Over two decades of cyber security experience, delivered as fractional leadership for Australian businesses navigating growth, compliance, and risk.
Portcullis Security was founded by an experienced Chief Information Security Officer with over two decades in cyber security — more than fifteen of those in security leadership, sitting at the executive table, presenting to boards, and owning the programme.
This isn't theoretical advisory from a partner who last touched a system fifteen years ago. It's operational leadership from someone currently doing the job — bringing the discipline of a sitting CISO to every engagement.
What makes Portcullis different is how we combine that depth of experience with modern, AI-augmented delivery. Traditional consultancies run on human hours. We run on human judgement amplified by AI tooling — sharper risk assessments, faster compliance evidence, continuous intelligence instead of point-in-time snapshots.
The result: senior-grade security leadership with the responsiveness of a modern boutique, at a fraction of the cost of a full-time hire.
A virtual CISO provides executive-level security leadership without the full-time overhead. It's not advisory theatre — it's someone accountable for outcomes. What is a vCISO? →
We define our scope tightly so that what we do deliver gets genuine senior attention. This is what we say no to — and why.
Pen testing is a specialist discipline. We'll scope the requirement, recommend a trusted partner, and interpret the findings — but we won't be the ones running the tools.
We don't earn commissions on products we recommend. When we advise on tooling, our only interest is what works for your environment. Independent advice, no vendor strings attached.
We provide leadership and governance — not 24×7 operational monitoring. Where managed services are the right answer, we'll help you select and oversee the right provider.
We take on a deliberately small number of retainer clients — only when we can give them genuine senior attention. This isn't a volume practice. If we're at capacity, we'll tell you.
If we can't be accountable for the outcome, we won't take the engagement. Strategy documents that sit in a drawer aren't security — they're theatre.
Your business is scaling. Enterprise clients are asking about your security posture. Investors want evidence of cyber governance before the next round. The board is asking harder questions you don't have structured answers for yet.
Hiring a full-time CISO is expensive and slow. For many growth-stage businesses, a fractional model is the more practical way to access senior security leadership without waiting months or carrying full executive overhead.
Every week without security leadership is a week your attack surface grows unchecked, your compliance deadlines creep closer, and your team makes decisions without the context they need.
Book a free 30-minute call with Doug. No obligation, no pitch deck — just an honest conversation about your security posture and what it would take to shore it up.
Book a Discovery Call