BlackFlag Advisory

BlackFlag Advisory is a Sydney-based GRC consulting firm delivering structured, evidence-based governance, risk, and compliance advisory for Australian businesses operating in complex, regulated environments. We specialise in passive OSINT assessments — using publicly available data to surface your organisation's external attack surface, technology exposure, credential breaches, email security gaps, and Privacy Act compliance posture, without accessing a single system.

Every engagement follows a disciplined five-phase framework, with all findings mapped to recognised standards including ASD Essential Eight, NIST CSF 2.0, ISO 27001, CIS Controls, and the Australian Privacy Principles. Deliverables include a structured risk register and a Board-level executive report that translates technical risk into clear, actionable language for non-technical decision-makers.

Founded by Cluny Archibald — a Bachelor of Cyber Security graduate with 20+ years of enterprise commercial experience — BlackFlag Advisory brings rare depth to GRC: formal cybersecurity qualifications combined with genuine business maturity.