Sovereign Cyber Resilience.
Continuous Adversary Path Chaining.
Principal-led ASD ISM compliance, Essential Eight remediation, and objective-led adversary simulation - powered by AloupaAI and delivered 100% onshore in Canberra by veterans with 30+ years in national security.
Delivery model
Principal architect on every call, start to finish
Background
Australian intelligence, defence, government and critical infrastructure
IRAP
Official facilitator, assessment-ready evidence
Platform
AloupaAI continuous attack-surface mapping
You work with the principal.
Not a pyramid.
Feisty Fox is deliberately boutique. The architect who scopes your engagement runs it, writes the findings and briefs your board. Nothing is passed to a junior team after the sale.
- One senior security architect owns the engagement - scoping through to debrief.
- Official IRAP facilitator, so assessment evidence is built once and holds up.
- 30+ years across Australian intelligence, defence, government and critical infrastructure.
- Canberra-based and 100% onshore. No offshore delivery, no subcontractor chain.
Client names are never published. These three engagements are described by sector and outcome only.
Accelerated ASD ISM and Essential Eight Maturity Level 2 readiness ahead of IRAP assessment, cutting remediation timelines by 60%.
Zero-disruption SCADA/ICS adversary simulation exposing lateral movement paths across air-gapped boundaries.
Objective-led red team engagement validating detection and response against nation-state TTPs.
Four engagements. Fixed scope, fixed price.
Each engagement starts with a 15-minute call, then a written scope with deliverables, timeline and price before any work begins.
ASD ISM & IRAP Readiness Advisory
Who it's for
Federal agencies, cloud vendors and SaaS providers preparing for an IRAP assessment.
Deliverables
- ISM control mapping against your system boundary
- Pre-assessment gap register with owner assignment
- Remediation roadmap sequenced for the assessor
- Assessor-ready evidence pack
Essential Eight Maturity Uplift
Who it's for
CISOs and risk owners who need defensible ML1-ML3 evidence, not a slide deck.
Deliverables
- ML1-ML3 baseline across all eight strategies
- Weakest-link analysis with control evidence gaps
- Engineering uplift roadmap with effort estimates
- Board-ready maturity report
Objective-Led Red Teaming & Adversary Simulation
Who it's for
Enterprises that need to prove detection and response, not just scan compliance.
Deliverables
- Objective-based red team against crown-jewel assets
- AloupaAI attack-path chaining across trust boundaries
- Detection and response validation against nation-state TTPs
- Executive debrief plus technical remediation register
OT / SCADA & Critical Infrastructure Security
Operational technology assessments using passive network telemetry, digital-twin validation, and formal de-confliction protocols. Backed by comprehensive Professional Indemnity & Cyber Liability coverage.
Who it's for
Critical infrastructure and OT operators who cannot accept production downtime.
Deliverables
- Safety-first assessment of the OT estate
- Air-gap and segmentation boundary testing
- Lateral movement path analysis across IT/OT
- Zero-disruption recovery and response playbook
From recon to ISM mitigation.
AloupaAI does the mapping at machine speed. A principal decides what is real. Select a stage to see the work.
AloupaAI maps the surface first
Every reachable asset, identity, certificate and service in your external footprint is enumerated continuously - including the shadow IT an adversary would find first.
Net effect: 88% of attacker-reachable surface closed before an adversary acts.
Deployment & Data Sovereignty
100% Australian-hosted on IRAP-assessed PROTECTED infrastructure, or deployed air-gapped on-premises inside your network boundary.
Single-tenant isolation. Client telemetry and attack-path graphs are never shared, retained post-engagement, or used to train external models.
Every machine-chained adversary path is manually verified by a cleared senior operator within 24 hours to eliminate false positives.
Rapid Sovereign Incident & Assessment Readiness
Fly-away sovereign telemetry kits and pre-staged onshore operators ready for rapid deployment across Canberra, Sydney, Melbourne, and remote critical infrastructure sites.
Pre-staged operators
Onshore principals retained in Canberra, Sydney and Melbourne
Fly-away kits
Sovereign telemetry kits shipped to site, never dependent on client tooling
Remote sites
Deployment to regional and remote critical infrastructure locations
Test the thinking before you buy the work.
Every tool runs free in the browser - no account, no paywall. Only the formatted board report asks for a work email.
For buyers and risk owners: score posture, map ISM controls, export a board pack.
Essential Eight Maturity Calculator
Score all eight ASD strategies live, see your weakest link, and export a board-ready maturity report.
Open toolISM Control Explorer
Search the ASD Information Security Manual and map controls directly to your system boundary.
Open toolScored below Maturity Level 2?
Book a 15-minute review with a Principal Architect to map your fastest path to compliance.
Executive board report (PDF / DOCX)
Run the calculator, then export the formatted pack for your board or assessor. Work email required at export.
Confidential by default. Principal-led by design.
AGSVA Security Clearances
Principals hold active Australian Government security clearances (NV1 / NV2 / PV), verifiable upon NDA and sponsor check.
DISP & Sovereign Governance
100% Australian-owned entity with zero Foreign Ownership, Control, or Influence (FOCI). Full Defence Industry Security Program (DISP) governance pack available on request.
Certified Practitioners
Assessments executed exclusively by senior principals holding industry-recognized offensive and governance credentials (OSCP, OSEP, CISSP, CISM).
Pre-Engagement Due-Diligence Pack
ABN, Professional Indemnity and Cyber Liability Certificates of Currency, and de-identified Principal CVs issued under NDA before contracting.
Procurement, legal and security teams can verify all four before any contract is signed.