BCyber
Could your business survive a ransomware attack?

Cyber jobs done for you, with the evidence to prove it.

Tell us about your business once. We work out what you need, then complete the jobs: backups tested, incident plan ready, ASIC s912A cyber evidence signed off. We work alongside your IT provider.

Winner, RegTech Awards 2026: Cyber & Operational Resilience, and Corporate RegTech Initiative.

Start with a Cyber Health CheckSee the jobs we complete
Australian-Owned & Operated
2026 Australian AI Awards — Finalist, Cyber Security
2025 GRC Provider of the Year — Finalist
35+ Years Combined Experience
15+ Compliance Frameworks
Scroll to explore

The BCyber Advantage

Real numbers behind the work we deliver today

0+
Compliance Frameworks
APRA, Essential Eight, NIST & more
0+
Threat Scenarios
AI-enhanced & MITRE-mapped
0+
Training Programs
Industry-specific & role-based
0
Years of Awards
Recognised since 2019
0+
Years Experience
Combined leadership expertise
Sound familiar?

Challenges We Solve

Click on any challenge below to see exactly how BCyber addresses it — with specific products, not vague promises

This is our brain

One signal. The whole system responds.

One client record. Every job uses it.

Here is a simplified, public view of how a signal in one place becomes action everywhere else. You cannot screenshot a brain you do not have.

The operative-intelligence core

A Super Conductor wiring the whole swarm, a shared Knowledge Hub, the GRACE framework, and self-learning that gets sharper every week.

Super ConductorKnowledge HubGRACE frameworkSelf-learning
  1. CyberTriage

    A signal enters

    An incident lands at 2am. Triage classifies its severity and starts the response runbook — it executes, it does not wait for a phone call.

  2. GRACE / Profiler

    The risk register re-scores itself

    The core maps the incident to your risk register and re-scores the exposure automatically — mapped to a named authority (ACSC / ISO / APRA / OAIC), not to a colour.

  3. Governance / Board

    A board note drafts itself

    A plain-English board note is drafted — what happened, what it means, and what is already being done — with the evidence trail attached. A human reviews before it goes up.

  4. Cyber Fitness

    Training schedules itself

    Targeted training is scheduled for the people the incident actually touched — so the same door does not open twice, and risk genuinely goes down.

That cross-spoke propagation is the thing a catalogue of products cannot replicate — because they have products, and we have a brain.

Operative intelligence, human on the loop: a person reviews every consequential step. We show the evidence and name what we could not determine — we never claim a guarantee.

Watch it thinkSee the compounding slopeHow we operate

We don't sell products. We complete jobs.

You don't pick modules. We diagnose, then do the work.

8 Years of Industry Recognition

Consistently recognized by Australian and global industry bodies for excellence in cybersecurity, innovation, and leadership since 2019 — including our latest 2026 Australian Cyber Security Awards finalist nominations

8
Years of Recognition
3
Industry Awards Won
20+
Finalist Nominations
4
Global Recognitions
2026
5 recognitions
Winner

Cyber & Operational Resilience

The RegTech Association
RegTech Awards 2026 · Cyber & Operational Resilience category27 Oct 2026
Winner

Corporate RegTech Initiative

The RegTech Association
RegTech Awards 2026 · Corporate RegTech Initiative category27 Oct 2026
Finalist

Cyber Security

Australian AI Awards
Australian AI Awards 2026 · Cyber Security category
Finalist

GRC Provider of the Year

Australian Cyber Security Awards
Finalist

Cyber Professional of the Year - Professional Services

Australian Cyber Security Awards
B

BCyber

2025
3 recognitions
Finalist

Cyber Security Professional of the Year - Professional & Financial Services

Australian Cyber Security Awards
KS

Karen Stephens

Co-Founder & CEO

Finalist

GRC Provider of the Year

Australian Cyber Security Awards
Finalist

AI Innovator - Cyber Security

Australian AI Awards
2024
2 recognitions
Finalist

Cyber Security Professional of the Year

Australian Cyber Security Awards
KS

Karen Stephens

Co-Founder & CEO

Finalist

AI Innovator - Cyber Security

Australian AI Awards
Meet Our Award-Winning Team

The short answer

I run an Australian business — where do I actually start with cyber security?

Start by finding out where you stand, not by buying tools. Map your current controls against the ASD Essential Eight, identify which laws apply to you — the Privacy Act 1988, APRA CPS 234, the SOCI Act — then fix the highest-risk gaps first and keep evidence of each fix. A short, honest baseline assessment tells you which of those steps matter most for your organisation.

What it depends on

  • Your sector: APRA-regulated entities carry CPS 234 (in force since 1 July 2019) and CPS 230 (since 1 July 2025); critical-infrastructure owners carry SOCI Act obligations; almost every business holding personal information carries the Privacy Act 1988 and the Notifiable Data Breaches scheme (since 22 February 2018).
  • Your size: the Privacy Act small-business exemption (annual turnover of A$3 million or less) still applies to many SMEs, but not to health providers, those trading in personal information, or contracted Commonwealth service providers.
  • Your maturity today: the ASD Essential Eight Maturity Model (last updated November 2023) grades each control from Level Zero to Level Three — your starting level decides your first 90 days.

What a professional adds

  • Deciding which obligations genuinely apply when your structure is unusual — group entities, outsourced service providers, offshore processing.
  • Prioritising remediation against your actual business risk and budget, rather than a generic checklist order.
  • Standing behind the evidence when a board, insurer, auditor or regulator asks how you reached a conclusion.

Questions to ask your current provider

  • Can your current provider show you, in writing, which specific obligations they have mapped you against — and the date of that mapping?
  • When a control is marked “done”, can you see the evidence behind it, or only a green tick?
  • Does your security picture update when the regulation changes, or only at the next annual review?
  • If you asked for a board-ready summary tomorrow, would it show reasoning — or just a score?

What this answer does not cover

  • This page does not determine which laws apply to your specific entity — that needs your facts.
  • An assessment score is a point-in-time indication, not a certification or an audit opinion.
  • It does not replace incident response: if you are in an active incident, go to the CyberTriage guidance and contact the ACSC on 1300 CYBER1 (1300 292 371).

Core Australian cyber obligations — quick reference

Curated by BCyber from primary Australian regulatory sources. A navigational summary, not legal advice; verify against the current instrument. Reviewed .

ObligationRegulatorWho it applies toIn force since
Privacy Act 1988 + Notifiable Data Breaches schemeOAICAPP entities (most organisations over A$3m turnover, plus specified smaller entities)22 Feb 2018 (NDB)
CPS 234 Information SecurityAPRAAPRA-regulated entities1 Jul 2019
CPS 230 Operational Risk ManagementAPRAAPRA-regulated entities1 Jul 2025
SOCI Act cyber incident reportingCyber and Infrastructure Security Centre / ASDResponsible entities for critical infrastructure assets8 Jul 2022
Ransomware payment reporting (Cyber Security Act 2024)Department of Home Affairs / ASDBusinesses over A$3m turnover and SOCI responsible entities30 May 2025
Take the free GRACE Posture Score

10 questions, about 4 minutes, no sign-up required.

Straight answers to common cyber questions

Plain-English answers, reviewed by our team. General information only, not legal or insurance advice.

What does s912A require of a small AFSL holder on cyber?

Section 912A of the Corporations Act requires every AFSL holder, however small, to have adequate resources and risk management systems, and ASIC treats cyber security as part of that duty. In ASIC v FIIG Securities (13 February 2026), the Court ordered FIIG to pay A$2.5 million over cyber security failures. A small licensee should be able to show documented controls, named owners and evidence they are working.

Source: ASIC media release 26-021MR

Human-reviewed, Oct 2026

Start with a Cyber Health Check

Does ASD Essentials replace the Essential Eight for my business?

On 15 October 2026, ASD announced ASD Essentials as the next step beyond the Essential Eight. It doesn't switch off the Essential Eight overnight: ASD has not set a fixed changeover date, and both frameworks remain published during the transition. Plan for a move over the next year or two, keep meeting your current obligations, and map the controls you already have so the change is an update, not a restart.

Human-reviewed, Oct 2026

Start with a Cyber Health Check

How do I know my backups will actually work?

Use the 3-2-1-1-0 rule: three copies of your data, on two different types of storage, one kept off-site, one immutable or offline so ransomware can't reach it, and zero errors when you check. The last part matters most. A backup is only proven when you have restored from it and timed how long it took. Test a real restore on a regular schedule, and after any major system change.

Human-reviewed, Oct 2026

Start with a Cyber Health Check

What will my cyber insurer ask for?

Insurers' questions vary, but they commonly ask about three things: multi-factor authentication on email, remote access and admin accounts; backups kept separate from your network and tested; and a written incident response plan staff know how to use. Expect to be asked for evidence, not just a yes. This is general information only, not insurance advice; check your own policy wording.

Human-reviewed, Oct 2026

Start with a Cyber Health Check

Are we ready for ransomware?

You're ready when two things have been tested, not just written down. First, an incident response plan that names who decides, who calls your insurer and IT provider, and how you tell clients, rehearsed in a tabletop exercise. Second, a restore from an offline or immutable backup that you have actually run and timed. If either has never been tested, you don't yet know how long you would be offline.

Human-reviewed, Oct 2026

Start with a Cyber Health Check
Start Here · No Sign-Up Required

Three Ways to See Your Risk, Cost and Path Forward

Public, self-serve tools built by Australia's award-winning GRC specialists. Understand your posture, quantify your stack, and see transparent pricing — in minutes, not meetings.

GRACE Posture Score

10 questions · ~4 minutes · instant score across Governance, Resilience, Assurance, Compliance & Education — mapped to SOCI, APRA CPS 234 & the Privacy Act.

Start free assessment

Stack Replacement Calculator

Compare your current cybersecurity stack (tools + licences + MSPs + hidden costs) against the BCyber GRACE platform. See your real 12-month TCO side-by-side.

Model your savings

Transparent Pricing

Foundations · Momentum · Enterprise. Published bands. Full Build-vs-Buy TCO. No 37-day sales cycle before a number lands in your inbox.

View pricing bands
See where you stand on the AI Cyber Maturity Index

A Cyber Security Company in Australia, Built for Australian Businesses

BCyber is an award-winning, Australian-owned cyber security company in Mascot, NSW, helping SMEs, boards and regulated organisations turn cyber risk into provable resilience. Our cyber security services are delivered through the GRACE cyber resilience platform — Governance, Resilience, Assurance, Compliance and Education in one place, mapped to Essential Eight, APRA CPS 234, SOCI and the Privacy Act. Explore how we help, review our transparent pricing, or meet our Sydney-based team.

Explore our cyber security services See the GRACE platform