Assurance, 3 services
Independent assessment against the standards that boards, auditors and insurers ask about, delivered by the same consultants who break into systems for a living. Evidence gathered by testing controls, not by reading policy.
Services
Essential Eight assessment against the ASD maturity model: every strategy tested with evidence, rated ML0 to ML3, with a prioritised uplift roadmap.
You receive A maturity rating for each of the eight strategies, with the evidence behind it and a prioritised uplift roadmap
Security configuration review of firewalls, servers, endpoints, network devices and Microsoft 365 against CIS Benchmarks, with the exact settings to change.
You receive A finding for each deviation, ranked by risk, with the exact setting to change
Penetration test remediation support and retesting: hands-on help closing findings, sessions with your engineers or MSP, and a formal retest and report.
You receive A formal retest of the remediated findings and an updated report recording what has been closed
Standards
Each assessment names the standard it uses, so the report means the same thing to you, your auditor and your insurer.
The eight mitigation strategies at Maturity Levels Zero to Three, tested with evidence rather than questionnaires.
Consensus hardening baselines for operating systems, network devices, cloud platforms and Microsoft 365.
SP 800-53 control families and SP 800-115 testing guidance, used where a client reports against a NIST-based framework.
The Application Security Verification Standard, used to assess application controls beyond what a single test exercises.
Coverage
Each assurance service examines part of a typical organisation. Together they show where the controls stand, from the perimeter to the identity platform. Hover or tab to a system to see which services assess it.
It is an independent assessment against the ASD Essential Eight Maturity Model, with each strategy tested using evidence from your systems rather than answers to a questionnaire. It is not an IRAP assessment.
No. A configuration review checks settings against a benchmark; a penetration test checks what an attacker can do. They answer different questions and find different things. Organisations that run both get the settings right and know the paths that remain.
A report with the standard named on the front, a rating or finding for every control assessed, the evidence behind each one, and a prioritised roadmap. Where a retest is quoted or booked, the updated report records what was closed, and an attestation letter is available on request at no charge.
Less than most people expect. We need a technical contact for a kick-off session, read access to the systems being assessed, and a few hours across the engagement to answer questions and pull evidence. We tell you the list at scoping so nobody is surprised.
Also from Aurian: penetration testing services, and managed security services.
Tell us what you need to know about your environment. We reply within one business day.