Core service
Managed Security
Your security tools run, watched and reported on by security specialists.
- ASD Essentials
- NIST CSF
Cyber Security
Cyber Security
Find where you are exposed, fix what matters most and show insurers, auditors and customers the evidence.
- EndpointsEDR on laptops and serversManaged
- EmailPhishing attempt quarantinedContained
- IdentityMFA and risky sign-insManaged
- ASD EssentialsCurrent maturity and readinessDecision
01Cyber Security services
Protect, test and prove it.
Start with one service and add others as you go. Each one is scoped to your risks and quoted in writing first.
Services
Protect, test and monitor your devices, email, cloud accounts and people.
7 services
Penetration Testing
Find the gaps an attacker would use, before they do.
- NIST CSF
- ASD Essentials
Endpoint Security
EDR on your laptops, desktops and servers, set up and watched by our team.
- ASD Essentials
- NIST CSF
Email Security
Filter phishing, impersonation and fake invoices before they reach staff.
- NIST CSF
- ASD Essentials
Vulnerability Management
Continuous scanning that tells you which weaknesses to fix first.
- NIST CSF
- ASD Essentials
Security Awareness Training
Short training and realistic phishing tests that change staff habits.
- ASD Essentials
- NIST CSF
Cloud & Microsoft 365 Security
Find and fix the risky settings in Microsoft 365, Azure and AWS.
- NIST CSF
- ASD Essentials
Compliance
Turn a questionnaire, tender or insurance renewal into a plan you can act on.
2 services
ASD Essentials
Get ready for ASD's new Essentials framework, starting from where you are today.
- ASD Essentials
- NIST CSF
ISO 27001 & ISMS
Build an ISMS ready for audit, from a company that holds the certificate.
- NIST CSF
- ASD Essentials
02ASD Essentials
Get ready for ASD Essentials, and keep improving now.
ASD has released the ASD Essentials series, which will replace the Essential Eight. The transition timeline hasn't been set, and ASD does not recommend slowing or stopping uplift against the current model.
Every current strategy maps to at least one ASD Essentials principle, but maturity levels don't convert automatically. A baseline now makes the move easier later.
Today · eight strategies
- Patch applications
- Patch operating systems
- Multi-factor authentication
- Restrict admin privileges
- Application control
- Restrict Office macros
- User application hardening
- Regular backups
ASD Essentials · Phase 1
- Boundary services
- Identity services
- Governance and culture
- Visibility and response
Cyber Security
Findings that turn into decisions, not shelfware
Whether we're testing, monitoring or helping with a framework, we write findings so a manager can act on them: what we found, why it matters to your business and who should fix it. The technical detail sits underneath for your IT team.
03Read the detail
Cyber Security, explained
In short
Catharsis Cyber Security is a Sydney cyber security company certified to ISO/IEC 27001:2022. It tests your defences, protects devices, email and cloud accounts, trains staff and prepares you for ASD Essentials and ISO 27001, for government teams and organisations with 5 or more staff. Each engagement is scoped to your risks, so the highest-risk gaps are fixed first.
What does cyber security cover?
Cyber security is the work of keeping your systems, data and people safe from attack, and being able to recover when something goes wrong. For most organisations it is a mix of testing, protection, monitoring, training and evidence for the customers, insurers and regulators who ask for it. Security is Catharsis’s main business, not an add-on to something else.
Which service fits your situation?
Start from the problem in front of you:
- A customer, insurer or tender wants evidence your defences hold: penetration testing shows how they hold up, and an ASD Essentials baseline or ISO 27001 consulting covers the framework they name.
- You have security tools but nobody watches them: managed security puts a team behind them.
- Laptops still rely on basic antivirus: endpoint security adds detection and response.
- Staff keep receiving phishing and fake invoices: email security and security awareness training work as a pair.
- You patch, but nobody can prove what is still exposed: vulnerability management ranks and tracks it.
- Microsoft 365 was set up years ago and never checked: cloud and Microsoft 365 security finds the risky settings.
- You report against ASD’s current maturity model and need to plan what comes next: our ASD Essentials review gives you a baseline.
How do the frameworks fit together?
Compliance work often starts when someone asks for evidence: a customer security questionnaire, a cyber insurance renewal, a government tender or a board. ASD Essentials sets out the outcomes and actions ASD prioritises. ISO/IEC 27001 gives you the management system that governs them, and the same evidence can serve both. Where a framework fits better, we also map your controls to the NIST Cybersecurity Framework (CSF) 2.0.
Why work with a specialist security team?
You talk directly to a subject-matter expert, not a call centre. The person who scopes your work understands the technical detail and stays involved until it is finished. That matters when you need a straight answer about a finding, a cost or a deadline.
We work with organisations in accounting and finance, legal, healthcare, technology, education and the not-for-profit sector.
04Try before you commit
See it working on your systems first.
Proof-of-value trials for organisations ready to evaluate properly.
Free
Free security health check
A short review of your key security controls with a security specialist, then a ranked list of your biggest risks and what to fix first.
Book a health check14days
14-day email security trial
Run email security on your own Microsoft 365 or Google Workspace mailboxes for 14 days and see the phishing, malware and impersonation attempts it catches.
Start the email trial14days
14-day endpoint security trial
Try endpoint detection and response (EDR) on your own devices for 14 days, set up and watched by our security team, with a findings review at the end.
Start the endpoint trial30days
30-day vulnerability management trial
For organisations with 65 or more endpoints or users: 30 days of scanning and a prioritised list of the vulnerabilities that matter most, explained by our team.
Start the 30-day trialOffers are provided at our discretion. Trials are proof-of-value engagements for organisations actively evaluating a purchase, starting with a scoping call and agreed success criteria. Offer terms.
05Frameworks
How our services map to the frameworks
| Control | ASD Essentials | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|---|
| Managed EDR and alert triage | Visibility and response | Not applicable | A.8.7, A.8.16 | Detect; Respond |
| Email security management | Boundary services | Not applicable | A.5.14, A.8.7 | Protect |
| Patch oversight, and vulnerability scanning (add-on) | Not applicable | Patch applications; Patch operating systems | A.8.8 | Identify (ID.RA-01) |
| Firewall and VPN management | Boundary services | Not applicable | A.8.20, A.8.23 | Protect (PR.IR-01) |
| Security awareness program (add-on) | Governance and culture | Not applicable | A.6.3 | Protect (PR.AT-01) |
| Incident response planning (add-on) | Visibility and response | Not applicable | A.5.24, A.5.26 | Respond |
06FAQ
Cyber security, answered.
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistWhat cyber security services does Catharsis offer?
Catharsis offers managed security, penetration testing, endpoint security, email security, vulnerability management, security awareness training and cloud and Microsoft 365 security. We also help with compliance: preparation for the ASD Essentials series, assessment and uplift against ASD's current maturity model, and ISO 27001 consulting. Many organisations combine several services, and we scope each engagement so you only pay for work that reduces your risk.
Is Catharsis certified to ISO 27001?
Yes. Our certification is to ISO/IEC 27001:2022, the current version of the international standard for information security management. Because we run our own business under that information security management system (ISMS), we understand certification from the inside, which helps when we prepare your organisation for its own audit.
Can government agencies buy cyber security services from Catharsis?
Yes. Catharsis is registered on BuyICT, the Australian Government's digital marketplace run by the Digital Transformation Agency, and on buy.nsw as NSW Government supplier 95776. Federal, state and local government teams, as well as health and education organisations, can engage us through those channels or directly. We are happy to work within your procurement process and documentation requirements.
Do you work with small businesses that have no security team?
Yes. Our services are designed for organisations without a dedicated security person. You get a written quote before work starts, and we focus on the controls that make the biggest difference first. Larger organisations and government teams use the same services with a broader scope.
Where is Catharsis based?
Catharsis is based in Sydney and works with organisations across Australia. Much of our work, such as vulnerability scanning, cloud reviews and awareness training, is delivered remotely, so your location is rarely a barrier. Where on-site work is needed, for example an internal network test, we agree the arrangements with you during scoping.
Cyber Security
Not sure which service you need? Ask us first.
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.