Do you only work with organisations in Sydney and Melbourne?

No. Delivery is mostly remote, so location makes little practical difference. We work with clients across every Australian state and in New Zealand, including regional centres such as Cairns and Mareeba in Far North Queensland. On site days are available where the work genuinely needs them, such as physical security reviews and audit week.

Do you resell security software or take commissions from vendors?

No. We hold no reseller agreements and take no vendor margin. When a tool is the right answer we will tell you the category and help you run the evaluation, but we are not paid on what you choose. This is also why our recommendations tend to be shorter than a reseller's.

Can you work alongside our existing IT provider?

Yes, and it is the normal arrangement. Your IT provider runs the environment. We define what good looks like, verify it, and produce the evidence an auditor needs. We brief them directly rather than sending instructions through you.

What size organisation do you usually work with?

Most of our clients sit between 20 and 300 staff. Below about 20 people, certification is often premature and we will say so. Above about 300, you generally need in house security capability and our role becomes advisory rather than delivery.

Do you provide cyber security consulting in New Zealand?

Yes. New Zealand organisations pursuing ISO 27001 follow the same standard and the same certification process as Australian ones. The differences are in privacy law and in which certification bodies are convenient, and we work through both at scoping.

What happens after we are certified?

ISO 27001 certification runs on a three year cycle. There is a surveillance audit in each of the two intervening years and a full recertification in year three. Someone has to run internal audits, management reviews and risk reviews in between. Organisations that leave this to nobody are the ones that fail surveillance. Either your own team owns it, or a retained vCISO does.

Is a gap analysis the same thing as a penetration test?

No, and they are not substitutes. A penetration test tells you whether a specific system can be broken into on a specific day. A gap analysis tells you whether your organisation has the controls, ownership and evidence a standard requires. Auditors ask for the second. Customers often ask for both.

Cyber Security Consulting Australia | ISO 27001 Consultancy

Last updated: 7 September 2026

We are a compliance consultancy, not a software reseller. We do not sell you licences, we do not take vendor commissions, and we do not run your firewall. We tell you where you actually stand, we help you fix it, and we get you through the audit.

What does a cyber security consulting firm actually do?

A cyber security consulting firm does four things, in this order: it tells you where you stand, it helps you decide what to fix first, it builds the evidence an auditor will accept, and it keeps the system running after the certificate arrives.

It tells you where you stand. Not a vulnerability scan report. A written statement of which controls you have, which you do not, and which of the gaps will actually stop a deal or fail an audit.

It helps you decide what to fix first. Most organisations we meet have a list of forty problems and the budget for six. The value of cybersecurity consulting services is largely in the ordering.

It builds the evidence. Policies, risk registers, a Statement of Applicability, control owners, meeting minutes. Auditors do not certify intentions. They certify records.

It keeps the thing alive after the certificate arrives. ISO 27001 runs on a three year cycle with surveillance audits in between. A management system that stops being maintained in month four fails its first surveillance visit.

If a cyber security services company only offers you the first of those four, you are buying a report, not an outcome.

Our cyber security services

Five services. Each one has a page with the scope, the deliverables and the process written out.

Governance & Compliance

The full build. Scope definition, risk assessment, policy set, control implementation, staff awareness and pre audit checks, taken through to certification.

security, AI and privacy governance and compliance

Cybersecurity Gap Analysis

A structured read of your current state against a chosen standard, delivered as a prioritised remediation plan rather than a findings dump. The right first step if you do not yet know how far away you are.

cybersecurity gap analysis

Internal Audit

ISO 27001 clause 9.2 requires an internal audit before your certification body will pass you, and every year afterwards. We run it independently, which is exactly what the clause is asking for. This is also what most people mean when they search for cyber security audit services.

ISO 27001 internal audit

Virtual CISO

Ongoing security leadership at a fraction of a full time hire, for organisations that need someone accountable rather than a project.

Virtual CISO support

ISO 27001 consulting is the fifth: implementation led by a certified Lead Implementer, for organisations that have already decided ISO 27001 is the standard they need and want someone to run it. Alongside those, seven free interactive tools are available with no sign up, including a free cybersecurity gap assessment that takes a few minutes and tells you which of the five services above is the one you actually need.

Which service should you start with?

Where you are right now	Start with	What you walk away with
A customer or insurer has asked a question you cannot answer	Cybersecurity gap analysis	A written current state and a ranked fix list
You have decided on ISO 27001 and want it run properly	ISO 27001 consulting	A working ISMS and a certification date
You have policies but nothing is being followed	Governance and compliance	Implemented controls with named owners
Your certification body has asked for an internal audit	Internal audit	A clause 9.2 compliant audit and report
You are certified and nobody owns it	Virtual CISO	Ongoing accountability and audit readiness
You genuinely do not know	Free gap assessment tool	A short read on which of the above applies

The most important thing is not to start with policy documents. Organisations that buy a policy pack before they have scoped anything end up rewriting all of it.

How does a cyber security consulting engagement run, step by step?

It runs in four steps: scope, assess, build and implement, then audit and hand over. Most engagements of this shape take a few months rather than a few weeks.

Step 1. Scope. We agree what is in and what is out. For ISO 27001 this is clause 4.3 and it is the single decision that most affects cost. A narrow, defensible scope certifies faster than a broad vague one.

Step 2. Assess. Current controls against the chosen standard. Findings are ranked by what blocks certification, what carries real risk, and what is merely tidy.

Step 3. Build and implement. Risk treatment, policies that match how you actually work, control implementation, evidence collection, staff awareness.

Step 4. Audit and hand over. Internal audit, management review, then Stage 1 and Stage 2 with your certification body. After that, either you run it or we do.

Typical elapsed time from kick off to certification is 10 to 12 weeks for an organisation of about 50 staff. Cost depends almost entirely on scope and current maturity. We have written up what ISO 27001 certification actually costs in Australia with the real line items rather than a single headline figure.

Cyber security solutions, not licences you have to run yourself

A lot of cyber security providers describe what they sell as a cyber security solution and then hand you a console to operate. That works when you have a security team. Most organisations between 20 and 300 staff do not.

We are a cybersecurity service provider in the consulting sense of the term. The deliverable is a working management system and a passed audit, not a subscription. Where software genuinely is the right answer, we tell you what category to buy and we help you evaluate it. We do not resell it, so we have no reason to recommend the wrong one.

Cyber security solution providers who also collect margin on the tools they recommend are not necessarily wrong. They are just not independent, and an auditor will notice.

If you want something closer to cybersecurity as a service, an ongoing arrangement rather than a project, that is what the vCISO engagement is. Same people, retained rather than scoped.

Where do we work across Australia, New Zealand and the United States?

CyberNinja is registered at 333 George Street, Sydney, and works with organisations across Australia, New Zealand and the United States. Most delivery is remote, which is why cyber security consulting Australia wide is practical for us in a way it is not for a firm that bills travel.

We work regularly with clients in Melbourne, Brisbane and regional Queensland including Cairns and Mareeba, as well as across New Zealand.

If you are specifically looking for a cybersecurity consultancy Sydney side, with on site workshops and in person audit support, our Sydney team page sets that out.

Frameworks and standards we cover

ISO 27001, ISO 42001, ISO 27018, SOC 2, PCI DSS, HIPAA, NIST CSF, Essential Eight and IRAP. ISO 27001 is where most of our work sits. The 2022 revision carries 93 Annex A controls across four themes: organisational, people, physical and technological. Our ISO 27001 framework guide explains the clause structure and what certification involves.

We are equally comfortable telling you that you do not need a framework yet. Smaller organisations often get further with a handful of controls done properly than with a standard adopted for appearance.

Why do organisations choose us?

Because we are certified practitioners who have sat on both sides of the audit table, we take no margin on any tool we recommend, and we quote a fixed scope for a fixed fee.

Certified practitioners. Our consultants hold ISO/IEC 27001:2022 Lead Implementer and ISO/IEC 27001:2022 Lead Auditor certifications. We have sat on both sides of the audit table, which is the only reliable way to know what an auditor will accept.

3 years working with ANZ organisations, with more than 20 ISO 27001 certifications delivered.

Outcomes we can point to. A 40 person fintech in Sydney certified to ISO 27001 in five months and unblocked two enterprise deals. A 120 person SaaS business in Melbourne passed SOC 2 Type II with zero exceptions. A 25 person allied health practice in Brisbane moved from Essential Eight maturity level 0 to level 2 in four months. An 80 person e commerce retailer in Sydney completed security reviews of every critical vendor within six months.

No resale, no commissions. We do not take margin on any tool we recommend.

Fixed scope, fixed fee. Pricing is fixed fee. We scope out everything with you, so there are no surprises.

Frequently asked questions

Ready to talk?

Book a free consultation through our contact page, or run the free gap assessment first and bring the result with you. Either way the first conversation costs nothing and we will tell you if you do not need us yet.

Start Free Self-Assessment

Cyber Security Consulting for Australian, New Zealand and US Organisations