About
We sell one thing. This is why it is shaped the way it is, and what it deliberately is not.
Why the name#
There is a familiar shape to security advisory work. Someone is engaged, they look carefully, and they produce a document. The document is accurate. It is also, quite often, the last anyone hears of the problem — because the hard part was never the finding. The hard part is the order you close things in, who pays for it, and whether anyone can defend the result to a customer six months later.
We named the company after the part that usually goes missing. Findings arrive graded U1 to U5, cheapest and most load bearing first, each carrying a consequence level and the reason it sits there. Everyone finds problems. The order to close them is the useful part.
One assessment, not a menu#
We run a fixed scope, fixed fee space cyber assessment for Australian space companies. That is the whole offer.
It is not a menu because the alternative does not work. A consultancy that sells whatever you ask for is a consultancy whose control set is assembled fresh each time, which is exactly how you end up answering for a constellation you do not fly. Ours is scoped by payload class, bus model and orbital layer, then mapped to NIST SP 800-171 — the same 110 controls under CMMC Level 2. Ground segment controls apply to the ground segment.
One control set, three regimes#
Three regulatory regimes ask closely related questions in incompatible language. CMMC asks what your prime's flow-down requires. ITAR and EAR assume, without ever saying so, that you can show technical data never reached an unauthorised person. SOCI has not designated space as an asset class yet, though parts of what you already do sit inside somebody else's obligations.
Answering them separately means three engagements and three sets of evidence that do not agree. Answering them from one control set is the entire point.
Governance and engineering in the same room#
The method comes out of a wildfire detection pipeline built under FUEGO at the UC Berkeley Space Sciences Laboratory. If your payload is Earth observation or a detection system, the control set was written by people who have shipped one, rather than adapted from a generic checklist.
The governance half comes from regulated banking, payments and insurance, where the question is never whether a control exists but whether a board can defend it. See the team.
What this is not#
It is not a certification, and nobody can give you one for a space asset under SOCI today. It is not export classification advice — that is your export lawyer's call. It is not a penetration test.
It is evidence: a report written to be shown, answering a procurement questionnaire, a prime's security annex and a board paper as one artefact.