Skip to content
Penetration testing
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
All services on one page
Industries How we work About Blog
1300 AURIAN Contact
Menu
Penetration testing
  • Penetration testing services
  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation
Security assurance
  • Security assurance and compliance services
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
Managed security
  • Managed security services
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring
  • All services
  • Industries
  • How we work
  • About
  • Blog
Call 1300 AURIAN Contact
  1. Services
  2. Security assurance
  3. Essential Eight assessment

Security assurance

Essential Eight assessment

We assess your maturity against all eight strategies with evidence from your systems, not answers to a questionnaire.

Scope a test Call 1300 AURIAN

Who this is for

  • You are in, or supply, government

    Councils, government agencies and their suppliers are measured against the Essential Eight, and you need to know where you stand and what to fix.

  • A board or auditor has asked for your maturity level

    Schools, not-for-profits and businesses increasingly report an Essential Eight maturity level, and it needs to be defensible.

  • Your insurer references the Essential Eight

    Cyber insurance questionnaires ask which strategies you have implemented and to what level, and a real assessment answers them honestly.

What our Essential Eight assessment covers

Internet Web application API Perimeter Cloud tenancy Email Office network Workstation Identity Wireless Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: CHECKS INCLUDE Application control bypass attempts Office macro and user application hardening Patch verification on workstations Browser and PDF reader hardening IDENTITY: CHECKS INCLUDE Multi-factor authentication coverage and strength Restriction and separation of administrative privileges Privileged account hygiene WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: CHECKS INCLUDE Patch verification on servers and internet-facing services Regular backups, with restoration tested Application control on servers Internet Web application Perimeter API Email Cloud tenancy Office network Workstation Wireless Identity Crown jewels Servers INTERNET: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. WEB APPLICATION: NOT IN SCOPE HERE Covered by web application penetration testing. Click to open that service. PERIMETER: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. API: NOT IN SCOPE HERE Covered by API penetration testing. Click to open that service. EMAIL: NOT IN SCOPE HERE Covered by external network penetration testing. Click to open that service. CLOUD TENANCY: NOT IN SCOPE HERE Covered by cloud security assessment. Click to open that service. OFFICE NETWORK: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. WORKSTATION: CHECKS INCLUDE Application control bypass attempts Office macro and user application hardening Patch verification on workstations Browser and PDF reader hardening WIRELESS: NOT IN SCOPE HERE Covered by wireless penetration testing. Click to open that service. IDENTITY: CHECKS INCLUDE Multi-factor authentication coverage and strength Restriction and separation of administrative privileges Privileged account hygiene CROWN JEWELS: NOT IN SCOPE HERE Covered by internal network penetration testing. Click to open that service. SERVERS: CHECKS INCLUDE Patch verification on servers and internet-facing services Regular backups, with restoration tested Application control on servers

We assess all eight mitigation strategies against the ASD Maturity Model, testing controls rather than reading policy, and rate each one from Maturity Level Zero to Three.

  • Application control, tested by attempting to execute unapproved code
  • Patch applications, verified against the versions actually deployed
  • Configure Microsoft Office macro settings, tested with real macro-bearing files
  • User application hardening, including browsers, and the settings enforced
  • Restrict administrative privileges, examined across accounts and access
  • Patch operating systems, verified against deployed builds and timeframes
  • Multi-factor authentication, tested for coverage and for bypass
  • Regular backups, examined for coverage, isolation and tested restoration

How we test it

The Essential Eight is the yardstick Australian organisations are measured by in government, its supply chain, education and the not-for-profit sector, and increasingly by insurers everywhere else. An Aurian Essential Eight assessment rates your maturity against all eight strategies using the ASD Maturity Model, and it does so by testing the controls rather than asking whether they exist. That distinction is the whole point: a questionnaire captures intentions, while an assessment captures what is actually enforced when someone tries to get past it.

So we test. For application control, a consultant attempts to run unapproved executables and scripts from user-writable locations. For macros, we send real macro-bearing documents and see what runs. For patching, we check the versions actually deployed against the timeframes the model requires. For multi-factor authentication, we test coverage and look for the exclusions and bypasses a targeted attacker would use. Configuration evidence supports the ratings, but the ratings rest on what the controls do under test.

The result is defensible. Every strategy carries a maturity rating from Level Zero to Three with the evidence behind it, so it stands up to an auditor, a board or an insurer. Alongside the ratings you receive a gap analysis and, most usefully, a prioritised uplift roadmap ordered by how much risk each step removes for the effort it takes. Where you want help implementing the roadmap, our remediation support service can carry it through and retest the result.

Standards ASD Essential Eight Maturity Model, ASD Information Security Manual, CIS Benchmarks

  1. 01 Scoping

    We agree the target maturity level and the systems in scope, and set up the read access and the evidence sessions we will need.

  2. 02 Evidence and testing

    We test controls directly, attempting to run unapproved applications and macros, checking patch levels and probing multi-factor coverage, alongside configuration evidence.

  3. 03 Rating

    We rate each strategy against the maturity model, with the evidence behind every rating, so the result is defensible to an auditor.

  4. 04 Roadmap

    We deliver a prioritised uplift roadmap, ordered by risk reduction and effort, so you know what to do first.

What you receive

Every finding in an Aurian report looks like this: what we found, the evidence, what it means for you, and what to change.

High AUR-2026-014 Sample finding, fictional environment

Application control absent, allowing arbitrary executables to run

Affected asset
Standard operating environment, staff workstations
Rating
High Likely 4 × High 4 = 16

Description

Application control is not enforced on staff workstations. A standard user can download and run an arbitrary executable from their profile directory, which means the first mitigation strategy, and the one that stops most commodity malware, provides no protection. This holds the environment below Maturity Level One for this strategy.

Evidence

C:\> whoami
corp\a.nguyen        # standard user, not admin
C:\> copy \\test\share\notmalware.exe %TEMP%\
C:\> %TEMP%\notmalware.exe
[+] Executed from user-writable path; no policy blocked it

A standard user ran an unapproved executable from a writable directory with nothing to stop it.

Impact

Most commodity malware and initial-access tooling runs exactly this way, as an executable from a user-writable path. Without application control, a single phishing click can run whatever it downloads. Application control is the strategy ASD lists first because it closes this door, and here it is open.

Remediation

Implement application control in audit mode first to understand what runs legitimately, then move to enforcement, allowing only approved executables, scripts and installers from trusted locations. Windows Defender Application Control is available on every supported edition of Windows, and AppLocker on the Enterprise and Education editions, so this rarely needs new licensing.

References

  • ASD, Essential Eight Maturity Model
  • ASD, implementing application control
  • Executive summary with an overall position and the headline gaps, for the board
  • A maturity rating for each of the eight strategies, with the evidence behind it
  • A gap analysis showing what stands between you and the target level
  • A prioritised uplift roadmap, ordered by risk reduction and effort
  • A debrief call to walk your team through the ratings and the roadmap

Common findings

What this kind of engagement typically surfaces, so you can recognise your own environment.

  • Application control not enforced

    The first strategy is missing or in audit mode only, so unapproved code runs freely, which is where most incidents begin.

  • Macros unrestricted

    Office macros allowed to run from the internet or without signing, a favoured delivery route for malware.

  • Slow patching

    Operating systems and applications patched well outside the timeframes the model requires, leaving known weaknesses exposed.

  • Broad administrative privileges

    Too many privileged accounts, administrators browsing the web and reading mail, and no separation of privileged and daily-use accounts.

  • Incomplete multi-factor authentication

    Multi-factor authentication on some systems but not all, or with exclusions that a targeted attacker would use.

  • Untested backups

    Backups that exist but are not isolated from the network, or have never been restored, so their value in an incident is unproven.

Frequently asked questions

Is this the same as an audit or an IRAP assessment?

It is an independent assessment against the Essential Eight Maturity Model, with evidence gathered by testing controls rather than reading policy. It is not an IRAP assessment.

Why test controls rather than use a questionnaire?

Because a questionnaire records what people believe is in place, and an assessment records what is actually enforced. We attempt to run unapproved applications and macros, check the patch levels on real machines, and probe multi-factor coverage, so the rating reflects reality.

What maturity level should we aim for?

It depends on your risk and your obligations. Many organisations target Maturity Level Two; some in government supply chains are required to reach it. We assess against the level you nominate and show the gap to the next one.

How much of our team's time does it take?

A kick-off session, read access to the systems in scope, and a few hours across the engagement to provide evidence and answer questions. We send the list at scoping so nothing is a surprise.

What do we get at the end?

A maturity rating per strategy with the evidence behind it, a gap analysis, and a prioritised roadmap ordered by risk reduction and effort, so you can act on the findings rather than just file them.

Related services

Configuration review and benchmarking

Security configuration review of firewalls, servers, endpoints, network devices and Microsoft 365 against CIS Benchmarks, with the exact settings to change.

Internal network penetration testing

Internal penetration testing from a foothold on your network: Active Directory attack paths, credential hygiene and segmentation, tested to domain admin.

Remediation support and retesting

Penetration test remediation support and retesting: hands-on help closing findings, sessions with your engineers or MSP, and a formal retest and report.

Security assurance and compliance services

Scope a test with a senior consultant

Tell us what you need to know about your environment. We reply within one business day.

Scope a test Call 1300 AURIAN

Aurian Security is an Australian penetration testing and security assurance firm. Senior consultants perform every engagement, for clients across the country.

Penetration testing

  • External network penetration testing
  • Internal network penetration testing
  • Web application penetration testing
  • API penetration testing
  • Mobile application penetration testing
  • Wireless penetration testing
  • Cloud security assessment
  • Social engineering and phishing simulation

Assurance and managed

  • Security assurance
  • Essential Eight assessment
  • Configuration review and benchmarking
  • Remediation support and retesting
  • Managed security
  • Vulnerability management
  • Continuous application scanning
  • SIEM monitoring
  • EDR monitoring

Company

  • About Aurian
  • How we work
  • Industries
  • Blog
  • Contact
  • Privacy policy
526/368 Sussex St, Sydney NSW 2000 1300 AURIAN (1300 287 426) sales@aurian.com.au

© 2026 Aurian Security Pty Ltd. ACN 639 930 528.

This site is static, loads no third-party trackers, and publishes a security.txt.