Incident response · Managed security
We know what happens when businesses get hacked. We built Fortify so it doesn’t happen to yours.
IronSights is an Australian incident response team. Fortify is our managed security plan, shaped by what we see on real incidents: the way in, the gap that let it happen, and the control that would have stopped it. Sydney-based, answered around the clock by a person.
Under attack right now? A responder is on call1300 004 766
Trusted by organisations across Australia
We partner with organisations in a wide range of industries to reduce risk, strengthen security and build resilience.
Mortgage
. Settlement and loan emails are exactly what invoice fraudsters wait for.
brokersLaw
. Trust accounts and conveyancing emails make firms a favourite for payment redirection.
firmsMedical
. Health records bring the Notifiable Data Breaches scheme into play whatever the size of the practice.
specialist groupIndependent
. Student records and parent payments, looked after by an IT team that is usually one or two people.
schoolColleges &
. Thousands of accounts that turn over with every intake, and each one is a way in.
higher educationAnimation
. Unreleased work and render pipelines that cannot sit idle for a week while files are restored.
studioFinancial
. Client money, and a regulator who will ask exactly how it was protected.
services firmTechnology
. Remote access into every client they support, which makes them a route to everyone else.
servicesNFP
. Donor data on tight budgets, often with volunteers sharing accounts.
organisationNDIS &
. Participant records that are some of the most sensitive data any organisation holds.
disability servicesASX listed
. Continuous disclosure means a serious breach can quickly become a market announcement.
companies- Your sector?See industries→
What we see when the call comes
Most breaches aren't sophisticated. They walk in through a gap.
Attackers don't need zero-days. On the incidents we work, the same few gaps show up every time. Fortify exists to close them before the call.
Remote access without MFA
A VPN or remote desktop gateway with a password and no second factor is the front door in most Australian ransomware cases we see. One sprayed password, and the attacker is inside with a legitimate login.
Nobody watching the endpoint
Attackers sit on a server for days before encryption. Without detection on the device, the first sign is the ransom note.
A mailbox nobody is looking at
Business email compromise starts with one account. The attacker reads, waits, and sends the invoice from inside your own domain.
Anatomy of an incident
How a typical intrusion plays out, and where Fortify stops it.
Most of the ransomware cases we work start the same way. Someone guesses a password on a remote access gateway, sits quietly on the network for a week or two, then encrypts everything. Below is that attack as we usually find it, then again against a business running Fortify.
An attacker guesses thousands of passwords against a remote access gateway. Without multi-factor authentication one password works. Nobody is watching the file server or the finance mailbox, so the attacker waits for eleven days, sends a fake invoice from the business's own domain, then encrypts the business data. The same attack is then replayed with Fortify in place: phishing-resistant MFA refuses every attempt, including the correct password, an alert reaches the IronSights team, and the data is untouched.
The numbers and timings are illustrative. The sequence is the one we see most often on Australian incidents.
Built by responders
Security is not a project. It's a process.
The four pillars are what we wish every business we respond to had in place. Every cycle closes a gap we have seen exploited, raises Essential Eight maturity, and produces evidence your board can read.
Monitor
Identify threats
Detection across endpoints, identities, email, and cloud, tuned by the team that knows what an intrusion looks like at hour one.
Respond
Contain incidents
The same responders who handle and email compromise for Australian businesses, already on your account.
Improve
Reduce risk
Monthly hardening, prioritised by what is being exploited in Australia this quarter, not by a generic checklist.
Educate
Build awareness
simulations and short training built from the lures that actually landed.
Built on platforms you trust
The tools your business already uses, properly deployed.
Microsoft 365 Security
Secure identities, protect data, and reduce risk across the platform your business already runs on.
- Tenant hardening and Conditional Access
- Microsoft Secure Score uplift
- Continuous Defender coverage
- Identity and data protection
Microsoft Defender
Advanced endpoint protection, threat detection, and automated response.
Learn more→UniFi Protect CCTV
Enterprise video surveillance, professionally installed and managed.
Learn more→UniFi Access Control
Smart door access for modern Australian workplaces. Reliable and scalable.
Learn more→What clients say
Real voices from Australian businesses we protect.
“We engaged IronSights to help us with an Akira ransomware incident that impacted one of our clients. They were great to work with and jumped in quickly to help us investigate what had happened and get the client back up and running. Ryan and the team worked well alongside our engineers and kept things moving during a pretty stressful incident. Would definitely recommend them to other MSPs needing an extra set of hands or specialist help with ransomware recovery.”
Brett
Director
Managed Service Provider
“We recently worked with IronSights in relation to our Financial Services AFSL cybersecurity audit requirements and were extremely impressed with their professionalism and expertise. The team provided clear guidance throughout the process, assisted us with the Microsoft claim application, and ensured everything was completed smoothly and efficiently. Their knowledge of cybersecurity compliance and AFSL audit requirements gave us confidence that our business was meeting the necessary standards.”
Addy
Director
AFSL Financial Services Firm
“Not all heroes wear a cape. These guys dropped what they were doing and were on the next flight to not only save our butt but crucially recover forensic IT info about our ransomware attack and help us get back up. We can’t praise Ryan and team highly enough for their 6 star effort.”
Stephen
Systems Admin
Private College
“We’re a New Zealand tech company and needed some help on the ground in Australia. IronSights has been great to work with. The team is approachable, knows their stuff and gets things done without overcomplicating everything. It’s been good having a local partner we can rely on when we need support or advice.”
Harry
Director
New Zealand Technology Company
“We’ve had a great experience working with IronSights. As an allied health practice, we need our systems to be reliable and secure, and the team has been fantastic. They’re quick to respond, easy to deal with and always explain things clearly. It’s reassuring knowing our IT and cyber security are in good hands.”
Hollie
Mental Health Services
Allied Health Practice
“We weren’t looking for fear or complexity, we just wanted a clear picture of where we stood and what to focus on. IronSights delivered that. The advice was direct, practical, and aligned to how we work. It’s helped us move forward with confidence.”
Akram
Managing Director
Student Immigration Agency
“We engaged IronSights to help secure our Microsoft 365 environment, and the results have been outstanding. From start to finish, the process was handled with professionalism, clear communication, and deep technical expertise. The assessment gave us clarity on our risks and a practical path forward.”
Andrew
Technical Architect & CTO
Technology Consultancy
“IronSights secured our IT systems and protected sensitive information. Their skilled team delivered excellent cybersecurity and support that exceeded expectations. Their quick, proactive approach lets us focus on our business with confidence. I highly recommend IronSights for reliable IT solutions.”
Damien
Chief Executive Officer
Higher Education Provider
“When my Instagram got taken over, I honestly thought it was gone for good. I spoke to a few people before IronSights and nobody could get it back. The team jumped in, worked through the recovery properly, and got me back into the account. They made a stressful situation way easier and actually knew what they were doing.”
Daniel
Content Creator
Independent content creator
“IronSights have become an extension of our IT team, not just for this project but ongoing. They gave us extra support when we needed it, handled every technical detail, and made sure every workstation was connected and ready. Their planning and care turned a complex move into a smooth transition.”
Kareem
Head of Information and Technology
Animation Studio
“I’m a chippy, so I’m on the tools all day. I don’t have time to mess around with tech stuff. These guys have been a lifesaver. They keep my emails sorted, devices running smooth, and if anything goes pear-shaped, they fix it fast. No stress, no mucking around. Makes my life way easier. Highly rate them.”
Maher
Carpenter
Residential Construction
“What I appreciate most is that I’m not just fixing things anymore. We’ve got structure, we’ve got support, and we’ve got a plan. I know we’re protected, I know where we’re heading, and I know I’ve got the right people helping us get there.”
Susan
Head of Partnerships & Operations
Social Services
Free assessment
Where do you stand against the Essential Eight?
Answer a short set of questions and get an honest read on your maturity across all eight controls, plus where to focus first. No signup, results in about five minutes.
Start the assessmentLive threat intelligence · Updated weekly
View the trackerSecurity key store
The keys that replace SMS codes, sold by the people who deploy them.
Microsoft makes passkeys the default Entra sign-in from September 2026 and retires SMS and voice codes on 1 February 2027. We now stock YubiKeys in Australia, with straight advice on which key fits and guides to set them up.
Advice before checkout
Every product page says who the key suits and who it does not. The buying guides answer the questions people actually have.
Posted from Sydney
GST-inclusive pricing, a tax invoice with every order, and 30-day returns alongside your ACL rights.
Backed by the practice
Buy the hardware and take it from there, or have us run the enrolment and the Conditional Access policy behind it.
Based in Sydney
A cyber security company in Sydney, with responders who can be on-site.
Our team is based in the Sydney CBD. Most of the work is remote, for businesses across Greater Sydney and the rest of Australia. When an incident or an install needs someone standing at the hardware, we come to you.
Answered 24/7 by a person
In business hours the team picks up. After hours an answering service takes your details and calls us, and a responder rings you back.
Certified and licensed
ISO 27001 and ISO 9001 certified. NSW Master Security Licence 000109187 covers our CCTV and door access work.
Insights
Practical security thinking for Australian businesses.
thought leadership
OpenAI made the hardware key compulsory for its cyber models
Since 1 September, researchers in OpenAI's Trusted Access for Cyber programme have needed a hardware-backed passkey to keep its most capable security models. Why OpenAI did it, what the setting costs you in recovery, and what to do about the ChatGPT accounts inside your own business.
11 Nov 2026 · IronSights Editorial
compliance
The draft PEXA cyber rules: what ARNECC's Participation Rules version 8 mean for your practice
ARNECC's draft version 8 of the Model Participation Rules would make multi-factor authentication, annual cyber training for all staff and $50,000 of cyber insurance compulsory for every subscriber who settles electronically. It also names three cyber security frameworks, SMB1001 among them, that act as a safe harbour. What the draft says, what is still unconfirmed, and what a conveyancing practice can do now.
19 Oct 2026 · IronSights Editorial
compliance
SMB1001 vs Essential Eight vs ASD Essentials: which one should your business work to now?
ASD published the Essentials series on 15 October 2026 as the successor to the Essential Eight. ASD wrote it mainly for government and large organisations, and it comes with no certificate. Here is how it compares with the Essential Eight and SMB1001, and which one a small or mid-sized Australian business should be working to now.
17 Oct 2026 · IronSights Editorial
Free tool · No signup to run
Is your email domain exposed to spoofing?
Check your SPF, DKIM, and DMARC records in seconds and see your domain's email security score instantly. It's how business email compromise and invoice fraud start.
See the whole table
We'll show you every angle, then help you play the right shot.
A good player reads the whole table before they take a shot. A review does the same for your security. We map where your risks sit and what to deal with first, so every move after that is deliberate rather than a guess.
- A free hour with our team on your environment
- Your highest-priority security gaps
- A clear remediation roadmap
- The right service for your situation