CyberSentienModular by design.
Priced by conversation.
Three tiers over a seven-layer module catalogue — subscribe to the layers you need. Every figure below is an indicative “from” floor in AUD: final pricing depends on tenants, connectors and deployment. The self-serve lanes you can subscribe to online; banks and Enterprise are scoped in a conversation first. The demo week is free either way.
Talk pricing with us →🌱 Founder pilots — first 5 Australian practices
Locked founder pricing that never rises on you, a direct line to the founder, and real roadmap input. We're pre-logo and honest about it — founding partners are how we earn them.
The three tiers
Three lines, one engine. Small business starts on the Essential Eight baseline (from $6,612/yr, in Other ways in below). GRC consultants & practices run multi-client on Core and Professional. Banks & regulated entities take Enterprise for CPS 230/234, ISO and IRAP depth — scoped in a conversation, not a checkout. The self-serve lanes you can subscribe to online right now; we publish every price either way, so you can budget before you talk to us.
Core
from $11,058 / yrAUD, indicative — final pricing is a conversationThe evidence & assurance engine — per-control evidence chains, framework mapping, honest posture, consultant-grade reports.
Professional ⭐
from $23,313 / yrAUD, indicative — final pricing is a conversationThe working practice: integration fabric, identity & Microsoft packs, AI registers, document drafting, observation capture.
Enterprise
from $62,940 / yrAUD, indicative — final pricing is a conversationThe regulated entity: multi-entity, SIEM/EDR/cloud AI packs, Shadow-AI radar, continuous assurance, board packs, tamper-evident ledger.
Sector lanes — buy the pack that governs you
A school and an early childhood service do not need a platform tier. They need the one curated, source-cited obligation set that actually binds them, and a console that renders it honestly — including telling them when an obligation has not commenced in their state. Priced per school and per service, not per seat.
Early Childhood Compliance
The curated Education and Care Services National Law obligation pack, gated to your jurisdiction, plus notification clocks, retention, devices and images, the Privacy Act health-service determination, vendor risk and governed reports.
Subscribe →Talk to usSchool Compliance
195 source-cited Australian school obligations, each stating the sector and jurisdiction it binds, plus Essential Eight, privacy and notifiable breaches, child safety, EdTech vendor risk and governed reports.
Subscribe →Talk to usSMB Cyber Baseline
ASD Essential Eight maturity for small business on the evidence engine — honest, evidence-led posture your director can stand behind, growing into full ISM depth when you do.
Subscribe →Talk to usRunning more than one?
Groups, multi-campus schools, dioceses and multi-service approved providers are a different conversation, so they are priced in one — not with a discount curve invented on a web page. What you get is consolidated posture across every site with each site still gated to its own jurisdiction: a provider operating in both WA and NSW genuinely carries different duties per centre, and we will not flatten that to make a dashboard tidier.
Early Childhood — multi-service
For approved providers running several services. Consolidated posture across every centre, with each centre gated to its OWN jurisdiction — a group operating in both WA and NSW genuinely carries different duties per site, and the December 2025 child safety package binds the NSW centres but not the WA ones. Group-level reporting for a board or an insurer, one administrator, volume pricing. Single service? That tier is listed above at $1,482 / service / yr.
Contact sales →Talk to usSchools — multi-campus, group or diocese
For multi-campus schools, school groups, dioceses and independent-school associations. Consolidated obligation posture across every school, each still scoped to its own sector and jurisdiction, plus group-level reporting, one administrator and volume pricing. Single school? That tier is listed above at $4,503 / school / yr.
Contact sales →Talk to usBilling, plainly
All subscriptions are prepaid. Your access period starts the day you pay and runs ~30 days on monthly billing, or a year on annual. Cancel any time — cancelling stops the next charge and you keep full access until the end of the period you have already paid for, not the moment you click. A refund ends access immediately.
Other ways in
| Offer | Indicative (AUD) | What it is |
|---|---|---|
| Per-assessment (one-off) | from $3,500 | One engagement, one framework scope agreed up front, full report pack. |
| Single-use report (Report Store) | from $1,450 · flagship SAR $2,950 · Complete Assurance Package $4,950 | One report, one download, integrity-anchored. The flagship is the ISM/IRAP-style Security Assessment Report; the package is every report plus SoAs, registers and a tamper-evident bundle. |
| Per-managed-client (consultant channel) | from $1,800 / client / yr | Your practice runs your clients on the engine; you set the resale. |
| IRAP engagement support | from $15,000 / yr | Assessor-facing support through an IRAP engagement: the ISM assessment kept current against your evidence, and the report pack an assessor works from. |
| GAiaaS AI governance — scoped engagement | from $8,000 / yr · $1,800 for schools | AI-system register, impact assessments and AI-governance reports. Quoted with the build and provisioned with your box — not switched on later against a running one. |
For context, publicly reported quotes for a human IRAP assessment run roughly from A$25,000 for a narrow, well-prepared OFFICIAL system to A$250,000 or more for a large PROTECTED environment — see our guide to IRAP assessment cost for what moves it. Those are reported market ranges, not our prices. A subscription is a different shape of spend — continuous and re-runnable rather than a point-in-time report — so compare what each one leaves you holding, not just the number. The consultant channel lets practices resell managed clients at their own margin.
Not sure which tier? Run the demo first.
Open the gated demo, run a real assessment on sample docs, and price against what you actually saw.
Banks & APRA-regulated entities
There is a dedicated bank console — board and CRO views, CPS 230 operational risk and CPS 234 information security as standard rather than add-ons, and third-party risk on the same evidence spine. It is a different console from the consulting practice edition, not a bigger version of it.
Priced per licensed ADI per year, banded on total assets as APRA reports them:
| Band | Price (AUD/yr) | 2-year term |
|---|---|---|
| ADI under $2bn in assets | $62,940 | $56,646/yr |
| $2bn to $20bn | $85,000 | $76,500/yr |
| Significant financial institution | from $140,000 | from $126,000/yr |
Foreign bank branches are priced on the assets of the Australian licensed entity. Every band includes the board and CRO views, operational-risk and material-service-provider registers on the same evidence spine, third-party risk, ISM at IRAP-aligned depth, and the supplier obligations we sign as your material service provider — notification, right to audit, annual attestation, exit plan. IRAP engagement support and the GAiaaS AI-governance register attach separately.
Regulated deployments are scoped in a conversation before purchase: your procurement and security review come first, and the deployment model, tenancy and data boundary are agreed rather than assumed. You can see the console before any of that — the demo is open.