Assess + Architect · Identity
Identity is the perimeter now, and most teams cannot say cleanly who and what can reach their systems. We map the current state, surface the standing and privileged access that should not exist, then design the target identity and Zero Trust model you build toward. One engagement reads where you are; the next decides what good looks like.
Scope agreed in writing before any work. No obligation.
Years of joiners, movers, and leavers, contractors, and acquisitions have left entitlements no one fully understands. Standing access accumulates because removing it feels risky and nobody owns the call. You need the real picture before you can tighten it.
Administrative rights, service accounts, and secrets are scattered across cloud and on-premise, and a single over-privileged account is the path most incidents actually take. The Essential Eight and APRA both put this at the centre, and so do we.
You are moving off a flat network and a trusted perimeter toward identity-based access, and you want the target architecture decided deliberately rather than assembled one tool at a time.
The method
We inventory human and machine identity as it actually is: privileged accounts, service accounts, dormant and orphaned access, and the standing entitlements least privilege would never grant. The map reflects what your systems permit today, not what a policy says they should.
Posture is scored against the access controls you actually answer to: the Essential Eight strategies for restricting administrative privileges and enforcing multi-factor authentication, APRA CPS 234's access-management expectations, and the identity controls in ISO 27001 Annex A. One review, mapped to each.
Workforce identity, customer identity where it touches your estate, and the workload identity, service accounts, and secrets that machines use are designed as one fabric on a Zero Trust footing (NIST SP 800-207), not as separate projects that never quite meet.
The architecture defines the access model, segmentation, privileged-access management, and identity threat detection, then sequences a migration from where your estate is today. You leave knowing both the destination and the order of the moves.
What you are commissioning
This page is backed by two named engagements: the assessment that maps your real identity and access posture, and the architecture that designs the target state and the path to it. Each is scoped on its own, and each stands alone.
Assess trackTypically 2–4 weeks
Map who and what can reach your systems, and where that access goes wrong.
Best for teams where identity has sprawled faster than anyone has governed it.
Includes
Deliverables
Architect trackTypically 4–6 weeks
A focused design for identity, access, and Zero Trust.
Best for teams modernising identity as the new perimeter.
Includes
Deliverables
The sequence
The two engagements run best in sequence, and the gate between them is a decision that stays yours.
Questions
Privileged access, because that is where the exposure concentrates and where the Essential Eight and APRA both focus. From there we cover the joiner-mover-leaver lifecycle, service and machine accounts, dormant and orphaned entitlements, and how access is granted, reviewed, and removed across your cloud and on-premise estate.
Yes. Service accounts, workload identity, API credentials, and secrets are where modern access risk increasingly sits, and they are designed into the same model as workforce identity rather than left as an afterthought.
Both put identity at the centre: the Essential Eight through restricting administrative privileges and enforcing multi-factor authentication, CPS 234 through its access-management and accountability expectations. We assess against them directly and map every finding back, so the same work serves your Australian obligations and your ISO 27001 or SOC 2 program at once.
No. The assessment stands on its own and ends in a prioritised gap register that is yours to act on. Many teams then commission the target-state architecture; others close the immediate gaps first and design later. The gate is a decision you control.
A design. We are independent of any identity vendor, our own platform included, so the target state is decided on your needs and only then matched to tooling, whether that is your existing identity provider extended properly or a consolidation onto one.
One conversation, then the scope and the price in writing. Your enquiry arrives already marked for identity & access management.