Cyber risk management platform
See your cyber risk clearly.
Cyber Guys brings assessments, staff training, phishing simulations, security actions and evidence together in one cyber risk management platform.
Built in Australia for businesses and the IT providers that support them.
Cyber readiness
+764/ 100
Essential Eight
ML1
Training passed
94%
Security actions
- Enforce MFA on remote accessAwaiting approval
- Test the backup restoreAwaiting approval
- Separate admin accountsRisk accepted
Simulation click rate
11%
Evidence verified — ready for your insurer
Your entire cybersecurity program. One place.
Assess technical controls. Train your people. Test their readiness. Assign improvements. Record decisions. Produce evidence.
Find out where you actually stand.
“Multi-factor authentication is not enforced for remote access.” Found against the Essential Eight, mapped to four other frameworks you hold.
Assess in detailCybersecurity is scattered.
Assessments live in spreadsheets. Recommendations disappear into email. Training and phishing results sit in separate systems. Important decisions are rarely recorded.
Cyber Guys brings the entire program together.
One platform
- Assessment spreadsheet
- Staff training portal
- Phishing report
- IT provider email
- Insurance questionnaire
- Unapproved recommendation
Know where you stand.
Assess your organisation against recognised cybersecurity, privacy, insurance and AI-risk frameworks — with the evidence attached to each answer.
- Controls in plain English, each stating the evidence it expects
- Maturity assessed per strategy, constrained by the weakest — never averaged
- Framework coverage and gaps recalculated as you answer
Overall maturity
Maturity Level 0
Constrained by the weakest strategy, never averaged.
- Multi-factor authenticationML2Verified
- Patch applicationsML2Verified
- Restrict admin privilegesML1Needs review
- Regular backupsML1Not attached
- Office macro settingsML0Not attached
Build better judgement.
Deliver scenario-based cyber and responsible-AI training for staff, managers and owners — measured on the decision they make, not on reaching the last page.
- Workplace scenarios with an immediate explanation of why an answer was wrong
- Written for the role: a payroll officer is targeted as payroll first
- A quiz with a pass mark, graded server-side, and a verifiable certificate
Decision
A supplier emails to say their bank details have changed, and the invoice is due today.
- Pay it — the email thread looks right
- Reply to the email and ask them to confirm
- Call the number you already had on file
Why: replying to the thread reaches whoever sent it. Verifying on a number you already held is the only step that survives a compromised mailbox.
Test real behaviour safely.
Run authorised phishing simulations and automatically assign targeted follow-up training to the people who need it.
- Only ever sent to your own people, on verified domains
- No real credentials collected, and distressing scenarios blocked outright
- Report rate rising matters more than click rate falling — both are tracked
Reported
61%
Clicked
9%
Submitted
2%
Across four campaigns
Reported Clicked
Turn gaps into action.
Convert assessment findings into clear recommendations with an owner, a priority, a due date and a recorded decision.
- Approved, assigned, quoted, deferred, completed — or declined with the risk accepted
- A decline is a dated, attributed, immutable record with a review date
- No uncertainty about whether something was ignored, declined or lost in an email
Identified
Recommended
Approved
Completed
- Owner
- Morgan — IT provider
- Priority
- High
- Due
- In 14 days
- Decided by
- Practice manager
Approved on the 3rd. The wording shown at the time is stored with the decision.
Show what changed.
Produce evidence and reports for insurers, clients, boards, auditors and procurement teams — built from records rather than recollection.
- Point-in-time reports that do not change retrospectively
- Every figure traceable to a dated assessment, decision or completion
- Certificates anyone can verify with a code
Progress since March
Point in time- Essential Eight controls met42% → 71%
- Required training passed55% → 94%
- Simulated phishing reported18% → 61%
- Actions with a named owner40% → 96%
Every figure traces to a dated record — assessments, decisions, completions and evidence.
Framework breadth
One control library. Multiple frameworks.
Collect evidence once and use it across the standards and requirements relevant to your organisation.
One control
Multi-factor authentication is enforced for all users
Answered once, with the evidence attached once.
Essential Eight
Multi-factor authentication
NIST CSF 2.0
PR.AA-03
ISO/IEC 27001
A.5.17
CIS Controls v8.1
6.3, 6.4, 6.5
Cyber-insurance readiness
question 1
…and every other framework you hold that asks the same question.
Answer once. Map it everywhere it applies.
Also supported
ASD Essential Eight Maturity Model
Australian- Requirements assessed
- 24
- Covered by mapped controls
- 24
Australian Privacy Principles and Notifiable Data Breaches
Australian- Requirements assessed
- 21
- Covered by mapped controls
- 21
ASD Information Security Manual
Australian- Requirements assessed
- 12
- Covered by mapped controls
- 12
APRA Prudential Standard CPS 234 Information Security
Australian- Requirements assessed
- 11
- Covered by mapped controls
- 9
Cyber Insurance Readiness
Australian- Requirements assessed
- 10
- Covered by mapped controls
- 10
NIST Cybersecurity Framework 2.0
- Requirements assessed
- 68
- Covered by mapped controls
- 68
CIS Critical Security Controls v8.1
- Requirements assessed
- 55
- Covered by mapped controls
- 55
ISO/IEC 27001:2022 readiness
- Requirements assessed
- 51
- Covered by mapped controls
- 47
PCI DSS v4.0.1 readiness and scope tracking
- Requirements assessed
- 21
- Covered by mapped controls
- 15
NIST AI Risk Management Framework 1.0
- Requirements assessed
- 18
- Covered by mapped controls
- 18
ISO/IEC 42001 AI management system readiness
- Requirements assessed
- 12
- Covered by mapped controls
- 11
ISO/IEC 27701 privacy information management readiness
- Requirements assessed
- 8
- Covered by mapped controls
- 8
Software first.
Cyber Guys is a self-guided cyber risk management platform your organisation can use directly or through its existing IT provider. It provides the assessments, workflows, training, simulations and reporting needed to run an ongoing cybersecurity program.
Optional advisory or implementation support is available only when requested.
- 01
Use it directly
Your organisation manages its own cybersecurity program.
- 02
Use it with your IT provider
Your existing provider completes technical actions while you retain visibility and control.
- 03
Deliver it through your MSP
IT providers use Cyber Guys to operate structured cyber services across their client base.
Built for businesses and IT providers.
See what is protected — and what is not.
Understand your risks, train your people, track improvements and keep the evidence. You see what is being done, what still needs attention and what needs your approval.
Explore Cyber Guys for businessBuilt for the risks Australian businesses face.
- Australian owned and operated
- Australian English and terminology
- Essential Eight and ASD context
- Australian privacy considerations
- Cyber-insurance readiness
- Local business and scam scenarios
- Pricing in Australian dollars
Stop guessing about your cybersecurity.
See where your risks sit, what needs to happen next and whether your organisation is improving.
Assess. Train. Simulate. Improve. Prove.