Find and fix the security gaps attackers look for first.
Expert-led, AI-assisted assessment of your email, accounts and systems, and of how your organisation uses AI, from Copilot to free AI tools. Our team reviews every finding, then we make the priority fixes and re-check them. Independent specialist penetration testers are engaged where your risk or compliance needs call for it. Nothing is tested without your written authorisation.
Opens a prepared email to admin@jundra.com. The first consultation is free; discovery is a paid stage, scoped in writing. How it works
Attackers now use AI to phish, profile and scan at scale. Close the basics first.
Australia’s Signals Directorate reports that malicious actors are using AI to write convincing phishing, profile victims from stolen and public data, and scan for and exploit weaknesses at scale (ASD Annual Cyber Threat Report 2025–26).
A business owner we know saw what happens next (Jundra was not involved): after a company’s customer data was stolen, criminals emailed its customers pretending to be the company and asking them to ‘update their credit card’ through a link. Customers clicked the link and entered their card details.
The four measures in full
These measures make that kind of follow-up attack harder to pull off and faster to spot:
- Email authentication (SPF, DKIM and DMARC), so fake emails using your domain are more likely to be rejected or flagged.
- Multi-factor authentication on staff and admin accounts, so a stolen password alone is not enough.
- Clear customer communications, prepared in advance, such as “we will never ask you to update your card through an email link”.
- An incident playbook, so your team knows who does what in the first hours, and when to bring in your legal, privacy and incident-response advisers.
Use AI without opening new doors to attackers.
Your staff are probably already using AI, approved or not. We review how yours does, against ASD’s guidance on engaging with artificial intelligence, and close the gaps.
What we review (4)
- Staff use of free AI toolsWhat is being pasted where, and approved alternatives that fit your data rules.
- What Copilot and other assistants can surfaceOver-shared files and permissions found and fixed before more people start asking questions.
- What AI agents and automations can reachLeast-privilege access, approval points and logging where your systems allow.
- An AI use policy and registerDrafted from the National AI Centre’s templates, for your sign-off.
Organisations that hold customer data and cannot afford a week-long scramble.
Organisations with customer or member data, online payments, many staff accounts or a mix of old and new systems, who want a practical, prioritised plan and the fixes delivered, not a thick report.
Signs you need it
- Staff use free AI tools and nobody knows what is pasted into them.
- You are rolling out Copilot or AI agents without checking what they can reach.
- Some staff or admin accounts still sign in with a password only.
- There is no written plan for the first 24 hours after a breach.
A prioritised plan, and the fixes that matter most.
The exact deliverables are agreed in your written proposal.
Expert-led, AI-assisted assessment
Your email, accounts and internet-facing systems examined in depth with AI tools, and every finding reviewed by our team.AI use and access review
Which AI tools are in use, what data reaches them, and what assistants and agents can access, checked against ASD’s guidance on engaging with AI.Findings mapped to the Essential Eight
Plain-English findings ranked by risk, mapped to the ASD Essential Eight strategies where relevant, so you can see where you stand before any formal maturity assessment.Fixes delivered
The agreed high-priority fixes, such as email authentication and MFA, made under your authorisation and checked in place.Specialist penetration testing
Independent specialist testers engaged for your project where your risk or compliance needs call for it, under the same written authorisation.Policy, playbook and customer messages
A draft AI use policy and register, an incident playbook with a practice run, and draft customer warnings and breach-notice templates for your legal or privacy adviser to approve.Re-check and handover
A re-check of what was fixed, and a clear list of what still needs attention.
Read this diagram as a list
- Written authorisation first: systems in and out of scope, methods, timing and contacts. No testing before sign-off.
- Expert-led, AI-assisted assessment: configuration, exposure, accounts and email settings examined with AI tools. Independent specialist penetration testers are engaged alongside this step where your risk or compliance needs call for it.
- Our team reviews every AI finding and ranks it by risk.
- Agreed fixes, highest risk first, such as email authentication and MFA, made under your authorisation.
- Re-check what was fixed and list what still needs attention, then repeat for wider coverage within your authorisation.
Six steps, with your written authorisation before any testing.
Nothing is tested until you have signed off what, when and how. Discovery and the proposal involve no testing.
STEP 01
Free consultation
30 minutes, free30 minutes on what worries you and what you hold. No charge, no obligation, and no testing.
STEP 02
Discovery (paid)
paid, scoped in writingWe talk with your team and review documents you share, such as system lists, current settings and the AI tools in use. No testing happens at this stage. A paid stage, scoped and priced in writing before it starts.
STEP 03
Written proposal
scope, steps, priceA written proposal and written authorisation: systems in and out of scope, methods, timing, contacts and price.
STEP 04
Pilot or MVP
fixed deliverablesExpert-led, AI-assisted assessment of the agreed systems, every finding reviewed by our team, with specialist security reviewers on the project where the scope calls for it, then fixes for the highest-risk gaps first.
STEP 05
Rollout
scale what worksFurther fixes, wider coverage, specialist testing where needed and an incident practice run.
STEP 06
Handover and support
your team, your filesFindings, changes made, playbooks and a list of what remains, 60-day defect fixes and optional support.
We only test systems covered by your written authorisation, and we do not test systems run by your suppliers without their permission. Your legal and privacy advisers lead on any breach-notification obligations; we prepare the drafts and playbooks for them.
What you can count on.
Free first conversation
A 30-minute consultation costs nothing and commits you to nothing. Discovery is a paid stage, scoped and priced in writing, and the pilot or MVP has fixed deliverables.
60-day defect fixes
We fix defects in our work for 60 days after delivery, at no charge, on top of your rights under the Australian Consumer Law.
People stay in charge
Our team reviews every AI finding before it reaches you, and nothing is tested or changed without your written sign-off.
Prequalified and insured
A prequalified supplier under the NSW Government ICT Services Scheme (SCM0020), with professional indemnity, public and products liability cover.
Want to know what we’d check first? Book a free 30-minute consultation →
Security is built into how we deliver.
The systems we build use multi-factor authentication, code review, vulnerability scanning, a secrets manager and backups. For assessments we combine expert-led, AI-assisted analysis by Jundra with independent specialist penetration testers, engaged for each project where the risk or compliance needs call for it.
We choose the right specialist for each job rather than a one-size-fits-all partner, and our team reviews every AI finding before it reaches you.
Built to fit Australian AI guidance.
We design to the National AI Centre’s Guidance for AI Adoption, and prepare the paperwork your own review needs: an AI register entry, a risk and impact summary, test results and the points where a person approves. That gives your team ready-made evidence for:
- the NSW AI Assessment Framework (NSW agencies);
- the Australian Government’s policy for the responsible use of AI in government (Commonwealth agencies);
- the National AI Centre’s Guidance for AI Adoption (any organisation);
- the OAIC’s privacy guidance on commercially available AI products.
Your privacy, legal and risk owners make the decisions; we give them the information to make them quickly.
Ownership of the work, data privacy and pricing are answered in the questions below.
Questions we get asked.
Do you test without permission?
No. We only test systems covered by your written authorisation and the agreed scope, at agreed times, with named contacts on both sides. Anything outside the scope is not touched.
Do you do penetration testing?
Yes, through independent specialist testers we engage for your project where your risk or compliance needs call for it, under the same written authorisation. Jundra leads the AI-assisted assessment and the fixes.
How is AI used?
AI tools let us examine configuration, map what is exposed, analyse logs and draft findings in depth. Our team then reviews every finding, so you get findings checked and prioritised by people, with the same approval-gate discipline we use for AI agents. Your data is handled under the agreed rules, never in free or consumer AI tools.
Can you help us secure Copilot and other AI tools?
Yes. We check what Copilot and other assistants can surface, fix over-shared files and permissions, review what agents and automations can reach, and draft an AI use policy and register for your sign-off.
Do you work to the Essential Eight?
Yes, as the baseline. We map findings to the ASD Essential Eight strategies where relevant and can help lift your maturity level with the changes you approve, such as MFA, patching and application control. We are not an IRAP assessor and do not certify maturity levels; if you need a formal assessment, we close the gaps ahead of it and work alongside your assessor.
More questions (7)
Is this a compliance audit or certification?
No. It is hands-on assessment and hardening. If you need a formal audit or certification, we can close the gaps ahead of the audit, prepare the evidence your auditor will ask for, and work alongside them.
What about confidentiality?
Findings are shared only with the contacts you name. We are happy to work under your confidentiality agreement. We use only the access needed for the agreed scope, ask you to revoke it at the end, and confirm when we no longer hold it, and the proposal says what happens to findings and copies of data afterwards.
Can you guarantee we will not be hacked?
No honest provider can. What we do is find and fix the gaps attackers commonly exploit, make phishing in your name harder, and give your team a rehearsed playbook for day one.
What if we have an active incident?
Contact your incident-response provider and report it to the ACSC at cyber.gov.au. Our work is preparation and hardening, which need to be ready before an incident, not after it.
You’re a small firm. Can you handle an organisation our size?
Yes. You work directly with Jundra’s project leads, Ken Taggart and Ali Khorsandian, and we bring in specialist developers, engineers and security testers as each project needs, named in your proposal. We start with one team or one task, so the first stage is sized to fit, and we have supported one critical rail monitoring system for more than a decade.
How can we buy from you?
Directly, or through the NSW Government ICT Services Scheme, under which Jundra is a prequalified supplier (SCM0020). Tell us how your organisation buys and we will confirm in writing what applies before discovery starts.
What does it cost?
The 30-minute consultation is free. Discovery is a paid stage, scoped and priced in writing before it starts. After that, scope and price depend on your organisation, so we do not publish package prices: you get a written proposal with the scope, steps, timeframe and price before the pilot starts, and the pilot or MVP has fixed deliverables.
Related AI services
Book a free 30-minute consultation.
Tell us which AI tools your staff use today and what worries you most about your systems or email.
You’ll talk with Ken Taggart or Ali Khorsandian, who lead Jundra’s projects. In 30 minutes we will:
What we’ll cover in 30 minutes
- look at the systems, email and AI tools you are most worried about;
- tell you the three things we would check first;
- name the main risks in how your staff use AI today;
- outline what a paid discovery would cover.
No charge and no obligation. If you go ahead, discovery is a paid stage, scoped and priced in writing. Please do not include confidential information in your email.
How this button works
It opens a prepared email to admin@jundra.com in your email app; nothing is booked or sent automatically. Press Send and we reply within one business day to agree a time: a video call, a phone call or a visit to your site. Using webmail? Copy the address into a new email. How we use enquiry details.