology stocktake and a Legacy Technology Risk Management Plan, reported to Home Affairs.
104 working days in Canberra
Issued 29 Sep 202613% elapsed
Working days count Canberra weekdays, minus ACT public holidays, the usual APS close-down between Christmas and New Year, and Easter 2027, which falls in the last week before the March deadline.
| The Direction asks for | We deliver |
|---|---|
| A stocktake of every legacy system, public-facing first | An AI-accelerated stocktake across code repositories, asset registers, cloud accounts and dependencies, ranked by exposure |
| A reduction target that matches your risk tolerance | Target options with the effort and risk of each, for your executive to choose |
| Prioritisation strategies to meet the target | A ranked sequence of systems to retire or upgrade |
| Mitigations for systems that stay in use | Compensating controls, with the top fixes built and ready to merge |
| Procedures to rationalise the wider estate | Procedures written to fit your existing change and architecture processes |
| A plan that sits inside your cyber security strategy | A Legacy Technology Risk Management Plan drafted against your current strategy, ready to send |
| Rapid patching when a vendor rates a flaw critical | Storm Watch, which keeps this running after the deadline |
Each state and territory sets its own cyber security policy, and many use the Essential Eight as their baseline. NSW agencies work to the NSW Cyber Security Policy, and Victorian agencies to the Victorian Protective Data Security Standards. Councils often run large public-facing estates with small IT teams, which is where fixed-scope work helps most.
| What you need to show | Where we fit |
|---|---|
| Maturity against your state policy and the Essential Eight | AI Attacker’s View gives you tested evidence to report against |
| Fewer legacy and out-of-support systems | Legacy Risk Pack: stocktake, plan and priority fixes |
| Fast patching of critical flaws on internet-facing systems | Storm Watch: impact assessment within hours of a critical disclosure |
Responsible entities under the Security of Critical Infrastructure Act 2018 must keep a Critical Infrastructure Risk Management Program, meet a recognised cyber security framework, and give the Cyber and Infrastructure Security Centre a board-approved annual report.
340days
until the next CIRMP annual report is due on 28 Sep 2027, 90 days after the financial year ends.
King & Wood Mallesons12hours
to report a cyber security incident that has a significant impact on your asset. Incidents with a relevant impact allow 72 hours.
Clayton Utz| What you need to show | Where we fit |
|---|---|
| The cyber hazards that could affect your assets | AI Attacker’s View: what an AI agent can reach on your internet-facing systems |
| Mitigations, including for out-of-support technology | Legacy Risk Pack: stocktake, plan and priority fixes |
| Current framework maturity for the annual report | Storm Watch: quarterly re-scans and a yearly refresh to report against |
Most businesses answer to customers, boards and insurers more than to a single regulator, and the Essential Eight is the usual baseline. A few obligations apply widely.
$3mturnover
and above: report any ransomware payment to ASD within 72 hours under the Cyber Security Act 2024.
Clyde & Co72hours
for APRA-regulated entities to notify APRA of a material information security incident under CPS 234.
MinterEllison| What you need | Where we fit |
|---|---|
| Evidence for your board, customers and insurer | AI Attacker’s View: tested findings and an executive briefing |
| A plan for out-of-support systems | Legacy Risk Pack: stocktake, plan and priority fixes |
| A way to keep pace with critical disclosures | Storm Watch: impact assessment within hours |
Readiness check
Answer for your organisation to see where the gaps are and which product fits. Nothing you enter leaves this page.
How we work
Written rules of engagement before anything runs: what’s in scope, when we test and who to call. We start in non-production wherever it exists.
AI agents and AI-assisted code review work through your systems far faster than manual testing. A person verifies every finding before it reaches you.
We write fixes as merge-ready changes, or document a mitigation where a fix has to wait. Your team reviews and deploys.
You get an evidence pack and an executive briefing, plus the artefacts your framework or regulator asks for.
We run analysis inside your environment or on tools you’ve already approved. Nothing leaves without your sign-off.
We map findings and plans to the framework you report against, whether that’s the Essential Eight, the ISM and PSPF, your SOCI program or ISO/IEC 27001.
An Australian-owned SME with cleared personnel and hands-on experience building and running Commonwealth platforms.
Contact
Build a short enquiry here and email it to us. We’ll reply with a fixed-scope proposal.
Your enquiry
Subject: Enquiry from [Organisation]: Legacy Risk Pack Hi thinkStack, We’re interested in: Legacy Risk Pack. We’d like to start as soon as possible. Could you send us a fixed-scope proposal? Thanks, [Your role] [Organisation]
Email it to [enquiries email]placeholder