ctrl:cyber

Name

ctrl:cyber

Legal name

CTRL Security Pty Ltd

Website

https://ctrl.co

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

51–100 employees

Ownership category

akta.pro rank

Product category

Managed Cybersecurity Services

NAICS

Investigation and Security Services (5616)

akta.pro primary industry

Security Operations Center (SOC) as a Service (BPAEADAB)

akta.pro secondary industries

Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF), Fraud, Cybercrime Investigations & Brand/Dark Web Monitoring (BPAKAHAO), Web Application Security (WAF, RASP) (HDADACAA)

Keywords

• Managed security services
• Penetration testing services
• Cybersecurity advisory
• Incident response services
• Security operations platform

Headquarters

HQ city

Melbourne Street Station

HQ country

Australia

HQ region

Oceania

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Managed Security Services (ROC+): 24/7 monitoring and threat detection services through the Risk Operations Centre. Subscription-based services providing continuous protection, real-time insights, and incident response capabilities.
2. Penetration Testing: One-time and recurring offensive cybersecurity testing services covering internal networks, external infrastructure, web applications, mobile applications, and social engineering assessments.
3. Governance, Risk & Compliance Advisory: Cyber advisory services including compliance gap analysis, Essential 8 assessments, policy uplift, incident response planning, and third-party risk assessments.
4. Cyber Engineering: Security architecture, cloud and infrastructure solutions, security tooling optimization, and embedded engineering services for organizational uplift.
5. Privacy & AI Governance: Privacy advisory, privacy impact assessments, data ethics assessments, AI governance frameworks, and privacy training services.

Pricing tiers

Go-to-market motion3 records

Distribution channels3 records

Marketing channels6 records

Core offering

ctrl:cyber is an Australian cybersecurity services firm that delivers 24/7 threat monitoring via its Risk Operations Centre (ROC+) backed by the proprietary ROC+ Platform, alongside penetration testing, governance/risk/compliance advisory, cyber engineering, privacy and AI governance, and digital forensics and incident response services. All services are delivered onshore in Australia with full data sovereignty, targeting ASX 100, Fortune 500, government, critical infrastructure, and financial services organisations.

Product overview

ctrl:cyber is an Australian-owned cybersecurity services company offering a portfolio of integrated security services rather than a single software product. The core offering is the ROC+ (Risk Operations Centre) service, which combines 24/7 monitoring with the proprietary ROC+ Platform for real-time threat visibility and interactive reporting. The service portfolio spans offensive security (Penetration Testing with sub-services for internal, external, web application, mobile application, and social engineering testing), advisory services (Governance Risk & Compliance, Cyber Engineering, Privacy, Data Risk, AI Governance, Awareness & Training), and incident response (Digital Forensics & Incident Response). Supporting offerings include a Free Cyber Scan tool and the plain.txt Podcast for industry education. The Cyber Engineering capability was expanded in December 2025 through the acquisition of the former Shelde leadership team, adding security architecture and enterprise integration expertise.

Differentiator

Problem solved

Functional benefit

Brands

• ROC+ Platform: A comprehensive cybersecurity reporting and monitoring platform providing real-time insights, interactive reporting, and threat visualisation for business leaders and security teams.
• plain.txt Podcast

Products and services

• ROC+ Platform A proprietary cybersecurity reporting and monitoring platform that provides real-time visibility into security investigations, threat trends, and risk metrics. Delivers customisable dashboards for executives and security teams with live case tracking and interactive reporting capabilities, designed and hosted in Australia.
• Risk Operations Centre (ROC+) 24/7 threat detection and monitoring service that replaces a traditional SOC with a risk-based approach. Provides continuous monitoring, vulnerability scans, incident response, dark web monitoring, and proactive defence capabilities backed by expert analysts, targeting enterprise and government organisations.
• Penetration Testing Offensive cybersecurity testing services covering internal networks, external infrastructure, web applications, mobile applications, and social engineering, identifying vulnerabilities before malicious actors can exploit them. Delivered by CREST and ISO 27001 certified testers.
• Governance, Risk & Compliance (GRC) Cyber compliance services including policy uplift, compliance gap analysis, Essential 8 assessments, incident response planning, threat simulation exercises, third-party risk assessments, and controls assessments aligned to ISO 27001, NIST, and PCI DSS standards.
• Cyber Engineering Security architecture and engineering services covering enterprise, cloud, and OT environments. Implements Zero Trust principles, secure-by-design frameworks, and provides capacity on demand for team augmentation and capability uplift.
• Privacy Privacy program services including privacy impact assessments, capability assessments, advisory support, strategy development, policy drafting, complaints handling, training, and breach response aligned to the Australian Privacy Act.
• Data Risk Data governance services covering data processing inventory, lifecycle management, information records management, data ethics and bias assessments, retention schedules, and information risk profiling.
• AI Governance AI oversight services including AI risk assessments, governance framework development, and data ethics/bias evaluations to enable responsible AI adoption aligned with regulatory expectations.
• Awareness and Training Cybersecurity and privacy training programs including role-based training for executives and staff, advanced privacy training, and board/executive cybersecurity education aligned to regulatory obligations.
• Digital Forensics & Incident Response (DFIR) Critical incident response services including digital forensic evidence collection, root cause analysis, malware and ransomware analysis, timeline and impact analysis, and remediation guidance aligned to NIST and SANS methodologies.
• Internal Penetration Testing Internal penetration testing that exploits vulnerabilities to determine what information is exposed within an organisation, assessing security posture against internal threat actors and attackers with internal network access.
• External Penetration Testing External penetration testing that exploits vulnerabilities to determine what information is exposed to the outside world, testing internet-facing components including VPN, email servers, and other perimeter systems.
• Web Application Penetration Testing Web application penetration testing that discovers and exploits server and client-side vulnerabilities attackers can use to disrupt business availability or access sensitive information.
• Mobile Application Penetration Testing Mobile application penetration testing that discovers and exploits server and client-side vulnerabilities that could disrupt business availability or access sensitive information on mobile platforms.
• Social Engineering Penetration Testing Psychological manipulation testing through phishing and vishing attacks that test organisational susceptibility to social engineering, including email fraudulent attacks and phone-based information extraction.

Quantifiable outcome

• 98% of cyber attacks rely on social engineering, with new employees most susceptible - 60% of IT professionals cite recent hires as high risk
• +1 more outcomes

Named customers3 records

Segments5 records

Ideal customer profiles6 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability5 records

Feature3 records

Partnerships

Five partnerships are on record, tiered core, flagship and minor.

• Rapid7coreChannel Partner/ Reseller/ Distributor · 1 February 2026ctrl:cyber is a Rapid7 MSSP partner in the Asia-Pacific Japan region. Awarded Rapid7's 2026 'MSSP of the Year' for APJ and recognized in multiple award categories. Rapid7's PACT partner program enables ctrl:cyber to deliver managed security services to customers, focusing on Continuous Threat Exposure Management to shift customers from reactive to preemptive security.
• elevenMflagshipStrategic or Co-development Partner · 12 January 2026ctrl:cyber acquired elevenM, marking a significant milestone in building Australia's sovereign, end-to-end cyber capability. The acquisition united closely aligned values and complementary capabilities, bringing elevenM's privacy and digital risk expertise into ctrl:cyber's portfolio. The elevenM team includes podcast co-hosts Jordan Wilson-Otto and Arjun Ramachandran who continue under ctrl:cyber.
• Melbourne City FCflagshipStrategic or Co-development Partner · 1 January 2024Multi-year major partnership as naming rights partner of City Football Academy Melbourne – ctrl:cyber Campus. ctrl:cyber branding appears on facilities and kits of A-League Men's, Women's, and Youth Academy teams. Partnership focuses on shared values, developing future talent, promoting diversity in football and technology. Steve Williams, CEO of ctrl:cyber, leads partnership emphasizing lasting impact beyond business.
• Managed Service Providers (MSPs)coreChannel Partner/ Reseller/ Distributorctrl:cyber partners with MSPs to deliver cybersecurity services. MSPs maintain customer relationships while gaining access to ctrl:cyber's specialist expertise, 24/7 monitoring, and incident response. All services delivered 100% onshore in Australia with full data sovereignty.
• DGplexminorChannel Partner/ Reseller/ DistributorAustralian partner recognized alongside ctrl:cyber in Rapid7's 2026 Partner of the Year Awards. DGplex won APJ Partner of the Year in 2025.

Scale indicators4 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Sense of Security: Australian independent cybersecurity consultancy offering penetration testing, GRC advisory and managed security services. Targets the same enterprise and government buyer base with a comparable services-led model.
• Orro: Australian secure networking and cyber services provider serving enterprise and government. Overlaps ctrl:cyber on managed detection, advisory and SOC services, and was co-recognized in Rapid7's 2026 APJ Partner of the Year awards.
• Tesserent (Thrive Australia): Largest Australian-headquartered cybersecurity services consolidator, now part of Thrive. Offers managed security, advisory and offensive services to similar enterprise and government customers, competing directly for ASX 100 mandates.
• Cythera: Australian pure-play cybersecurity services firm offering managed security, advisory and offensive testing. Directly comparable in size, scope and customer tier, and recognized alongside ctrl:cyber in Rapid7's 2026 APJ Partner of the Year awards.
• Triskele Labs: Australian MSSP and cyber advisory firm focused on mid-market and enterprise clients. Closely overlaps ctrl:cyber on managed detection, incident response and Rapid7-based delivery, and was named alongside ctrl:cyber in Rapid7's 2026 APJ awards.

Broad incumbents

• Arctic Wolf: Global MDR/MSSP providing 24/7 managed detection and response across multiple geographies. Competes with ctrl:cyber's ROC+ for multi-region enterprise customers and represents the kind of global platform that could challenge the sovereign-only positioning.
• Telstra (Telstra Cyber): Largest Australian telecommunications incumbent with a broad managed security, SOC and advisory portfolio. Competes for the same ASX 100 and government cyber spend as ctrl:cyber, but as part of a much wider product set.
• BAE Systems Australia (Cyber): Global defense prime with a sizable Australian cyber and intelligence business serving federal government and critical infrastructure. Overlaps ctrl:cyber on cyber defense and incident response for regulated clients, with deeper sovereign-security credentials.

Emerging players

• Kasada: Australian-headquartered cybersecurity vendor specializing in bot management and online fraud prevention. Comparable as a successful Australian cyber scale-up, though focused on a narrower product category than ctrl:cyber's broad services stack.
• Bugcrowd: Australian-origin crowdsourced security platform combining penetration testing, bug bounty and attack surface management. Overlaps ctrl:cyber's offensive testing practice with a different crowdsourced delivery model.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• YouTubeyoutube.com/@ctrlcybersecurity
• LinkedInlinkedin.com/company/ctrlcyber

Compliance8 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Subsidiaries1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ctrl:cyber