How passkeys work, and why you should use them
Sign in with a fingerprint, face or PIN, without typing a password. Learn how passkeys work, why they resist phishing, and how to avoid getting locked out.
Managed security · Projects · Sydney
Security that runs every day, not just audit week.
exit.codes is an independent security practice in Sydney. We help protect Australian businesses month to month, take contract work from providers who need a specialist, and build the web infrastructure underneath both.
$exit-codes status --client acme
Monitoring 14 endpoints, 6 domains endpoint agents 14/14 reporting tls certificates 6/6 valid, none due dmarc policy acme.com.au p=none dns records no changes in 24h detection 1 alert triaged 04:12 Next report: Friday 09:00 AEST $▌
Three ways we work with you
Start with whichever fits. You do not need all three.
Recurring
Managed Security
Endpoint detection, infrastructure monitoring and email authentication, checked continuously and reported monthly. Alert review, escalation and coverage are agreed for your engagement.
Explore managed security → Point in timeSecurity Projects & Contract
Work with a defined end. Supplier security assurance, attack surface and cloud reviews, and framework gap assessments. We also take subcontract work for other providers, under their brand.
Explore projects and contract → Build and maintainWeb & Digital
Websites, technical SEO, back-end development and platform migrations. A lot of the risk we find in small businesses lives in web plumbing that nobody owns.
Explore web and digital →Managed security
What being covered actually means
Monitoring, alert review and reporting with a defined scope. Coverage hours, response targets and escalation arrangements are agreed in writing for your engagement.
Always on
- Endpoint detection agents across your fleet, monitored and kept current
- DNS record change monitoring on every domain you own
- TLS certificate expiry and chain validation before anything lapses
- Email authentication drift, so SPF, DKIM and DMARC stay enforced
- External attack surface tracking as your estate changes
- Patch and hardening posture against the Essential Eight
What lands in your inbox
- Reviewed alerts with context, within your agreed coverage
- A plain English monthly report you can hand to your board or insurer
- A running remediation list, prioritised, showing what changed since last month
- Direct access to the person doing the work
- Escalation through the contacts and response targets agreed with you
We alert, we do not act without you.
Detection and triage are included. Anything beyond that, isolating a machine or locking an
account, needs your written authorisation first. You will always know who changed what.
For MSPs, IT providers and consultancies
Capacity you can put your name on.
Providers bring us in when a job needs a specialist, or simply another pair of hands. We work under your brand, report in your format, and stay out of your client relationship. We carry our own professional indemnity and cyber liability cover, and can provide a certificate of currency for your vendor onboarding.
What we take on
- Supplier questionnaires, assurance evidence and practical policy work
- Threat hunting across an estate you already manage
- Overflow assessment and reporting work when your team is at capacity
- Scoped technical reviews and investigation support, by arrangement
How it works
- You stay the prime. We contract to you, not to your client
- White-labelled deliverables, or co-branded if you prefer
- A signed master agreement once, then a short scope per job
- Wholesale rates that leave you margin on the engagement
Security assurance
Your clients ask for proof of security. We help you prepare it.
Supplier questionnaires, policies that reflect how you work, and technical checks that support your answers. Start with one request and build a reusable foundation.
Who you work with
Meet Rinto Ismail, Principal at exit.codes.
More than 15 years in technology, including six years specialising in cyber security. Hands-on infrastructure experience, security assurance and incident investigation, with advice written for the people who have to act on it. You deal directly with the person doing the work.
Experience and credentials →How we work
Findings you can act on
Every finding comes with how we found it and what to do about it, written for the person who has to fix it.
No lock-in
We document as we go and hand it over. If you leave, your team keeps everything we built and knows how it works.
Properly contracted
A master agreement and a written scope before work starts. Professional indemnity and cyber liability cover, certificate of currency on request.
One person throughout
You deal with the practitioner doing the work. Nothing gets passed to a first-level desk and back again.
We work to
ASD Essential EightISO 27001NIST CSFNIST 800-61SOC 2PCI DSSOWASP Top 10CIS BenchmarksMITRE ATT&CKPrivacy Act 1988Notifiable Data Breaches
Free tools, now on sec.team
We build DNS, certificate and email security checks and give them away. They now live on sec.team, our tools platform.
DNS monitoring
Record change alerts and a domain health grade.
Certificates
Certificate expiry, chain and protocol monitoring.
Email security
SPF, DKIM, DMARC, MTA-STS and BIMI analysis.
Subdomain discovery
Hosts found from certificate logs and passive DNS.
Writing
What we are seeing in Australian small business estates, written up as we go.
Moving from Google Workspace to Microsoft 365: what the process really looks like
We moved our own email from Google Workspace to Microsoft 365. Copying the mailbox was the easy part. Addresses, domains stuck in old tenants and the final checks took longer.
Most DNS change alerts are not incidents
A full run of DNS change alerts with nothing actionable in it. What the noise really is, why the obvious fix is dangerous, and how to spot the real change.