Managed security · Projects · Sydney
Security that runs every day, not just audit week.
exit.codes is an independent security practice in Sydney. We monitor and defend Australian businesses month to month, take contract work from providers who need a specialist, and build the web infrastructure underneath both.
Three ways we work with you
Most clients start with one and grow into another. You are not required to take all three.
Managed Security
Endpoint detection, infrastructure monitoring and email authentication, checked continuously and reported monthly. You get alerts a person has already triaged, not another console to learn.
Explore managed security → Point in timeSecurity Projects & Contract
Work with a defined end. Attack surface and cloud reviews, incident response and digital forensics, framework gap assessments. We also take subcontract work for other providers, under their brand.
Explore projects and contract → Build and maintainWeb & Digital
Websites, technical SEO, back end development and platform migrations. A lot of the risk we find in small businesses lives in web plumbing that nobody owns.
Explore web and digital →Managed security
What being covered actually means
No dashboard you never open, and no alert queue handed straight back to you. We watch it, we triage it, and we tell you what needs doing.
Always on
- Endpoint detection agents across your fleet, monitored and kept current
- DNS record change monitoring on every domain you own
- TLS certificate expiry and chain validation before anything lapses
- Email authentication drift, so SPF, DKIM and DMARC stay enforced
- External attack surface tracking as your estate changes
- Patch and hardening posture against the Essential Eight
What lands in your inbox
- Alerts that a person has already triaged, with the noise removed
- A plain English monthly report you can hand to your board or insurer
- A running remediation list, prioritised, showing what changed since last month
- Direct access to the person doing the work, not a ticket queue
- Immediate contact when something is genuinely urgent
For MSPs, IT providers and consultancies
Capacity you can put your name on.
Providers bring us in when a job needs a specialist, or simply another pair of hands. We work under your brand, report in your format, and stay out of your client relationship. We carry our own professional indemnity and cyber liability cover, and can provide a certificate of currency for your vendor onboarding.
What we take on
- Incident response and digital forensics, including imaging and chain of custody
- Threat hunting across an estate you already manage
- Overflow assessment and reporting work when your team is at capacity
- Named expert engagements, including evidence for proceedings
How it works
- You stay the prime. We contract to you, not to your client
- White labelled deliverables, or co-branded if you prefer
- A signed master agreement once, then a short scope per job
- Wholesale rates that leave you margin on the engagement
How we work
Findings you can act on
Every finding comes with how we found it and what to do about it, written for the person who has to fix it.
No lock in
We document as we go and hand it over. If you leave, your team keeps everything we built and knows how it works.
Properly contracted
A master agreement and a written scope before work starts. Professional indemnity and cyber liability cover, certificate of currency on request.
One person, not a queue
You deal with the practitioner doing the work. Nothing is handed to a first level desk that has to escalate it back.
We work to
Free tools, open to everyone
We build monitoring tools and give them away. They run the same checks we run for clients, and they are how most people meet us.
DNS Canary
DNS change monitoring and an A to F domain health grade.
SSL Sentinel
Certificate expiry, chain and protocol monitoring.
Email Security
Deep SPF, DKIM, DMARC, MTA-STS and BIMI analysis.
DNS Map
Subdomain discovery across certificate and passive DNS sources.