Proactive security
Attack simulation: Red Teaming and Purple Teaming
Our attack simulations consist of planned exercises which attempt to cover relevant threat actor’s methods.
Thomas Murray simulates the most common attack vectors during the following stages

Simulate social engineering via phishing
- Identify high-value targets using internet reconnaissance.
- Craft realistic emails that appear to come from a legitimate source and containing legitimate content.
- Weaponise emails to install our custom malware on the target’s computer or steal authorisation credentials our team will use to access the network.

Simulate insider threat
- Mimic an internal user who has authorised access to the internal network.
- Assess the level of access that can be achieved using authorised equipment, such as laptops.
- Determine whether abuses of policies and procedures can be detected by your organisation.

Attack path validation
Using standard frameworks, such as the Mitre Att&ck framework we work with client teams to identify and test specific attack paths that might be relevant to them.
This may be because of a previous breach and a need to re-test new or tightened controls, or because of an industry or sector-wide cyber security campaign being waged by adversaries.
Cyber risk consulting
Our cyber risk advisory services help organisations to address fundamental challenges and opportunities around cyber risk, resilience and regulation.
The increasing frequency, sophistication and severity of cyber incidents is driving awareness across the business landscape. Thomas Murray’s Cyber Advisory Practice takes a threat-intelligence-led approach to solving our clients’ most complex challenges:

Strategy

Governance

Audit

Compliance

Assessments

Controls
vCISO services
Virtual CISOs (vCISOs) act as a friendly challenger and partner to organisations’ executive management and board as they seek to mature their cyber security posture.
The vCISO acts as your single point of contact, supported by our team of experts with experience across all the cyber domains. They provide regular advice and support to any cyber security initiatives within the business, while keeping management up-to-date on key cyber threats and issues.

Cyber risk management

Management reporting

As-needed subject matter expertise (SME) advice and support

Cyber programmes and transformation
Maturity assessment
Our skilled team members use subject matter expertise (SMEs) as the basis for a comprehensive approach to conducting cyber security reviews against industry frameworks (such as ISO 27001, NIST, CIS etc).
We combine interviews with output from Thomas Murray’s Orbit Risk platform to provide strategic and operational views of cyber security across the business. We seek to answer key questions:

Are cyber security controls implemented across the whole business?

Are the adopted practices aligned to good practices?

Are current security-related initiatives sufficient? What more does the organisation need to invest in?

How is the business organised to ensure appropriate resources, responsibilities and accountabilities are in place?

Is the organisation managing cyber risk appropriately?

Does the organisation have good capabilities to detect and respond to cyber attacks?

What is involved in undertaking a cyber security transformation journey?
We safeguard clients and their communities
Insights

Digital forensics and eDiscovery: An introduction for beginners
Key points Digital forensics is the process of uncovering and interpreting electronic data for use as evidence in an investigation Digital…

Cyber security of Australia’s super funds under scrutiny
Australia is ranked as the world’s fifth most powerful ‘cybernation’, with a cyber security market valued at US$5.99bn in 2023 and expected to…

Tabletop exercises: Where to start
Knowing how to deal with the fallout from a major cyber incident is just as important as knowing how to prepare for one. In cyber security…