BCyber Free Exposure Watch

Free Exposure Watch for Australian business

See what an attacker can see about your domain in minutes — email spoofing risk, certificate and header hygiene, exposed subdomains, known-exploited vulnerabilities in your stack, Essential Eight, insurance readiness and the reporting obligations that apply to you.

Consent first: nothing runs until you prove you control the domain. Passive checks only.

How the model works

Tier 0 · Free Exposure Watch

Passive, consent-first checks with a score, an indicative A$ loss band and your top three fixes.

Tier 1 · Verified Finding

Pay only when a finding is validated as real, material and new — and you accept it.

Tier 2 · Resolved Risk

Milestone fees only when a re-test passes and the evidence is stored in GRACE.

Tier 3 · Assurance & Accountability

vCISO retainers include Tiers 1 and 2 — retained clients never see a per-finding bill.

Published fee table

Fees apply only to clients who opt in to outcome pricing. They are ex GST, include the fix pack (step-by-step remediation mapped to your framework) and one re-test.

Critical finding: $1,500
High finding: $750
Medium finding: $250
Low finding: always free

Finding fees are capped at $3,000 per month. You have 7 days after accepting a finding to dispute it, and nothing is billed until the fix is re-tested. Every invoice is reviewed by a person before it is sent — no surprise invoices.

Resolved-risk milestones

Paid only when a re-test passes and the evidence is stored in GRACE (small / medium / large entity):

Essential Eight Maturity Level 1 reached: $2,000 / $3,000 / $4,000
Essential Eight Maturity Level 2 reached: $4,000 / $5,000 / $6,000
Insurance proposal answered and bound: $750 / $1,000 / $1,500
Audit passed: $1,500 / $2,500 / $4,000
Board pack accepted: $500 / $750 / $1,000
Incident tabletop completed: $750 / $1,000 / $1,500
Insurance gainshare: 20–30% of the verified first-year premium saving, documented with your broker

Where per-outcome fees never apply

We never charge per finding on an engagement where BCyber also attests to your compliance, and clients on a vCISO Assurance & Accountability retainer have findings and milestones included. Evidence-based assessment that maps to ASD Essential Eight, ISO/IEC 27001 and APRA CPS 234. It is not a guarantee that your organisation is secure or compliant.

Is the Exposure Watch really free?

Yes. The passive checks, score, indicative loss band and top three fixes are free with no card required. You only pay if you later choose to have BCyber validate and fix a finding, or reach a verified milestone.

Do you scan or attack my systems?

No. We only read public information: DNS records, one normal request to your homepage, your TLS certificate and public certificate-transparency logs. Nothing runs until you prove you control the domain with a DNS TXT record. Active testing only ever happens with written, scoped authority.

What does a verified finding cost?

Critical $1,500, High $750, Medium $250, Low always free — capped at $3,000 a month. Each fee includes the fix pack and one re-test, and you have 7 days to dispute.