Red Pulse

Know where your security actually stands.

Independent assessments of your security posture against the Essential Eight and the Australian Government Information Security Manual, with a remediation plan your engineers can run and a report your board can read.

Book a scoping call See what we assess

Three engagements, scoped to what you need to prove.

Each one ends with a written report, a prioritised remediation plan and a working session with your team. None of them end with a sales pitch for software.

Security posture assessment

For organisations that want an honest baseline before committing budget.

A structured review of identity, endpoints, email, cloud tenancy and backups across Microsoft 365, Azure and Google Workspace. We look at configuration, not just policy documents, and show you the gap between what you believe is in place and what is actually enforced.

  • Tenant and identity configuration review (Entra ID, Conditional Access, privileged roles)
  • Endpoint, patching and application-control state
  • Email authentication, backup and logging coverage
  • Risk-ranked findings with effort estimates

Essential Eight uplift

For businesses asked by a customer, insurer or regulator to reach a target maturity level.

A maturity assessment against the ACSC Essential Eight Maturity Model, then a sequenced plan to reach Maturity Level 1, 2 or 3. We map each mitigation strategy to the controls you already own, call out the ones that need new tooling, and help you collect evidence that will stand up to a third-party review.

  • Current-state maturity per mitigation strategy, with evidence
  • Target-level gap analysis and sequencing
  • Hands-on implementation support where you want it
  • Evidence pack prepared for your assessor or customer

ISM readiness

For suppliers to government and regulated sectors preparing for an ISM-aligned or IRAP review.

A readiness review against the relevant controls of the Information Security Manual for the classification you are targeting, typically OFFICIAL or PROTECTED. You get a control-by-control view of what is met, partially met and missing, plus the system documentation an assessor will expect to see.

  • Scoping of the system boundary and applicable controls
  • Control gap register with remediation owners
  • System Security Plan and supporting document templates
  • Pre-assessment walkthrough before you engage an IRAP assessor

Also available as add-ons or standalone: external and internal penetration testing, cloud security architecture review, and a short fractional security-lead arrangement while you hire. Red Pulse is independent and is not an IRAP assessor; readiness work is designed to make your formal assessment faster and less expensive.

How an engagement runs

1

Scope

A 30-minute call to understand what you need to prove, to whom, and by when. You get a fixed-price proposal within two business days.

2

Assess

Read-only access to the tenants and systems in scope, interviews with the people who run them, and evidence collection. Typically one to three weeks.

3

Report

A findings report with risk ratings, a remediation plan ordered by impact and effort, and an executive summary written for non-specialists.

4

Remediate

A working session with your engineers to walk the plan, then optional hands-on help or a check-in review once the work is done.

Built for Australian organisations with something to prove.

Government suppliers

Businesses on panels or in the Defence and Commonwealth supply chain that need to show Essential Eight maturity or ISM alignment to keep or win contracts.

Regulated and insured businesses

Health, finance, legal and professional services firms answering cyber-insurance questionnaires, APRA-aligned expectations or customer security reviews.

Growing SMBs and mid-market

Organisations of 50 to 2,000 staff running on Microsoft 365, Azure or Google Workspace, usually with a small IT team and no dedicated security function yet.

Who you work with

Red Pulse is run by Aiden, a Sydney-based senior security engineer with a background in cloud security, DevSecOps and security program leadership at large technology companies.

You work directly with the person doing the assessment. There is no handover to a junior team, and the report you receive was written by the engineer who looked at your environment. Findings are explained in terms of what an attacker could do and what it costs to fix, not in audit language.

Red Pulse also builds a continuous Essential Eight and ISO 27001 monitoring platform. Consulting clients can use it during an engagement to collect evidence, but no engagement depends on it and no report recommends it unless it is the cheapest way to close a gap.

Based in
Sydney, NSW. Remote engagements Australia-wide.
Frameworks
ACSC Essential Eight, Australian Government ISM, ISO/IEC 27001, ISO/IEC 42001.
Platforms
Microsoft 365, Entra ID, Azure, Google Workspace, Windows and macOS endpoints.
Engagement size
Fixed-price, typically one to four weeks.
Independence
No reseller agreements. No commission on recommended tooling.

Start with a scoping call

Tell us what you need to demonstrate and to whom. We reply within one business day with a short set of questions or a proposed time.

By sending this form you agree to our privacy policy. We use your details only to respond to this enquiry.

Prefer email? hello@redpulse.net