Cyber security services · ANZ

Identity you can trust. Security you can prove.

We respond to cyber security incidents of every kind, including the ones that don’t fit a category. We find out what happened, prove it with evidence your insurer and lawyers can rely on, and get you back to work.

Talk to a responder

Our services

Think an email account has been taken over? Run the two-minute check.

Incident AU-0147 · Example Co

Elapsed 26h 14m

Business email compromise

Contained

Triage call
Scope and immediate next steps agreed
+00:12
Contained
Attacker access removed
+02:40
Evidence preserved
Key evidence secured
+09:15
Analysis
Establishing what happened and what was affected
In progress
Report & recovery
For your board, insurer and legal counsel
Pending

Next client update 14:00 AEST

Illustrative example

24/7

Incident line answered by a responder, not a call centre

Any

Incident, common or unusual. If it doesn’t fit a box, call anyway

1 page

Executive summary in every report. Facts first, in plain English

ANZ

Responders working on Australian and New Zealand time

What we respond to

The incidents we see most. And the ones that don’t fit a box.

Each incident leaves different evidence. We know where to look for each one, and what your insurer, lawyers and the regulator will ask for.

Business email compromise

An attacker gets into a mailbox, watches the conversation, then asks someone to pay a different account. It is the most expensive cyber incident most Australian businesses will face.

Signs you may see

A supplier or customer says they paid you, but the money never arrived
Mailbox settings or rules nobody remembers changing
Replies to emails you never sent
Sign-in alerts from unfamiliar locations

What we do

Remove the attacker’s access and contain the incident
Establish how they got in and what they did
Determine what information was exposed
Report our findings to you, your insurer and your lawyers

Money already sent? Call your bank first to request a recall, then call us.

Check for BEC →

Ransomware

Files are encrypted and there is a ransom note. Most groups also copy data before they encrypt, so recovering your systems is only half the problem.

Signs you may see

Files renamed with an unfamiliar extension
A ransom note on desktops or file shares
Backups deleted or disabled
New admin accounts or remote access tools you did not install

What we do

Contain the incident while preserving evidence
Establish how they got in and whether data was taken
Support a safe recovery
Report our findings to you, your insurer and your lawyers

Do not power off affected machines. Disconnect them from the network and call us.

Get help now →

Cloud compromise

An attacker holds a valid identity in your cloud tenant. They may be reading mail, granting themselves roles, or quietly exporting data from SharePoint or storage.

Signs you may see

Sign-in prompts or alerts nobody expected
Admin or security settings changed without explanation
New apps or integrations nobody approved
Unusually large downloads of company data

What we do

Remove the attacker’s access
Investigate account and tenant activity
Determine what was accessed or changed
Strengthen your controls so it does not happen again

Call early. Cloud evidence does not last forever.

Talk to a responder →

Web compromise

Your website or web app has been altered. Visitors may be redirected, served malware, or have their card details skimmed at checkout.

Signs you may see

Unexpected redirects or pop-ups on your site
Browser or search engine warnings about your domain
Unknown files or admin users on your site
Customers reporting card fraud after buying from you

What we do

Preserve the evidence
Establish how the site was compromised
Determine which customers and records were affected
Support a safe restoration

Take a copy of the site and its logs before anyone cleans it up.

Talk to a responder →

Something else

Not every incident fits a category. Insider misuse, a data leak, extortion without encryption, a breach at a supplier, or a sense that something is wrong. If you are not sure what you are looking at, that is the time to call.

Signs you may see

Your data appearing somewhere it should not be
A threat or extortion message
A supplier or partner reporting a breach that involves you
System behaviour nobody can explain

What we do

Work out what is actually happening
Contain it and preserve the evidence
Establish the impact on your people, data and systems
Report our findings to you, your insurer and your lawyers

You do not need to know what it is before you call. Working that out is our job.

Get help now →

How an engagement runs

What happens after you call.

A calm, fixed sequence. You always know what we are doing, what we have found and what we need from you.

Hour 0

Triage call

A responder takes the facts, tells you what to do in the next hour, and confirms scope.

Hours 1–4

Contain

We cut off the attacker's access while keeping the evidence intact.

Hours 4–24

Collect

The evidence that matters is identified and preserved.

Hours 24–72

Analyse

We rebuild the timeline, identify affected data and brief you on findings.

Report & recover

A clear report for your board, insurer and lawyers, and a plan to harden.

Who we work with

Built for everyone in the room.

An incident pulls in your board, your insurer and your lawyers. We are a cyber security firm, not a law firm. We give each of them the technical evidence they need, in plain English.

Businesses

Direct help when an incident hits, and readiness work so the next one costs less.

For businesses →

Cyber insurers

Fast scoping, clear cost estimates and findings your claims team can act on.

For insurers →

Law firms

Evidence collected and preserved to support your legal advice, with booklets built for review.

For law firms →

MSPs & IT teams

An escalation path when a client’s incident is bigger than your team.

For MSPs →

Reporting

Reports that lead with the answer.

Every Authene report follows the same structure, so your board, insurer and lawyers know where to look. Findings first, evidence after, no filler.

01
One-page executive summary.

Risk, highest findings and the one action that matters.
02
Findings you can act on.

Severity, affected system and a remediation deadline.
03
Evidence you can trace.

Every finding links back to its source.

NIST SP 800-61

Essential Eight

ISO/IEC 27001

SOCI Act

APRA CPS 234

authene

Cyber Security

Business Email Compromise
Incident Report

Example Co Pty Ltd
Confidential · For legal counsel
Version 1.0

Executive summary

An attacker controlled the accounts payable mailbox for 41 hours and redirected one supplier payment. Two findings are Critical. Close the account protection gaps identified in this report within 7 days.

ID	Finding	System	Severity
F-01	Unauthorised mailbox access	Email	CRITICAL
F-02	Fraudulent payment request	Accounts payable	CRITICAL
F-03	Gaps in account protection	Identity	HIGH
F-04	Insufficient log retention	Logging	MEDIUM

Two-minute check

Is this BEC?

Answer five questions about what you have noticed. You will get a plain-English read on how urgent this is, and what to do next.

Nothing you select here is stored or sent anywhere.

Has anyone been asked by email to change bank or payment details?

Have you found mailbox rules or settings nobody remembers changing?

Have people received emails from you that you did not send?

Did someone enter their Microsoft 365 password after clicking an email link?

Have you seen unexpected MFA prompts or sign-in alerts from overseas?

Authene software

BECRIP

Desktop app · Windows & macOS

Microsoft 365 BEC forensics, on your desk.

BECRIP is forensic software for Microsoft 365 business email compromise. It turns Microsoft 365 evidence into a clear, QA-checked record of attacker activity in hours, not weeks.