18+ years across four major banks, defence and government · Author, The CISO's AI Firewall
AI SECURITY & CYBERSECURITYENTERPRISE ADVISORY
When the rules move,
who moves with them?
Board-level security and AI leadership for organisations navigating cyber risk, AI adoption and regulatory change.
We work in
ISO 42001ISO 27001NIST AI RMFOWASP LLM Top 10SOC 2
Delivery capacity
Through our delivery partner
Cyber Arista
We work in
Security leadership for the decisions that matter.
Cybersecurity Link helps organisations govern AI, strengthen cyber resilience and build the security capabilities required to operate with confidence.
01 / YOU ARE PROBABLY HERE BECAUSE
Something just changed.
The trigger is rarely a desire for more documentation. It is a decision that now needs a credible owner.
01
Security leader gone
Your CISO resigned without notice. The accountability for security did not leave with them.
02AI in production, no policy
Staff are already using AI tools across the business. Nobody has been given ownership of the risk.
03Tender demands certification
A tender or contract now requires ISO 27001, and there is a date to work back from.
04Audit or assessment finding
The audit or assessment report has landed. Now it needs a named owner and a credible plan.
05Insurance renewal approaching
Your cyber insurance renewal is approaching, and the insurer wants evidence, not assurances.
06The board asked a question
The board asked who is accountable for AI, and that deserves a better answer than silence.
02 / OPERATING CONTEXT
The environment keeps moving.
AI ADOPTION / WIDESPREADREGULATION / MOVINGACCOUNTABILITY / UNASSIGNED
The rules moved.
Security baselines are being rewritten faster than certification cycles complete.
AI regimes do not agree.
Each regime moves on its own clock: in force in some markets, phasing in elsewhere, principles-based in others. Even the deadlines have moved.
The chair stayed empty.
AI reached the workforce before it reached the org chart. Very few organisations have named an executive accountable for it.
So, who in your organisation is accountable for AI?
And will your compliance still hold when the rules move again?
02 / AI Security FirewallGovernance that
Governance that
holds at runtime.
AISF, the Cybersecurity Link AI Security Firewall, turns your AI policy into controls that run where your models, agents and MCP tools run, and keeps the evidence to prove it. It is the method from The CISO's AI Firewall, built as a platform.
In developmentFounding design partners: openAustralian-built
Why now
The rules moved, and AI is already in production. A policy on paper doesn't stop an agent calling a tool it shouldn't.1,000+ AI policy initiatives across 69 countries, territories and the EU (OECD.AI).
01
Govern
Write AI policy once, as code, with approvals and version history.
02
Assess
Find every model, agent and MCP server, and map its attack paths.
03
Enforce
Apply policy inline: audit first, then simulate, then enforce on routes you approve.
04
Contain
Assume a detector can miss. Limit what an AI system can reach and do.
05
Prove
Every decision recorded and mapped to ISO 42001, NIST AI RMF and OWASP.
Launch sequenceSoftware first.
Software first.
Hardware once it's proven.
AISF launches as SaaS and as a virtual appliance. A hardware appliance follows once the software has run in production with our design partners. It is the same product throughout, so nothing you configure in the first release has to be rebuilt later.
Wave 1 · Launching first
01Launching first
AISF SaaS
The quickest start. Point your AI traffic at the gateway and use the hosted console.
- Hosted gateway, Australian region by default🚩 Confirm hosting region before launch
- No infrastructure to stand up
- Content redacted before storage by default (mode M1)
02Launching first
AISF Virtual Appliance
Runs in your environment, so AI traffic and prompts stay inside your boundary.
- VMware, Hyper-V and KVM images, plus Kubernetes (Helm)
- Keeps enforcing on last good policy if the cloud is unreachable
- Content processed locally (mode M3)
Wave 2 · Follows
03Next
AISF Hardware Appliance
The same software on certified partner hardware, for sites that need a dedicated box.
- High-availability pair, secure boot
- Air-gapped option with signed offline updates
- Hardware, software and support in one subscription
One product, three ways to deploy.Same policy, risk model and evidence in every form. Choosing how you deploy doesn't change which edition you buy.
What we see
You decide what leaves your environment.
You set data handling per tenant and can change it per route. It answers the CISO's first question: what can Cybersecurity Link actually see?
M0
No content
Only metadata leaves: decisions, IDs, timings.
Highest sensitivityM1
Redacted
Sensitive elements masked before storage.
SaaS defaultM2
Your keys
Full content, encrypted under keys you manage.
Forensic replayM3
Local only
Content never leaves your environment.
Virtual · hardwareFounding Design Partner Programme
Help shape the first release.
We are taking on 3 to 5 organisations to pilot AISF on their real AI estates. Partners get early access, a seat on the roadmap and direct access to the architect. We won't use your logo without written consent.
Independence. AISF is a separate product line. Our advisory and assessment work stays product-neutral: we never make AISF a condition of an engagement or recommend it as a finding in our own assessments.
Status. AISF is in development. This section describes the planned release. AISF reduces AI attack paths and limits blast radius. It does not claim complete prevention or automatic compliance, and it is not IRAP-assessed.
03 / TWO EXECUTIVES
Two executives. One firm.
Security and AI, one mandate.
Fractional security executives exist. Fractional AI executives are emerging. We're the firm that provides both, and can technically secure what it governs.
Virtual CISO (vCISO)
Your security executive. Strategy, governance, risk, board reporting and crisis leadership, held by a named senior practitioner, not a platform.
EstablishAssureLead
How vCISO works Virtual Chief AI Officer (vCAIO)
Your AI executive. Accountable for AI strategy, governance, risk and security, with the technical depth to red-team the systems it governs.
EstablishGovernLead
How vCAIO works 04 / ECONOMICS
The economics of fractional leadership
Full-time CISO
The right answer when the role is truly full-time.
A second seat
Adding a permanent AI executive means two recruitments, two fixed costs and two sets of single-person risk.
One connected firm
vCISO + vCAIO, one coordinated mandateAccountable senior leadership, flexible capacity and a defined mandate that scales.
05 / FIVE PRACTICES
Five practices. One firm.
01
Executive Advisory
Provide accountable vCISO, vCAIO and board-level security leadership.
Explore practice02
AI Security
Secure, govern and monitor enterprise AI, from ISO 42001 readiness to red teaming.
Explore practice03
Cybersecurity
Build resilient security architecture, governance and operating capability.
Explore practice04
Security Transformation
Turning board intent into operating capability, evidence and measurable improvement.
Explore practice05
Academy
Your people learn what we practise, in an Academy built as an institution.
Explore practiceWhy organisations choose us
Every proposal names the people who do the work, before you sign anything.
Nobody is assigned after you sign. You know who leads your engagement before you commit.
Senior-led is structural, not aspirational: there is no junior rate card to staff from.
Steve Sharma's ASD IRAP endorsement, CISSP, CISM, CREST, SABSA, TOGAF and ISO/IEC 27001 Lead Auditor, each verifiable with its issuer.
Governance and technical security should not operate in separate silos. We connect executive governance, security architecture and technical assurance under one coordinated mandate.
How the model differs
| The question you'd ask | Large network | Specialist boutique | Platform / software | Cybersecurity Link |
|---|---|---|---|---|
| Who exactly does the work? | Varies by engagement | Varies by firm | Software | Named executive, before you sign |
| Security and AI governance? | Often separate teams | One or the other | Via software | Both, one firm |
| Can they secure what they govern? | Varies | Rarely | No | Yes, governance to red team |
| A fractional CISO and AI executive? | No | No | No | Yes, engaged as a pair |
| Prices before a sales call? | No | Sometimes | Yes | Fixed fee, shared on registration |
| Independent advice? | Often not | Usually | Vendor itself | Yes. No referral commissions, and we never recommend our own platform in our own assessments. |
| 24/7 monitoring and operations? | Yes | No | Yes | No. We do not run a security operations centre |
We put the last row in ourselves. If you need a SOC, we'll point you to one.
06 / THE TEAM
Your named executive
A named senior executive on every engagement.
Founder & PrincipalSteve Sharma
IRAPCISSPCREST
18+ years across four major banks, defence and government. Author, The CISO's AI Firewall.
Cybersecurity DirectorManju Sharma
CISMISO 27001Risk
15+ years leading enterprise risk, governance and compliance programmes across government and regulated sectors.
HR & Admin DirectorSanjeev Kumar
PeopleOperationsCompliance
15+ years overseeing strategic talent management, workforce operations and administrative governance for technology enterprises.
COO India OperationsParas Sharma
OperationsDeliveryAgile
12+ years driving offshore service delivery, operational scaling and cross-border security engineering operations.
Cybersecurity DirectorMansee Sharma
ISO 42001NIST AICloud
Specialist in emerging tech security, AI governance frameworks and cloud security architecture for modern enterprise environments.
Every engagement is assigned a named senior executive before the engagement begins. Where additional specialists are required, they are identified in the proposal and subject to client approval.Meet the executive who'd lead the work
HOW WE WORK
One security architecture. Multiple reference points.
Each has a different job. Our delivery model turns them into operating evidence.
Strategy session
We work out whether we can help. Sometimes the answer is no.
Discovery
What you have, what applies and what is exposed.
Proposal, in writing
Scope, price, named executives and timeline.
Engagement begins
The people named in the proposal do the work.
What changes
REGULATED LENDER
RENEWAL READYEvidence & control readiness
Controls undocumented, then evidenced to underwriter standard. Insurance renewal readiness improved.
INSURANCERENEWAL READYEvidence & control readiness
GOVERNMENT ENTITY
REMEDIATIONFindings structured for close-out
Security leader gone; interim executive in place. Audit findings moved into a structured remediation programme.
AUDITREMEDIATIONFindings structured for close-out
TECHNOLOGY COMPANY
READYGovernance & security readiness
AI in three products, no governance. Certification readiness accelerated.
CERTIFICATIONREADYGovernance & security readiness
Our engagements are covered by NDA. These success stories are anonymised by sector.
Seen enough to want specifics?
A senior executive takes the call, never a sales team.
07 / PRICING
Clear entry points. Indicative fees for registered organisations.
Fixed-scope first steps make it easier to fund the first decision without committing to an oversized programme.
Register to see indicative fees
- Security, AI or Executive Readiness
- Fixed scope, fixed fee
- Written result for your board
Register to see indicative fees
- Credited in full against a retainer
- Prioritised remediation roadmap
- Executive readout
Register to see indicative fees
- Tiers from Establish to Lead
- A named executive on every engagement
- Month to month
Executive Advisory and Security Transformation are scoped in a discovery workshop, because the honest number depends on your size, exposure and obligations.
Full pricingSTART HERE
Choose your starting point.
Four starting points: a self-assessment, an Executive Assessment, the Sprint or ongoing fractional executive leadership.
Free AI Risk Self-Assessment
Fifteen questions, five minutes, your result on screen before we ask for anything. Nobody will chase you.
Take the assessmentExecutive Assessment
A bounded, board-fundable first step with a written result you can take to your next meeting.
See the assessmentsThe Sprint
A focused two-week engagement to identify the problem, establish priorities and produce an executive-ready action plan.
How the Sprint worksFractional Executive Leadership
A named vCISO or vCAIO, on a fixed monthly fee, for as long as you need the seat filled.
Compare engagement modelsTaking something to your board first?
08 // Academy & Author Hub
The method behind our work.
The Academy teaches what we practise. We codified the approach in The CISO's AI Firewall, with a free Executive Mini Book.
Academy Learning Hub
Masterclasses for executives and courses for practitioners, taught by people who do this work. The aim is capability your people can use, not letters after a name.
Capability progression
Phase 01: Free tierPhase 03: Certification
Author Hub
The CISO's AI Firewall
A practical executive framework for securing, governing and deploying enterprise AI.
- ASSESS
- GOVERN
- DEFEND
- MONITOR
- IMPROVE
Insights
Latest intelligence
Living document · AustraliaAustralia's Essential Eight is evolving. What organisations need to know.Board briefingWho's accountable for AI? A 🚩[N]-page briefing for boards.2026-07-28AnalysisGoverning AI without securing it is half an answer.2026-07-14
All insights QUESTIONS WE GET ASKED
The hard questions first.
Enterprise buyers should be able to understand accountability, independence and delivery boundaries before a call.
Why choose a founder-led firm over a larger network?+
Choose a founder-led firm when you want to know who will do the work. We have traded since 2007, led by our founder, Steve Sharma. Every engagement is assigned a named senior executive before it begins.
Who actually does the work?+
The people named in your proposal do the work. No one is swapped in after you sign.
Can you handle an enterprise-scale programme?+
For enterprise-scale programmes, we provide the executive mandate. Where additional delivery capacity is required, we extend capability through our strategic partnership network, including our delivery partner Cyber Arista.
Do you sell security products?+
We build one: AISF, our AI Security Firewall. Our advisory stays product-neutral: AISF is never a condition of an engagement, and we don't recommend it as a finding in an assessment we perform.
Can you assess us, then fix what you found?+
Across different engagements, yes. On the same system, we stay independent.
What does it cost?+
Cost depends on the engagement. Fixed-scope entry points are listed on this page, with indicative fees for registered organisations. Executive Advisory is scoped in a discovery workshop.
08WHERE WE DRAW THE LINE
Trust includes the word no.
Clear boundaries protect independent advice and make accountability easier to verify.
01 / DECLARED BOUNDARY
Certification boundary
We prepare organisations for certification. The audit itself must be conducted by an accredited body.
02 / DECLARED BOUNDARY
Operational boundary
We do not run a 24/7 security operations centre. If that is what you need, we will point you to someone who does.
03 / DECLARED BOUNDARY
Advisory boundary
We provide advisory and governance architecture, not legal advice.
04 / DECLARED BOUNDARY
Independence boundary
On any system assessed under IRAP, we take one role: assessment or advisory. Never both. Assessment or AISF: where we assess a scope, we don't sell AISF into that same scope. 🚩 Steve to confirm this rule.
09 / THE SIGNAL ENDS WITH A NAME
Who is accountable for AI in your organisation?
If the answer is “nobody, exactly,” that is worth a conversation.
hello@cybersecuritylink.com.auA senior executive replies. No sequences and no sales team.
TELL US WHAT IS HAPPENING