Company news
Stone Leaf Capital portal release: a CAR representative area, board minutes and named regulator owners
An area for authorised representatives, board minutes under e-signature and an owner for every regulator duty.
Black Shard
The Den, built and run for Fox ValuationsShown with sample data
Read the case studyWhat do you need done?
- Commission softwareA web, mobile or platform build that we host, secure and keep shipping after launch.What we need from youThe problem, who will use it and the systems it has to work with.Software engineering
- Improve securityThe weak points in your systems found, fixed and re-tested, with a written report.What we need from youThe systems in scope, a contact on your side and a window to test in.Security services
- Meet a compliance deadlineThe gaps against your framework closed in order before the date, with the evidence ready for the assessor.What we need from youThe framework, the assessment date and access to the systems it covers.Compliance deadlines
Patch the edge first.Guard every sign-in.Keep a backup offline.
The attacks in our advisories reach Australian firms through the same few doors: an exposed edge device, a stolen password, a backup server left on the network. The flaws behind them are often exploited before a fix ships. Our security monitoring has analysed more than 476 million security events since 1 Oct 2026.
Some of the firms that run on what we build.
A few of our case studies, among the many systems we build, host and secure today.
Legal
GRM LAW
The firm runs intake, conflicts, trust oversight and AML/CTF from one portal.
A new release of the portal ships every week.
Shown with sample dataFinancial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
Every investor is identity-checked through InfoTrack before they can proceed.
Health
Aurii
Specialists run notes, letters, orders and billing from one app.
Available in 174 App Store territories and 178 Google Play countries.
Health
Zenith Cardiology
The clinical site and the practice’s ICT now sit with one team.
A 19-page clinical website, migrated with zero outage.
Recognition and credentials
Nominated twice on Awwwards, for our own site and for the Fox Valuations site we built. The CyberCert certificate and the Xero listing verify online; the panel records go out with our tender responses.
Also on the record
- ISO/IEC 27001:2022 Lead Auditor
- Built on Azure and Microsoft 365
CyberCert
SMB1001:2026 Gold
16 Jun 2026 to 17 Jun 2027
Local Buy
Queensland councils, LB308
Appointed 23 Oct 2026
NSW Government
ICT Services Scheme SCM0020
Registered 14 Oct 2026
Victorian Government
Fair Jobs Code certificate
23 Oct 2026 to 22 Oct 2028
Own estate
Essential Eight Maturity Level 3
Assessed September 2026
Reports and whitepapers
Recognition by evidence: our own figures, charted.
Report
Notifiable data breaches, read for small and mid-sized firms
OAIC figures of 6 Jul 2026, read 26 Oct 2026
The Black Shard Platform
Jetstone at the core. Practitioners who test, assure and respond around it. The engineering that builds and runs it.
- JetstoneLaunching 2027
The agent
Detect and respond
Test and assure
Build and run
Practitioners
Where Jetstone will run
- Windows
- macOS
- Microsoft 365
- Google Workspace
Built on and integrated with
Microsoft 365
Microsoft Azure
Microsoft Entra ID
Microsoft Intune
Microsoft Defender for Endpoint
Microsoft Teams
SharePoint
- InfoTrack
- Medical Objects
- Every platform we run
Detect and respond
Responders stop an intrusion spreading today, and Jetstone will watch your devices and sign-ins.
Explore detect and respond
Test and assure
Stops an attacker finding the way in before you do.
Explore test and assure
Build and run
Stops the systems you run on falling behind on patches, backups and uptime.
Explore build and run
The scale behind every engagement.
The engineering and security work behind the software we build and run.
- 476,663,655Security events analysed
Analysed by our own security monitoring, the record our responders work from in an incident.
Our security monitoring, since 1 Oct 2026
- 4,620,462Lines of source code
Written and maintained by our own team, across client systems and our own products.
Non-blank lines in the repositories we own
- 70,540Tests across our codebases
Tests run before a release ships, so a change is checked before it reaches your people.
Tests in our repositories
- 35,088Commits in 2026
Every change on record, so any line of a system traces back to who made it and why.
Git history across our product repositories, since 1 Jan 2026
- 3,523Pull requests merged
Changes ship in small, reviewed steps, so each one is easy to check and to roll back.
Merged on GitHub, since 1 Jan 2026
- 1,660Deploys and releases shipped
Deploys go into the production systems we run every week.
Successful deploy and release runs, since 1 Jan 2026
Measured from our repositories and monitoring; last updated .
Jetstone
Software that will contain known threats before anyone opens the alert.
The console will fit a phone, and a Monday summary will cover the week. The waitlist is open now.
Services
Fixed-scope offers with prices up front, and a free scoping call for everything else.
- Penetration testingNetworks, web apps, cloud and AI systems, with a written report and a re-test.From A$4,950 ex GST
- Essential Eight assessmentMaturity rated strategy by strategy, with an uplift plan sequenced by risk and effort.From A$5,950 ex GST
- SMB1001 readinessGap assessment, evidence pack and support through to your target tier.From A$3,950 ex GST
- Microsoft 365 and Azure security reviewIdentity, Conditional Access and tenant settings, with written findings.From A$3,500 ex GST
- vCISOSecurity leadership on a monthly retainer, from risk register to board briefing.
- Incident responseContainment, root cause and Notifiable Data Breaches support.
- Software engineeringWeb, mobile and platform builds, run in production.
- Managed ICTMicrosoft 365 tenants, devices and support, run by the people who secure them.
Solutions by industry
Software and security for the sectors we already build and run systems in.
HealthClinical software and its security
LegalTrust accounting and QLS obligations
Financial servicesPortals for AFSL holders
PropertyPractice systems and AML/CTF screening
GovernmentCouncils and agencies
Professional servicesTesting and managed ICT for firms
Automotive and tradesWorkshop and dealer systems
Motorsport and sport technologyRace-weekend decision software
RecruitmentCandidate intake and placement
From the newsroom
Releases from the firm, and advisories with the patched version and the first step.
Latest from the desks
Policy and regulation
ASD launches ASD Essentials, the successor to the Essential Eight
High severityAdvisories
Ivanti Connect Secure zero-day CVE-2026-104935 exploited in a three-flaw chain
Under attack? Call the incident line.
24/7 incident line1800 370 270Talk to us about a test, a tender or Jetstone.