CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, PCI-DSS, SMB1001
Why software and tech companies are targeted
For tech companies the common failures are leaked credentials (keys committed to a repository or left in a CI log), misconfigured cloud storage and over-privileged accounts. One mistake can expose every customer at once.
Attackers also go after the tools developers use: compromised packages, stolen session tokens and access to build pipelines. The faster a team ships, the more these need to be built in rather than bolted on.
What the technology & saas check asks about
The quick check has 20 questions and the full assessment 44. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- Source code & secrets management
- Cloud infrastructure security
- Secure SDLC / CI-CD
- Customer-data protection at scale
- Penetration testing & vuln management
- Customer-driven compliance (SOC 2 / ISO)
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Customer requirements. Enterprise and government customers expect ISO 27001 or SOC 2, regular penetration testing and a clear incident response process. Getting there takes time, so knowing your gaps early matters.
- The Privacy Act. Companies with annual turnover above $3 million, or that trade in personal information, must comply with the Australian Privacy Principles and the Notifiable Data Breaches scheme. Reforms passed in late 2024 added a statutory tort for serious invasions of privacy.
- Payments. If your product handles card data, PCI DSS applies.
- Ransomware payments. Companies with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Enforce multi-factor authentication on source control, cloud consoles and CI/CD
- Scan repositories for secrets and rotate anything that has been exposed
- Give people and services only the cloud permissions they need, and turn on logging
- Test your breach response with a tabletop exercise before a customer asks how you would handle one
Start the free technology & saas check
Frequently asked questions
Should a startup get ISO 27001 or SOC 2?
It depends on your customers. Australian and European enterprise and government buyers often ask for ISO 27001, while US customers more often ask for SOC 2. Many controls overlap, so fixing the gaps this check finds helps with either.
What are the most common security gaps in SaaS companies?
Secrets in source code, overly broad cloud permissions, missing multi-factor authentication on developer tools, and no tested incident response plan. They are common because teams move fast, and they are fixable.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a formal audit, certification, penetration test or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.