About
An independent security practice, based in Sydney.
We work with Australian businesses that need security handled properly but cannot justify hiring for it, and with providers who need a specialist behind them on a particular job.
What we do
Three things, and they connect. We run managed security month to month: detection on your endpoints, monitoring across your domains and certificates, and posture work against the Essential Eight. We take project and contract work with a defined scope: assessments, supplier security assurance and cloud reviews. And we build and look after the web layer underneath, because that is where a lot of small business risk sits.
A meaningful share of our work is subcontract. MSPs, IT providers and consultancies bring us in when a job needs security assurance expertise or extra assessment capacity, and we work under their brand.
We carry professional indemnity and cyber liability insurance, and can provide a certificate of currency for vendor onboarding.
How we work
Attacker mindset
We look for real paths to compromise. What matters is what someone could actually do with your systems, not how many boxes are ticked.
Engineer-grade reporting
Findings are written for the person who has to fix them: specific, reproducible, with remediation advice that names the actual change.
No lock-in
We document as we go and hand it over. Knowledge transfer is part of the engagement, not an upsell.
Open by default
We build security tools and give them away on sec.team, because better tooling raises the baseline for everyone.
Who you work with
Rinto Ismail
Principal, exit.codes · Sydney, Australia
Rinto brings more than 15 years in technology, including six years specialising in cyber security. His background spans data centres, networks, servers, virtualisation and service delivery, alongside security programmes, technology roadmaps and advice to executive teams.
That combination shapes the work at exit.codes: understanding the business concern, checking the technical evidence and explaining what to do next. You work directly with the practitioner doing the assessment, writing the report and talking through the findings.
The work includes supplier security assurance, Microsoft 365 and infrastructure reviews, incident investigation and digital forensics. Advice and documentation are written for the people who need to use them, with practical priorities and clear next steps.
Credentials
CompTIA certifications spanning security engineering, analysis and risk.
- SecurityX
Formerly CASP+. Advanced security architecture, engineering, governance and risk. - CySA+
Security analysis, threat detection, vulnerability management and incident response. - Security+
Security principles, controls and risk management. - Security Analytics Expert (CSAE)
A stackable credential recognising Security+, CySA+ and SecurityX.