AJQ CYBER SECURITY
Cyber Risk & Compliance Services for Enterprise, Government and Mid-Market Organisations
Proactive Cyber Security, From Strategy to Execution
We help enterprises, government agencies and mid sized companies reduce cyber risk and meet Essential Eight, ISO 27001, SOC 2 and CPS 234. We hold our own independent SOC 2 Type 2 report, so we know what it takes.
SEE HOW WE PROTECT YOU
Penetration testing, Essential Eight uplift and compliance, audit ready and board ready
KNOW WHERE YOU STAND
Knowing how exposed you are and what to fix first is vital. The right specialists make all the difference.
A clear picture of risk
Assessments that show where you are exposed, written so both your engineers and your board can act on them.
Practical priorities
A roadmap that separates what needs fixing now from what can wait, so effort goes where it counts.
Specialists who have done it before
Senior, Equifax background checked specialists who have taken many organisations through this work.
WHAT WE DO
From a one off assessment to an ongoing security partner.
Penetration Testing
Simulated attacks and vulnerability testing on web apps, APIs, cloud and internal systems.
Risk & Governance
Maturity assessments, risk registers, third party risk and governance for safe AI use, reported to executives and boards.
Compliance & Audit Readiness
Gap analysis and documentation to pass SOC 2, ISO 27001, CPS 234 and Essential Eight audits.
Uplift Programs
Policies, incident playbooks, governance refresh and staff security awareness training.
Virtual CISO
For businesses of 25 to 200 staff without a security team. Named vCISO, health checks, phishing campaigns and quarterly roadmaps.
Cyber Specialists
Embedded GRC, audit, testing and cyber engineering specialists on contract or retainer.
CYBER SECURITY CASE STUDIES
View all cyber security case studiesReal engagements, real outcomes. A selection of our recent cyber security work.
Questions & Answers
A virtual CISO (vCISO) gives you a named senior security lead on a part time basis. It suits organisations that are too small to justify a full time CISO but still have customers, regulators or insurers asking hard questions. Ours typically covers a security roadmap, policy ownership and quarterly reporting to the executive or board.
Essential Eight, ISO 27001, SOC 2 and CPS 234 are the ones we see most. We start with a gap analysis against the framework you need, then help close the gaps and prepare the evidence an auditor or client will ask for.
Yes, across web applications, APIs, cloud environments and internal networks. You get a report that separates what needs fixing now from what can wait, written so that both your engineers and your management can act on it.
Yes. Most breaches start with a person, not a firewall, so we run awareness training and phishing simulations that go out to staff on a regular schedule rather than as a once a year event. You get reporting on who clicked and who reported, which is what auditors and insurers now ask for.
Penetration tests, gap analyses and awareness training programs are quoted as a fixed price once we have scoped the environment, so there are no surprises. A vCISO is a monthly subscription. Where you need a security specialist embedded in your team for a period, that is time and materials.
That is most of our mid market work. For organisations of roughly 25 to 200 staff we offer fixed price and subscription options that combine awareness training, regular health checks and a vCISO, so you get coverage without hiring.