Verazim

Current availability: Verazim currently works with organisations based outside Australia. General enquiries are welcome from anywhere.

Verazim Cyber & Intelligence Analysis

Cyber Security Assessments and Intelligence Analysis.

Two practice areas, engaged separately or together. Cyber Security Assessments: evidence-based reviews of how well protected you are, measured against recognised frameworks, with a clear plan to improve. Intelligence Analysis: structured, sourced assessments of geopolitical developments and cyber threats, covering what is happening, why, and what is likely next. Every engagement ends in clear, prioritised recommendations, with support to find and put in place the right solutions.

Giles B King · Cyber Security and Intelligence Analyst

Make an enquiry View services

Who we work with

Organisations that need to know how secure they are, and what they face

Businesses

Small and mid-sized firms that need to know where they stand against ransomware, business email compromise and account takeover: how well identity, email, endpoints and backups are protected, and what to fix first. Also supplier and partner cyber risk, state-linked intrusion and sanctions exposure in new markets.

International NGOs

Humanitarian, development, human rights and media-freedom organisations protecting staff, partners and sensitive data in hostile environments: phishing and spyware aimed at staff, account security, and secure handling of data about the people they serve.

International organisations

UN agencies, regional and multilateral bodies needing independent cyber threat intelligence, security assessments of programmes and country offices, and country analysis, through individual consultant contracts.

Universities and research groups

Research security and foreign interference: state-sponsored targeting of researchers' accounts and devices, protection of sensitive research data and collaboration platforms, and the security of research partnerships.

Services

Two practice areas: how secure you are, and what you face

Cyber security assessments show how well protected you are and what to fix first. Intelligence analysis shows what is happening around you and what is likely next. Each service stands on its own: engage for one area, the other, or both. Every engagement is scoped and priced in writing before work starts, at a fixed price or an agreed rate.

Practice area 1

Cyber Security Assessments

How secure are we, and what should we fix first?

Security SnapshotA quick health check of 8–10 core controls such as multi-factor authentication, patching, backups, admin rights and email security. Red, amber or green ratings and your top five fixes. For organisations of up to 20 staff.1 week · A$1,500–2,500
Security AssessmentA full maturity assessment against the framework that fits your country and sector: Essential Eight, NIST CSF 2.0, CIS Controls or UK Cyber Essentials. Gap list weighted by your threats, and a 90-day plan. Up to 50 staff.2–3 weeks · A$3,000–5,000
Identity and Email Security AssessmentMulti-factor coverage, privileged access, email authentication (SPF, DKIM, DMARC), phishing resilience and account recovery.1–2 weeks · A$1,500–2,500
Technology Service and Integration ReviewA map of the technology you run today, the security capabilities you are missing, and what to implement, in order. For each recommendation you get 2–3 example providers across budget tiers, how each would fit your existing systems, and indicative costs. Vendor-neutral: no referral fees or commissions.2–3 weeks · A$3,000–5,500
Implementation AssuranceIndependent support on your side while your vendor or IT provider puts a recommended technology in place, as oversight or guided implementation. Offered only for technology you have committed to, and only where it adds value beyond what the provider and your own team already deliver. See Recommendations and solutions.Blocks of days · A$750–1,000 a day
Incident Readiness AssessmentYour incident response plan and playbooks checked against recognised guidance and your notification duties, with an optional remote tabletop exercise.2–3 weeks · A$2,000–6,000
Re-assessmentA repeat assessment at 6 or 12 months to measure progress and reset priorities.1 week · A$1,200–2,500

On request: comprehensive multi-framework assessments for larger organisations, third-party cyber risk assessments, and ISO 27001 readiness gap analysis. All assessments are evidence-based. No scanning or penetration testing.

Practice area 2

Intelligence Analysis

What is happening, and what is likely next?

Country and Partner Intelligence AssessmentThe political, security, sanctions and regulatory picture for one country, market or partner, with risk ratings and indicators to watch.2–4 weeks · A$3,000–5,500
Cyber Threat Intelligence BriefThe actors, campaigns and techniques targeting your sector and countries, mapped to MITRE ATT&CK, with prioritised defences.2–3 weeks · A$2,500–4,500
Actor ProfileA state, proxy, criminal or cyber group: its aims, capabilities, recent activity and likely next moves, and what that means for you.1–2 weeks · A$1,500–2,500
Intelligence Requirements WorkshopA half-day session that sets your 5–10 priority intelligence questions and a plan for monitoring them.1 week · A$1,500–2,500
Intelligence WatchA monthly brief against your priority questions (geopolitical, cyber or both), alerts within one business day, and time for questions.3-month minimum · A$1,200–2,000 a month; combined A$2,000–3,200
Leadership BriefingA 60–90 minute briefing for a board or executive team on a country, threat or developing crisis.Booked 2 weeks ahead · A$800–2,000

On request: strategic outlooks and scenario analysis over 12–24 months.

Prices are indicative starting points in Australian dollars, excluding any taxes, and are quoted in AUD, USD, EUR or CHF. International organisations' standard consultant rates apply where they set them. NGO and community-sector organisations receive 25% off list.

From findings to action

Recommendations and solutions

Analysis is only useful if it changes what you do next.

Every report and review closes with specific, prioritised recommendations: what to do, who should own it, how urgent it is, and what it is likely to cost in effort. Advisory engagements include a follow-up call 60 days after delivery to check progress.

Choosing solutions: comparing options and providers against your threats, budget and existing systems (the Technology Service and Integration Review), implementation roadmaps with owners, and the policies and procedures new controls need.

Implementation Assurance: once you have chosen a technology, independent support while it goes in, as oversight or guided implementation. Offered only where the technology is committed to and the support adds real value.

How Implementation Assurance worksDetails

Two forms:

  • Oversight. We write the requirements your vendor or IT provider builds to, review their implementation plan, join the key sessions, and check the finished setup against the requirements using screenshots and exports. We never touch your systems.
  • Guided implementation. Your own administrator makes the changes while we guide them live over a video call, step by step, with each change agreed before it is made.

When we offer it. Implementation Assurance is offered only when both conditions are met, and we will say so plainly if they are not:

  • The technology is actually going in. You have chosen it, budgeted for it and set a timeframe. We do not sell assurance for options still under consideration.
  • We add value you would not otherwise get. Our support must go beyond what the vendor's onboarding and your IT provider already deliver, for example linking the setup to your threats and framework, independent checking, or filling a gap in your team's experience. If the provider's own service covers it well, we will tell you to rely on that and save the fee.

A short fit check before any quote confirms both. Your vendor or IT provider stays responsible for its own work; we hold no administrator access, take no commissions, and do not configure systems ourselves. Every change is signed off by you.

Approach

Judgements you can weigh, not just read

Every assessment follows recognised analytic standards: open sources only, sources graded, facts kept apart from judgements, alternatives considered, and uncertainty stated in plain, consistent words.

Every report contains

  1. Bottom line up front: the answer in three to five sentences.
  2. Key judgements, each with a probability term and a confidence level.
  3. Impact assessment: each risk rated for the severity of its consequences, then combined with likelihood into an overall risk rating.
  4. Analysis that separates reported fact from assessment.
  5. Alternative views and what would make them more likely.
  6. Prioritised recommendations with owners and timeframes.
  7. Indicators to watch and the intelligence gaps that limit confidence.
  8. Annexes as needed: ATT&CK mapping, risk matrix, graded source list.

Reports carry a Traffic Light Protocol label (usually TLP:AMBER) so you know how far they may be shared.

How likely is "likely"?

The house probability scale, used in every report.

TermProbability

How severe is "severe"?

The impact scale, applied to operations, data, finances, reputation and people.

LevelConsequences
1 · MinimalNo meaningful disruption; absorbed in normal operations.
2 · MinorBrief disruption or limited exposure of non-sensitive data; contained internally at low cost.
3 · ModerateDisruption for days, exposure of internal or some personal data, a possible notifiable incident, and noticeable cost.
4 · MajorProlonged disruption, breach of sensitive or personal data, regulatory action, or significant financial or reputational harm.
5 · SevereA threat to the organisation's viability or to people's safety; sustained loss of critical operations or highly sensitive information.

Where a client has its own risk appetite or scale, reports use that instead.

Likelihood × impact = risk

Each risk is placed on this matrix; the rating sets the priority of the recommendation.

MinimalMinorModerateMajorSevere
Almost certainMediumHighHighExtremeExtreme
LikelyMediumMediumHighHighExtreme
Roughly evenLowMediumMediumHighHigh
UnlikelyLowLowMediumMediumHigh
RemoteLowLowLowMediumMedium

Extreme and High risks lead the recommendations, with suggested actions within days or weeks; Medium within the 90-day plan; Low are monitored.

Engagements

How an engagement runs

No work starts until checks are complete and a letter is signed. That protects you as much as us.

  1. EnquiryA reply within one business day.
  2. ScopingThe question, the decision it serves, and the budget.
  3. Acceptance checksIdentity, ownership, sanctions screening and conflicts. Some work is declined.
  4. Fixed-price proposalWithin three business days of the call.
  5. Signed letter and depositEngagement letter and Terms of Business; work begins.
  6. Research and analysisA midpoint update on anything longer than two weeks.
  7. Delivery and debriefFinal report after quality review, then a debrief call.
  8. Revision and close-outOne revision round, 30 days of follow-up questions.

About

Giles B King

Verazim is the independent practice of Giles B King, a Cyber Security and Intelligence Analyst. Every engagement is delivered by Giles personally, so the person you brief is the person who does the work. His background joins two disciplines that matter in this work. Training in psychology brings an understanding of how people judge risk, how bias distorts analysis, and why most cyber attacks succeed through people rather than technology. Postgraduate study in cyber security brings the technical grounding to assess defences against recognised frameworks.

Qualifications

  • Master of Information Technology (Computer Technology, cyber security focus)
    University of Southern Queensland · completing
  • Graduate Certificate in Cyber Security
    Charles Sturt University
  • Graduate Diploma of Psychology
    Deakin University
  • Bachelor of Science (Psychology)
    Macquarie University

The name joins vera, true, and azimuth, a bearing measured precisely from a fixed reference point. A true bearing is what the practice aims to give you: fix the reference points, measure carefully, and state how sure you are.

What Verazim does not do

Clear limits

  • Penetration testing, vulnerability scanning or any offensive cyber activity
  • Hands-on configuration of client systems, or holding administrator access
  • Selling or reselling products, or taking vendor commissions
  • Incident response, managed security or SOC monitoring
  • Physical or protective security, or security equipment advice
  • Investigations of individuals or surveillance of any kind
  • Lobbying, influence campaigns or reports with a fixed conclusion
  • Legal, financial or investment advice

Where you need these, we will point you to licensed or specialist providers.

Policies and terms

How we handle your information and our work

Summaries of the policies that govern every engagement. Full versions are provided with each proposal and on request.

Privacy

Summary

We handle personal information in line with the Australian Privacy Principles, and the EU and UK GDPR where they apply.

  • We collect only what we need: contact details, engagement information, and what you send through this page.
  • This website is hosted by Cloudflare, enquiries sent through the form are delivered by Web3Forms, and email is routed through Cloudflare. These providers process data only to deliver those services.
  • Our analysis focuses on organisations, states, threat groups and public figures in their public roles. We do not profile private individuals.
  • We never sell personal information, and use it for marketing only with consent.
  • Data is protected with multi-factor authentication, encryption and strict separation of client material.
  • AI-assisted tools support research and drafting; every judgement is made and checked by a person, and no decisions about individuals are automated.
  • You can ask to access or correct your information; we reply within 30 days.

Code of Ethics

Summary

Six commitments: independence, honesty, confidentiality, lawfulness, doing no harm, and accountability.

  • Conclusions follow the evidence, not the client's preferences or the fee.
  • Open, lawful sources only: no intrusion, deception, surveillance or use of stolen data.
  • We consider who could be harmed by a report or its misuse, and write to prevent it.
  • Material errors are corrected in writing, free of charge.

Client acceptance and sanctions screening

Summary
  • Every prospective client is checked for identity, ownership, sanctions (Australian, UN and, where relevant, US, UK and EU lists) and conflicts of interest before a proposal.
  • We do not work for sanctioned parties, political campaigns, or anyone seeking to target journalists, activists or other individuals.
  • Work for foreign-government-linked clients is private advisory only.

Information security and data handling

Summary
  • Controls aligned with the Australian Signals Directorate's Essential Eight, including phishing-resistant multi-factor authentication.
  • Four classification levels; your most sensitive material is never emailed as an attachment or carried across borders on devices.
  • Threat intelligence is shared under the Traffic Light Protocol.
  • Records are kept only as long as needed, then securely destroyed.

Terms of Business

Summary
  • Fixed scope and price in a signed engagement letter; changes only by written agreement.
  • Deposit on signing for new clients; balance due 14 days after delivery.
  • Reports are licensed for your internal use and carry a TLP label. Third parties may not rely on them without consent.
  • Analysis is based on open sources with stated confidence and does not guarantee outcomes. Decisions remain yours.
  • Liability is limited as set out in the Terms, without excluding rights that cannot lawfully be excluded.

Contact

Make an enquiry

Organisations, researchers, journalists and anyone else are welcome to ask a general question. If you are considering an engagement, a short description of your organisation and the decision you face is enough to start.

Engagements: Verazim currently works with organisations based outside Australia. General enquiries are welcome from anywhere.

Email

enquiries@verazim.com

We reply within one business day.

Fields marked * are required. Please don't include sensitive or classified information. Your enquiry is delivered to our inbox by the Web3Forms service.