Cyber Security
Prove your Essential Eight maturity from real configuration
Gwenda reads the systems that enforce your controls and scores each of the eight mitigation strategies against the maturity level you are targeting. The self-assessment spreadsheet retires, along with its optimistic answers.
Essential Eight maturity from real configuration
Gwenda reads your identity provider, cloud accounts, endpoint management and patch state, then scores your maturity against the target you are aiming for, from what is actually configured, not from what someone ticked.
Discovery
What Gwenda finds, and where it finds it
Every finding names the system it came from. That is what makes it evidence rather than an assertion.
Who actually has administrative access
Standing privileged roles, service accounts with more scope than they need, and accounts exempted from your MFA policy. Read from Microsoft Entra ID, Okta, Google Workspace.
Whether MFA is enforced or merely available
Conditional access and policy scope, read from the system that enforces it, including the exclusions somebody added for a project in March. Read from Entra ID Conditional Access, Okta policies.
Real patch state across your fleet
Operating system and application versions against known-vulnerable releases, with the age of the oldest unpatched internet-facing service surfaced first. Read from Intune, Jamf, Kandji, AWS Systems Manager.
Cloud configuration that drifts
Public storage, unencrypted volumes, permissive security groups, disabled logging, and root accounts without hardware MFA. Read from AWS, Azure, Google Cloud.
Backup coverage and whether restores are tested
What is in scope, how long it is retained, whether it is reachable from a compromised admin account, and when a restore was last proven. Read from AWS Backup, Azure Backup, Veeam.
Who has completed security awareness training
Completion and currency by person and team, matched against your current staff list instead of last year's export. Read from KnowBe4, HR system.
The benchmark
The Gwenda gold standard for cyber security
Essential Eight Maturity Level Two, evidenced from configuration, with the identity, logging and recovery controls a well-run Australian organisation is expected to hold alongside it. Maturity Level Three where you handle regulated or high-value data.
- Identity and access
- Phishing-resistant multi-factor authentication on every internet-facing service and privileged account, with administrative privileges restricted, time-bound and reviewed.
- Patch currency
- Internet-facing services patched within two weeks of release and within 48 hours for critical vulnerabilities, with operating systems and applications on a demonstrable cadence.
- Application control and hardening
- Execution restricted to an approved set on workstations and servers, with Office macro settings and browser hardening configured, whatever the policy document says.
- Backup and recovery
- Backups of important data, software and configuration retained, isolated from privileged accounts, and (the part most organisations cannot evidence) restored and tested.
- Logging and detection
- Centralised event logging retained long enough to investigate, covering authentication, privileged operations and internet-facing services.
- Incident readiness
- A tested response plan, with the assessment of notifiable data breaches able to be made inside the timeframe the Privacy Act expects.
Illustrative figures. Yours are measured from your own systems.
How it works
The same four moves, applied to your obligations.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Outcomes
What changes for you
A maturity score you can take to the board
Each of the eight strategies scored against your target level, with the configuration behind every score and the trend across quarters.
Evidence assembled before the assessor asks
Screenshots, exports and configuration snapshots collected continuously and timestamped, so an Essential Eight assessment stops being a fortnight of scrambling.
Drift caught months before any audit
When someone adds an MFA exclusion or a storage bucket goes public, it shows in your posture on the next scan instead of surfacing next year.
One control, counted everywhere
Multi-factor authentication evidenced once satisfies Essential Eight, ISO 27001 and SOC 2 at the same time.
Integrations
Where the evidence comes from
Read-only connections to the systems you already run.
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
Microsoft Intune
Operating system versions and patch level
GitHub
Branch protection and required reviews
Wiz
Cloud misconfiguration and exposure findings
Microsoft Sentinel
Connected data sources and coverage gaps
Veeam
Backup job success and failure history
Okta
Sign-on policies and MFA factors
Microsoft Azure
Subscription role assignments
Jamf
macOS version and update status
GitLab
Merge request approval rules
Tenable
Vulnerability findings by severity and age
Almost every organisation that fails an Essential Eight assessment already had most of the controls. What they could not do was prove it: which system enforced the control, for whom, on what date, and with what exceptions.
That gap exists because the Essential Eight is a statement about configuration, and most compliance tooling asks people questions instead of reading configuration. A questionnaire records an intention; Gwenda records what the system is doing.
Questions we get asked
Which maturity level should we be targeting?
Maturity Level One is the floor for most organisations. Level Two is the practical expectation for anyone handling personal or commercially sensitive data, and it is what Gwenda's gold standard is set to by default. You can change the target, and your score recalculates against it.
Does Gwenda need agents installed on staff devices?
No. Gwenda reads from the management systems you already run (your identity provider, MDM and cloud accounts). There is nothing to deploy to endpoints.
We are a Commonwealth entity. Does Gwenda cover the ISM?
Yes. The Information Security Manual is a supported framework, and controls discovered for the Essential Eight map across to the corresponding ISM controls automatically.
See what Gwenda finds in your cyber security posture.
Thirty minutes, your systems or ours. We'll show you what it discovers and where you sit against the gold standard.