A compliance verdict you can defend.

Grow your capability without growing your overhead.

Take on more clients and more frameworks without adding headcount. One engine runs every engagement, from the evidence to the report, the executive brief and the board pack.

GRC consultants & practices

Explore →

Leading cyber security and compliance, without the big price tag.

The same evidence-led assessment large institutions use, priced for organisations without a compliance team.

Small & medium business · Schools & education · Early childhood education & care · Mortgage & credit brokers

Explore →

Defensible accuracy, with less consultant overhead.

Build evidence-backed compliance in-house. Nothing is marked met without proof, so your reviewers and consultants spend their hours on judgement, not on collecting paperwork.

Banks & APRA-regulated · Insurers & APRA-regulated · Superannuation & RSE licensees · APRA CPS 230 & CPS 234 · Government & Defence · Critical infrastructure — SOCI · Rail & OT · Healthcare · AI vendors & providers — GAiaaS · Third-party & supplier risk

Explore →

Assess once, report everywhere

Upload your evidence once and see where you stand across every framework you are held to, without repeating the work for each one.

Less chasing, more doing

CyberSentien reads settings directly from the systems you already run and tells you exactly what is still missing, control by control.

Reports people can rely on

Board packs, executive briefs and full reports, each tied to the evidence behind it, so your auditor and your board see the same story.

Your data stays in Australia

Australian-owned and hosted in Australia. Your evidence stays in your own workspace.

1. Clear, honest wording

Every requirement is shown in the authority's own words where we are allowed to use them, and otherwise in our own plain English, clearly labelled as ours.

2. Proof, not promises

A policy that says something happens is not proof that it does. Logs, system settings, registers and reviews are, so that is what we look for.

3. Tested before it is trusted

Each framework is checked against answers settled in advance, on evidence CyberSentien has never learned from. We publish the results as measured.

4. Automatic passes only once proven

A framework gives automatic passes only after a test with no mistakes. Until then, your reviewer sees the evidence and makes the call. Every result is dated on the Correctness Board.

1. Try it

Free. Open any console on sample documents now, or bring your own evidence in a personal demo workspace.

2. Pilot

One full assessment on your evidence, credited in full against a subscription taken within 90 days.

3. Subscribe

Published prices for every product. Your organisation then works in its own workspace, separate from the demo.

What is CyberSentien?

CyberSentien is an Australian-owned cyber security and compliance platform. It assesses an organisation once against its real evidence and reports across many frameworks — Essential Eight, the ISM, APRA CPS 230 and CPS 234, privacy, AI governance, rail and OT, and credit broking — and maps the same evidence to ISO 27001, SOC 2 and ISO 42001 readiness. It serves consultants and practices; small businesses, schools, early childhood services and brokers; and banks, APRA-regulated entities, government and rail operators. Every result cites the evidence behind it.

Is CyberSentien the same as CyberSentience or CyberSentriq?

No. CyberSentien (CyberSentien Pty Ltd, ACN 688 655 334, New South Wales) is a separate Australian compliance-assurance software company. It is not affiliated with CyberSentience, a New Zealand threat-intelligence firm, or with CyberSentriq. The correct spelling is “CyberSentien” and the website is cybersentien.com.

What compliance frameworks does CyberSentien assess?

Essential Eight (with ML1–ML3 maturity), the ISM at IRAP-aligned depth, and APRA CPS 230 and CPS 234, the Privacy Act, SOCI, IEC 62443 and CLC/TS 50701 for rail and OT, the NCCP Act for mortgage and credit brokers, and AI-governance frameworks including the NSW AI Assessment Framework, QLD FAIRA, NIST AI RMF and the EU AI Act. For ISO/IEC 27001, SOC 2 and ISO 42001 it shows how ready your evidence is — not an independent certification: CyberSentien gets you audit-ready, and an accredited certifier issues the certificate.

Where is CyberSentien data hosted?

In Australia, on Australian-owned hosting. Each paying organisation works in its own workspace, and its evidence stays there. You decide how long it is kept, you can take a full, verifiable copy before anything is deleted, and nothing under a legal hold can be removed. Keeping your data in Australia is the first principle the platform is built on.

How much does CyberSentien cost?

Three platform tiers, plus per-school and per-service sector lanes. Billed annually or monthly in AUD (annual is the cheaper way to buy): Core from $11,343, Professional from $23,872 and Enterprise from $64,467. All subscriptions are prepaid — cancel any time and you keep access to the end of the period you have paid for. Pricing scales with framework breadth and deployment model, and every product's prices are published on the pricing page. The demo is free and needs no documents of your own.

How correct is it?

Each framework is tested against answers settled in advance, on evidence the engine has never learned from. A framework only gives automatic passes after a test with no mistakes; until then, matching evidence is shown to your reviewer to decide. Every result, with its date, is on the Correctness Board.

How is CyberSentien different from other GRC tools?

It never tells you that you pass when you can't prove it. Anything without evidence reads “manual assessment required” instead of a made-up pass, every framework is checked in full rather than in part, and anyone you send a report to can confirm it is genuine without an account.