Siege Cyber

What Siege Cyber does

Siege Cyber is an Australian-owned cybersecurity consultancy founded in 2019 by Peter Stewart (CISSP MAICD) and headquartered in Brisbane. The company delivers two integrated service lines to Australian businesses: penetration testing (offensive security services including web application, external/internal network, mobile, and cloud testing, plus red team, phishing simulation, and vulnerability assessment) and compliance certification across ISO 27001, SOC 2, DISP, APRA CPS 234, ASD Essential 8, SOCI, and Right Fit For Risk frameworks. Its primary customer segments are Australian SaaS and technology companies pursuing global-market compliance, defence industry contractors seeking DISP membership, managed service providers requiring white-label security partners, and general mid-market Australian businesses across healthcare, mining, manufacturing, finance, and legal verticals.

The technical stack combines a proprietary Siege Cyber Compliance Platform with integrations into leading compliance automation platforms Vanta and Drata, alongside manual penetration testing methodologies delivered by certified specialists. Service delivery is supported by advisory offerings including Virtual CISO, incident response planning, tabletop exercises, and policy development, packaged as either fixed-price monthly subscriptions or project-based engagements. The company claims a 100% audit pass rate across ISO 27001 and SOC 2 engagements and reports having delivered hundreds of penetration tests to Australian organisations.

Siege Cyber generates revenue through two primary streams: 12-month fixed-price compliance subscriptions priced between $2,450 and $4,950 per month, and project-based penetration testing fees ranging from $3,400 to $16,500. Go-to-market combines direct enterprise sales with Australian-based consultants, channel partnerships with MSPs and IT providers who maintain client relationships while Siege Cyber delivers technical work, official partner relationships with Vanta and Drata for co-marketing, and content-led marketing via SEO-optimised blog posts, free discovery calls, and downloadable resources. The company is CREST certified, holds SMB1001 Level 3 Gold certification (2023), and was an ACSA25 finalist in the Cyber Security Consulting Business of the Year SME category.

Name

Siege Cyber

Legal name

Siege Cyber

Website

https://siegecyber.com.au

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

1–10 employees

Short description

Siege Cyber is an Australian cybersecurity consultancy that delivers penetration testing and compliance certification services, including ISO 27001, SOC 2, and DISP, to Australian SaaS companies, defence contractors, and mid-market enterprises through fixed-price subscription packages and project-based engagements.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting

akta.pro primary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

akta.pro secondary industries

Penetration Testing & Red Teaming (BPAKADAE), Threat Intelligence, Hunting & Adversary Emulation (BPAKAHAE)

Keywords

• Penetration testing services
• Compliance certification consulting
• Vulnerability assessment services
• Cybersecurity advisory services
• ISO 27001 SOC 2 compliance

Headquarters

HQ city

Brisbane

HQ country

Australia

HQ region

Oceania

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Others

Revenue model

1. Compliance Certification Subscriptions: Fixed monthly subscription packages over 12 months for SOC 2, ISO 27001, and DISP certification, providing ongoing compliance support, policy development, training, and audit preparation.
2. Penetration Testing Services: One-time project fees for penetration testing engagements including web application, external network, internal network, mobile, and custom testing packages.

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels5 records

Core offering

Siege Cyber is an Australian-owned cybersecurity consultancy that delivers penetration testing (web, network, mobile, cloud, red team, phishing) and compliance certification services (SOC 2, ISO 27001, DISP, APRA CPS 234, ASD Essential 8, SOCI, RFFR) to Australian businesses. Work is delivered in-house by CREST-accredited, CISSP-certified Australian specialists, sold either as fixed-price 12-month compliance subscriptions or as unit-priced penetration testing engagements, supported by the proprietary Siege Cyber Compliance Platform and co-delivery with Vanta and Drata.

Product overview

Siege Cyber is an Australian cybersecurity consultancy offering two core service lines: Penetration Testing (offensive security services) and Compliance Certification (ISO 27001, SOC 2, and other frameworks). Their penetration testing portfolio includes web application, external/internal network, mobile, and custom testing packages, complemented by red team, phishing simulation, vulnerability assessment, and security awareness training. Their compliance services span multiple frameworks including ISO 27001, SOC 2, APRA CPS 234, ASD Essential 8, SOCI, DISP, and Right Fit For Risk, supported by advisory services such as virtual CISO, incident response planning, and policy development. Services are delivered through fixed-price compliance packages (Rapid Certification at $3,750/month, Ongoing Maintenance at $2,450/month, DISP Certify at $4,950/month) and priced penetration testing engagements, with all work delivered by Australian-based certified specialists.

Differentiator

Problem solved

Functional benefit

Products and services

• Penetration Testing Offensive security testing service delivered by CREST-accredited certified penetration testers that identifies vulnerabilities in web applications, networks, mobile apps, and infrastructure before attackers can exploit them. Includes clear, prioritised, actionable remediation reports.
• Vulnerability Assessment Structured assessment service that identifies and evaluates security weaknesses across systems and networks, producing prioritised findings and remediation recommendations for Australian businesses.
• Red Team Testing / Attack Simulation Advanced adversary simulation service that emulates real-world attack techniques to test an organisation's detection, response, and resilience capabilities against skilled threat actors.
• Phishing Simulation Employee security testing service that simulates phishing attacks to assess and improve staff awareness and organisational resilience against social engineering threats.
• Continuous Vulnerability Scanning Ongoing scanning service that continuously monitors systems and networks for new vulnerabilities and provides real-time alerting and reporting.
• Cloud Security Assessment Cloud security review service evaluating infrastructure security across AWS, Azure, and Google Cloud, identifying misconfigurations, risks, and recommended remediations.
• Firewall Review Security review service assessing firewall configurations, rules, and policies to ensure appropriate network segmentation and access controls.
• Security Awareness Training Staff cybersecurity education service that builds organisational resilience against threats such as phishing and social engineering through targeted training programmes.
• ISO 27001 Compliance Certification Compliance certification service that guides Australian organisations through ISO 27001 information security management system implementation and certification, from gap analysis to audit support, delivered by ISO 27001 implementer-certified consultants.
• SOC 2 Compliance Certification Compliance certification service that helps organisations achieve SOC 2 attestation, including readiness assessment, control design, evidence collection, and audit preparation against the Trust Services Criteria.
• APRA CPS 234 Compliance Compliance service helping Australian Prudential Regulation Authority-regulated entities meet CPS 234 information security obligations, including control design, gap remediation, and audit support.
• ASD Essential 8 Compliance Compliance service that helps Australian organisations implement and assess against ASD Essential Eight mitigation strategies, including maturity level assessments and uplift roadmaps.
• Security of Critical Infrastructure (SOCI) Compliance Compliance service helping organisations meet obligations under the Security of Critical Infrastructure Act 2018, including risk management program requirements.
• Defence Industry Security Program (DISP) Certification Specialised compliance service for Australian defence suppliers seeking DISP membership at Entry Level, Level 1, or Level 2, covering all four security domains (governance, personnel, physical, ICT/cyber) and Essential Eight ML2 requirements.
• Australian Right Fit For Risk (RFFR) Risk assessment and management service aligned with Australian Government risk management frameworks to help organisations implement appropriate security controls.
• Virtual CISO (vCISO) Strategic advisory service providing experienced Chief Information Security Officer expertise on a flexible basis, including security governance, strategy, and board-level reporting.
• Incident Response Planning Planning service that helps organisations develop structured incident response procedures and capabilities for cybersecurity events, aligned with compliance frameworks.
• Cybersecurity Tabletop Exercises Interactive exercise service that simulates cybersecurity incidents to test and improve organisational response procedures and team coordination.
• Cybersecurity Policy Development Documentation service developing security policies including Incident Response Plans (IRP), Business Continuity Plans (BCP), and Disaster Recovery Plans (DRP) aligned with compliance frameworks.
• Rapid Certification Compliance Package Fixed-price 12-month subscription compliance package ($3,750/month) that takes organisations audit-ready for SOC 2 or ISO 27001 in 3-9 months, including customised policies, training, risk assessment, tabletop exercise, internal audit, external penetration testing, free management platform, and ongoing compliance support.
• Ongoing Maintenance Compliance Package Fixed-price 12-month subscription package ($2,450/month) providing continuous single-framework compliance support including security questionnaires, annual tabletop exercise, internal audit, management committee hosting, and free management platform access.
• DISP Certify Compliance Package Fixed-price 12-month subscription package ($4,950/month) covering the full DISP journey for organisations with up to 50 employees at Entry Level, Level 1, or Level 2, including four-domain gap analysis, ISM-aligned security controls, CSO and SO advisory, incident response planning, and Annual Security Report preparation.
• Web Application Penetration Testing Specialised testing service ($5,900-$16,500) for web applications covering authenticated testing, SQL injection, XSS, authentication bypass, API security, and OWASP-aligned testing.
• External Network Penetration Testing Testing service ($3,400-$9,500) covering external IP addresses, external cloud pentesting, Microsoft 365 testing, attack surface reconnaissance, SSL/TLS validation, remote access testing, and open port verification.
• Basic Website Penetration Testing Entry-level testing service ($3,400-$6,500) covering unauthenticated testing, default credential testing, plugin vulnerability scanning, WordPress vulnerabilities, brute-force protection testing, and information disclosure.
• Mobile Application Penetration Testing Mobile security testing service covering insecure data storage, reverse engineering resistance, API endpoint testing, jailbreak/root detection, runtime manipulation testing, code tampering protection, and insecure authentication testing.
• Custom Pentesting Package Tailored testing package combining external, internal, wireless, cloud, hardware, and mobile penetration testing, red teaming, and vulnerability scanning based on client requirements and budget.

Quantifiable outcome

• Get organisations audit-ready in 3-9 months (vs 9-18+ months for competitors)
• +2 more outcomes

Named customers12 records

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

Feature2 records

Partnerships

Four partnerships are on record, tiered core.

• VantacoreTechnology or IntegrationOfficial Vanta partner. Siege Cyber acts as the human expert partner alongside Vanta's compliance automation platform, helping clients configure the platform, interpret results, and prepare for SOC 2 and ISO 27001 audits in the Australian regulatory context.
• DratacoreTechnology or IntegrationOfficial Drata partner. Provides complementary consulting services for organisations using Drata's compliance automation platform, bridging the gap between automated evidence collection and actual audit readiness for Australian businesses.
• MSPs and IT ProviderscoreChannel Partner/ Reseller/ DistributorStrategic channel partnerships with managed service providers and IT providers across Australia. Siege Cyber delivers penetration testing and compliance work while partners maintain client relationships.
• Auditors and Advisory FirmscoreImplementation/ SI/ Consulting PartnerWorks alongside auditors and advisory firms as a trusted execution partner rather than competing. When clients need penetration testing or certification help, Siege Cyber delivers the technical work.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• NetSPI: US-based penetration testing and attack surface management firm with enterprise clients. Comparable on pure-play pentest service depth but at much larger scale and a US enterprise customer mix.
• Sekuro: Australian cybersecurity and compliance consultancy that bundles advisory, managed security, and ISO 27001/SOC 2 readiness with similar fixed-engagement structures. Direct comparable for Australian mid-market compliance buyers.
• Insomnia Security: New Zealand-based penetration testing and red team firm with Australian customers. Provides a comparable boutique offensive security offering in the Australasian SMB and mid-market segment.
• CQR Cybersecurity: Australian cybersecurity firm focused on penetration testing, red teaming, and ISO 27001 advisory. Closely comparable in size, geography, and service mix to Siege Cyber, serving Australian SMB and mid-market clients.
• Bishop Fox: US-based offensive security firm specialising in penetration testing and adversary simulation. Comparable core service line (pentest + red team), though it does not emphasise the compliance certification side that anchors Siege Cyber's revenue.
• ThreatDefence: Australian offensive security firm offering penetration testing, red teaming, and managed security. Direct overlap on Australian pentest engagements targeting mid-market and enterprise customers.
• Coalfire: US-headquartered cybersecurity advisory with deep penetration testing and SOC 2/ISO 27001/CMMC compliance practices. Closely comparable mix of offensive testing plus compliance certification, though serving primarily US enterprise and federal customers.

Broad incumbents

• NCC Group: Global cybersecurity consultancy with strong penetration testing and ISO 27001 assurance practices. Comparable on the compliance-and-pentest service mix, though significantly larger and UK-headquartered with a much broader enterprise footprint.
• CyberCX: Australia's largest pure-play cybersecurity firm offering penetration testing, compliance advisory, SOC and MDR across Australia and New Zealand. Overlaps directly with Siege Cyber on penetration testing and ISO 27001/SOC 2 readiness but at vastly larger scale and broader service portfolio.

Emerging players

• Bugcrowd: Crowdsourced penetration testing and vulnerability disclosure platform with Australian heritage. Competes for the same vulnerability management and pentest budget but delivers via a platform/marketplace model rather than Siege Cyber's fixed-price consultancy model.

Market position

Strengths4 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/siege-cyber

Compliance6 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Siege Cyber