Last updated
ABN 18 692 781 561 · Australian owned and operated · Queensland, Australia
What can Ironbark Cyber do for a Commonwealth agency?
Offensive security testing and AI assurance mapped to the frameworks the Commonwealth actually uses. We do the hands-on technical work, finding the attack paths, proving the impact, and giving your team an auditor-ready path to close them.
- Essential Eight uplift and validation. Testing against the Essential Eight maturity model, and against the broader ASD "Essentials" series as it emerges.
- ISM and PSPF-aligned penetration testing. Testing scoped and reported against the Information Security Manual and Protective Security Policy Framework controls your assessors reference.
- IRAP-readiness and pre-assessment penetration testing. Find and fix the issues before the formal IRAP assessment, so the assessment isn't where you discover them.
- Supply-chain and third-party risk. Assessment of the vendors and integrations that extend your attack surface.
What about AI assurance for agencies?
The same offensive-first approach, applied to AI. As agencies adopt AI, the AI Technical Standard and the DTA policy set clear expectations, and Ironbark Cyber helps you meet them with evidence rather than assertions.
- Alignment to the Australian Government AI Technical Standard for AI systems in government use.
- AI Impact Assessments to the standard the DTA Policy for responsible use of AI in government expects.
- AI transparency statements for public-facing AI use.
- Technical testing to back it all. LLM penetration testing and red teaming ground every assurance claim in what an attacker can actually do. See AI governance & assurance for the full picture.
What about state government?
We work to the state frameworks as fluently as the Commonwealth ones.
- New South Wales. Testing and assurance aligned to the NSW Cyber Security Policy, and support for Directive DCS-2025-04 third-party risk inventories. AI work aligned to the NSW AI Assessment Framework.
- Queensland. Alignment with the IS18 information security policy, and AI risk work using Queensland's FAIRA (Foundational Artificial Intelligence Risk Assessment).
How do you engage us?
Ironbark Cyber is built to be easy for government to buy from.
- SME direct engagement. As an Australian-owned SME, we can often be engaged directly under the Commonwealth Procurement Rules SME provisions (up to $500,000) and the equivalent Queensland and NSW SME direct-engagement rules. No full tender required.
- Insurance. We hold professional indemnity and public liability cover; certificates of currency and levels are available on request.
- Sovereign delivery. Australian owned and operated, with all work delivered by senior Australian-based consultants.
- Clearance-ready. Tell us the clearance level your engagement requires on the scoping call and we'll confirm what we can staff for it.
- Prime subcontracting. Where a panel position is required that we don't hold, we deliver as a subcontractor to a prime that does (see below).
Partner with us as a prime
If you're a large consultancy or systems integrator bidding Commonwealth and state work, and you need sovereign Australian offensive security or AI assurance capability on the team, Ironbark Cyber subcontracts. We bring senior, named consultants (led by a founder featured by HackerOne on AI red teaming), fixed pricing you can build into a bid, and delivery that reflects well on your name. We've supported delivery for primes and government suppliers already; talk to us early in a pursuit and we'll help you scope the security or AI assurance component.
Why Ironbark Cyber for government?
Ironbark Cyber is Australian owned and operated (ABN 18 692 781 561), senior-only in delivery, and offensive-first in method. The people who scope your work are the people who do it. For agencies that need testing that stands up to an assessor and AI assurance that stands up to scrutiny, that combination is the point.
FAQ
Frequently asked questions
Can a government agency engage Ironbark Cyber directly without going to tender?
Often, yes. Ironbark Cyber is an Australian-owned SME, and under the Commonwealth Procurement Rules agencies can engage SMEs directly for procurements up to $500,000 (the SME direct-engagement provisions), with similar direct-engagement thresholds under state rules in Queensland and NSW. We can walk your procurement team through the pathway on a scoping call.
Can you help with IRAP?
Yes. Ironbark Cyber provides IRAP-readiness and pre-assessment penetration testing. The technical testing that finds and fixes issues before a formal IRAP assessment, so the assessment goes smoothly. We work alongside IRAP assessors rather than replacing them.
What if a procurement needs a panel we are not on?
Where we are not on a given panel, we can often be engaged directly under the SME direct-engagement provisions, or deliver as a subcontractor to a prime that holds the panel position. Tell us the procurement pathway on a scoping call and we will work out the cleanest route.
Do you hold security clearances?
Tell us the clearance level your engagement requires on the scoping call and we will confirm what we can staff for it. All work is delivered by senior, Australian-based consultants.
Can you subcontract to us as a prime?
Yes. Ironbark Cyber regularly delivers as a sovereign Australian subcontractor to larger primes and systems integrators that need senior offensive security or AI assurance capability on a bid or engagement. See the "Partner with us as a prime" section below.
What is happening with the Essential Eight and the ASD "Essentials" series?
The ASD is evolving its cyber security advice, with a broader "Essentials" series expected to build on and eventually succeed the Essential Eight. Ironbark Cyber tracks these changes and tests against both the current Essential Eight maturity model and the emerging guidance, so your uplift work stays current.
Contact
Talk to us
Tell us what you're trying to protect, secure or build. We'll come back with a plan.