Find free · Fix paid · Prove forever
Replace your cyber stack.
Save six figures a year.
Start with a free, consent-first Exposure Watch. Pay a published fee only when we find and fix something real — or roll everything into one accountable vCISO retainer. Built for Essential Eight, SOCI, the Privacy Act and APRA CPS 234.
Tier 0 · Find free
Free Exposure Watch
Tier 0 — Find free. See what an attacker sees, with your consent.
A$0
free, after you verify domain ownership
- Passive checks only — run after DNS verification and terms acceptance
- Email authentication (SPF, DKIM, DMARC), TLS and security headers
- Public subdomain discovery from certificate transparency
- Your declared stack matched to known-exploited vulnerabilities (CISA KEV / EPSS)
- Essential Eight & cyber-insurance readiness self-check
- Ransomware-payment reporting, NDB and SOCI obligations flagged
- Score, A$ loss band and your top three fixes
Pay for outcomes
Tiers 1–2 · Fix paid
Outcome — Fix Paid
Tiers 1–2 — pay only when a real finding is fixed or a risk milestone is proven
A$250–A$1,500
per verified finding · capped at A$3,000 a month · low severity always free
- Published fees: Critical A$1,500 · High A$750 · Medium A$250 · Low free
- Fee only after you accept the finding — 7-day dispute window
- Every fee includes the fix pack and one re-test
- Billed only once the re-test passes and the finding is resolved
- Resolved-risk milestones: Essential Eight ML1/ML2, insurance bound, audit passed, board pack, tabletop
- Optional gainshare of 20–30% of a broker-documented premium saving
- Invoices are prepared as drafts and reviewed before anything is sent
Tier 3 · Prove forever
Assurance & Accountability
Tier 3 — Prove forever. A named vCISO who owns your posture
From A$2,500
per month vCISO retainer — Essential, Assurance or Board-Ready
- Verified findings & resolved-risk milestones included — never a per-finding bill
- Named virtual CISO as your point of accountability
- Essential Eight, ISO 27001, SOCI and APRA CPS 234 alignment by tier
- Policies, assessments, tabletop exercises and board packs generated in GRACE
- Incident response plan, ready to invoke
- Audit & regulator liaison on Board-Ready
Outcome fees follow the published table above and are capped monthly. Retainer pricing scales with framework scope. All prices in AUD, excluding GST. We verify, fix and re-test — we never guarantee you won’t be breached.
Build vs. Buy
The real cost of a DIY cyber program
This is the honest TCO of running Australian GRC in-house, sourced from typical mid-market procurement and loaded salary data (SEEK, Robert Half Salary Guide 2025).
Running it yourself — mid-market benchmark
| Internal GRC Lead (1 FTE, loaded cost) | $180,000 | |
| GRC SaaS platform (per-user licence) | $42,000 | |
| Security awareness training vendor | $12,000 | |
| Policy management / document control tool | $9,500 | |
| External compliance audit fees | $25,000 | |
| Fractional virtual CISO engagement | $54,000 | |
| Implementation consulting (Year 1 only) | $60,000 | |
| Integration & maintenance overhead | $18,000 | |
| Total annual DIY TCO | $400,500 | |
BCyber vCISO Assurance — the equivalent outcome
vCISO Assurance (Tier 3)
$55,000
per year, all-inclusive
You save (Year 1)
$345,500
86% reduction in TCO
Payback period
~50 days
Faster than hiring one GRC Lead
What’s in each tier
Honest, complete feature transparency.
| Feature | Free Watch | Outcome | Assurance |
|---|---|---|---|
| Passive exposure checks (email auth, TLS, headers, subdomains) | |||
| Essential Eight & insurance readiness self-check | |||
| Declared stack matched to known-exploited vulnerabilities | |||
| Reporting obligations flagged (ransomware payment, NDB, SOCI) | |||
| GRACE portal access | Limited | ||
| Validated findings with fix pack + one re-test | |||
| Resolved-risk milestones (E8 ML1/ML2, insurance, audit) | |||
| Board packs & tabletop exercises | Limited | ||
| Named vCISO accountability | |||
| Quarterly multi-framework assessments | |||
| Incident response plan, ready to invoke | |||
| Findings & milestones included — no per-finding fees |
Optional professional services
Add expert delivery to any tier. All outcome-based, all fixed-fee.
Fractional GRACE Officer
From$4,500per month
Outcome-based virtual GRC lead. Attends audits, owns your posture score, presents quarterly to your Board.
Incident Response Retainer
From$2,500per month
Priority IR standby with agreed response-time targets, evidence chain of custody, and post-incident reporting.
Audit Preparation Sprint
From$15,000one-off
Six-week readiness sprint for ISO 27001, Essential Eight ML3, or APRA CPS 234 audit.
Pricing FAQ
Is pricing per-user, per-seat, or flat?+
None of those. The Exposure Watch is free. Outcome fees are charged per verified finding or proven milestone from a published table, capped at A$3,000 a month, with low-severity findings always free. vCISO retainers are a flat monthly fee based on scope, not seats.
When exactly do I pay an outcome fee?+
Only after you accept a validated finding, the 7-day dispute window has passed, the fix pack has been issued, the re-test has passed and the finding is resolved. Every fee includes the fix pack and one re-test. Invoices are prepared as drafts and reviewed by a person before anything is sent.
Do you guarantee results?+
No. We verify, fix and re-test specific findings and record the evidence. No provider can guarantee you will never be breached, and we will never say otherwise.
Are there per-finding fees on audits or retainers?+
No. Findings raised during an attestation or audit engagement, or while you are on a vCISO retainer, are never billed per finding — they are part of that engagement.
What's included vs what's an add-on?+
The free Exposure Watch, outcome fees and vCISO retainers cover the core. Add-ons (Fractional Officer, IR Retainer, Audit Sprint) are optional professional services for organisations wanting done-for-you delivery.
How does BCyber compare to Drata, Vanta, or 6clicks?+
Global tools (Drata/Vanta) are SOC 2 / ISO-centric. 6clicks is a respected Australian peer. BCyber is purpose-built for Australian regulatory depth — SOCI Act, Privacy Act, APRA CPS 234, ASIC REP 798 — plus a fully integrated behavioural and training layer. See our full comparison page.
Can I switch tiers later?+
Yes. Start with the free Exposure Watch, move to outcome pricing when you accept a finding, and move to a vCISO retainer at any time. Once you are on a retainer, findings and milestones are included and per-finding fees stop.
What implementation support is included?+
vCISO retainers include guided onboarding (30–60 days). Outcome engagements include the fix pack and one re-test for every billed finding. Everyone gets our GRACE Readiness Playbook.
Do you offer multi-year discounts?+
Yes, on vCISO retainers — 10% off for 2-year commitments, 15% off for 3-year. Speak to us about non-profit, education, and multi-entity family group pricing.
How do I know which tier is right for me?+
Run the free Exposure Check, take our free Posture Score (10 questions, 3 minutes) or run the Stack Calculator to see your current spend vs. the BCyber equivalent.
What's the minimum contract term?+
The Exposure Watch has no term. Outcome fees are per resolved finding or milestone, with no lock-in. vCISO retainers are 12 months, billed monthly or annually.