The platform
One system for assessing, training, testing, improving and proving.
Cyber Guys works the same way whether you run it for your own business or across a book of clients. The difference is scale and branding, not a different product.
- Authenticated, tenant-isolated and audited
- Australian frameworks and Australian English throughout
- Controlled PDF exports from completed work only
- Co-branded or fully white-labelled by plan
Where this business currently stands
- Essential Eight maturityLevel 1 → 2
- Controls implemented41 of 65
- Training completion92%
- Last simulation click rate4%
- Open recommendations6
- Risks formally accepted2
The same view an MSP sees per client, and a business sees for itself.
Assess. Train. Simulate. Improve. Prove.
Five stages, one connected record.
Each stage feeds the next. An assessment gap becomes a recommendation. A simulation failure becomes a training assignment. Both end up in the same evidence trail.
- Step 1
Assess
Find out where you actually stand.
Work through a recognised framework — the Essential Eight, NIST CSF 2.0, ISO 27001 readiness or your insurer’s questionnaire — and get a gap list instead of a feeling.
Learn more - Step 2
Train
Teach the people who make the decisions.
Scenario-based modules for staff, managers and owners, written in plain English and measured on judgement rather than on whether somebody reached the last page.
Learn more - Step 3
Simulate
Test readiness safely, with permission.
Authorised phishing simulations using approved templates, with follow-up training assigned automatically to the people who need it.
Learn more - Step 4
Improve
Turn findings into decisions somebody owns.
Gaps become prioritised recommendations in business language, each with an owner, a due date and a recorded answer — approved, deferred, or declined with the risk formally accepted.
Learn more - Step 5
Prove
Show the improvement to whoever asks.
Evidence records, verifiable certificates and reports that answer an insurer, a board, a major client or an auditor without anybody rebuilding the story from email.
Learn more
Inside the platform
What you actually get.
Everything below is an authenticated in-app workflow. Anything not yet generally available carries a label saying so.
Cyber-risk assessments
Structured assessment against 13 recognised frameworks, producing a gap list with maturity levels rather than a score you cannot act on.
Learn moreFramework benchmarking
65 master controls and 504 cross-framework mappings, so one answer counts everywhere it applies.
Learn moreStaff and manager training
Scenario-based modules that measure judgement, with separate tracks for the people who click links and the people who approve budgets.
Learn moreAI-risk training
Responsible AI use at work, covering what can be put into AI tools, verifying output, and deepfake and voice-cloning risk. A 14-module curriculum is in development.
Learn morePhishing simulations
14 authorised simulation scenario types with 10 pre-approved templates, safety scanning, and follow-up training assigned automatically.
Learn moreHuman-risk insights
In developmentA behaviour-only model that identifies where education, process change or a technical control is needed — never a punitive employee score.
Learn moreRemediation planning
Gaps become prioritised recommendations written in business language, with urgency, effort, indicative cost and a named owner.
Learn moreRecorded security decisions
Approve, request a quote, ask a question, defer or decline. Declining produces a dated, attributed, immutable risk acceptance with a review date.
Learn moreControl ownership
A plain-English responsibility matrix splitting what the IT provider owns from what the business owns — the document that ends “I thought you did that”.
Learn moreProgress tracking
Assessment history, maturity movement, training completion and simulation trend over time, so improvement is visible rather than asserted.
Learn moreReporting and evidence
Controlled PDF exports from completed work — certificates, action plans, management reports, evidence packs and risk acceptance records.
Learn moreMSP client management
Client organisations with their own dashboards, portals, branding and assessment history — and an access chokepoint that keeps every tenant separate.
Learn more- Frameworks you can assess against
- 13
- Master controls
- 65
- Cross-framework mappings
- 504
- Simulation scenario types
- 14
For a business
Run it for yourself.
You get the assessment, the training, the simulations and the evidence, without needing an IT provider to operate it for you.
- Assess your own organisation against a framework you choose.
- Assign training to staff and managers, and track who has actually completed it.
- Run phishing simulations against your own people, with your authorisation.
- Give each gap an internal owner and a due date.
- Export a management report for your board, insurer or largest client.
For an IT provider
Run it across a client base.
The same workflows, multiplied — plus the client-facing layer that turns a technical finding into a recorded business decision.
- Assess every client against the framework that suits them.
- Publish recommendations to a client portal in your own branding.
- Capture each client’s answer, including the risks they choose to accept.
- Run simulations and assign training across the whole book.
- Produce a QBR report per client from work that already happened.
Showing your work
Access for the people who ask for evidence.
An insurer, a board, a major client or an auditor rarely needs a login. They need one report, scoped and time-limited.
Secure share links
Time-limited, view-capped links for sharing a specific report with somebody who does not need an account. Available from MSP Growth.
Client portal
The client-facing view of their own action plan, decisions and training. Included with every MSP plan.
External auditor portal
MSP ProRead-only access scoped to a time-boxed engagement, with a downloadable evidence pack. Packaged on MSP Pro.
Content protection
Deliberately not a template extraction tool.
If this platform could be emptied into a folder of Word documents in an afternoon, it would have no ongoing value — to us or to you. So it cannot be.
- Substantive content requires an authenticated, paid account.
- Training and explainer pages are never publicly indexable.
- No editable Word or document exports, ever.
- No bulk library export and no template extraction endpoint.
- PDF exports are outputs of completed workflows only.
- Every export is logged with user, organisation, time and resource.
- Demo accounts get watermarked exports and a reduced content slice.
- Secure share links expire and have a view limit.
Security foundations
Multi-tenant from the first line of schema.
Tenancy is not a filter applied at the end. Every scoped record carries an organisation id, and access resolves through a single guard.
- One chokepoint decides whether a caller may reach an organisation.
- MSPs can reach their own client organisations and nothing else.
- Role-based permissions on top of plan-level feature flags.
- Immutable risk acceptance records with versioned corrections.
- Audit logging on every consequential action.
- Rate limiting on login, exports, decisions and quiz submission.
- Quizzes are graded server-side; answers never reach the browser first.
- No client passwords, secrets or credentials stored anywhere.
Full detail, including what is not yet implemented, in the security overview.
See the whole loop in fifteen minutes.
An assessment, the gaps it produces, a simulation result, the action plan, and the report at the end of it.