Security Strategy & vCISO
Board-ready direction and a prioritised roadmap, delivered as fractional CISO leadership that turns cyber risk into clear, costed decisions.
Learn more →Independent cyber assurance and strategy for New Zealand and Australian business. We help you become cyber-secure and cyber-safe, ready for the standards your customers and insurers expect, and ready for secure AI adoption.
A no-obligation conversation about where you stand and where to start.
Strong security starts with clarity: knowing where you stand, what matters most, and what to do next. These are the services Mosaic delivers now, independent of any product we might sell you.
Board-ready direction and a prioritised roadmap, delivered as fractional CISO leadership that turns cyber risk into clear, costed decisions.
Learn more →A clear, evidence-based view of your cyber risk, security maturity and architecture, measured against the Essential Eight, NIST CSF 2.0, NZISM and ISO 27001 across cloud and on-premise, so investment goes where it counts.
Learn more →Policies, frameworks and audit-readiness that fit how you work, covering ISO 27001, SOC 2, Essential Eight and SMB1001, plus third-party and supply-chain risk and secure SDLC review against OWASP SAMM.
We take your systems through NZISM Certification and Accreditation: assembling the control evidence, supporting the independent certification assessment, and preparing the residual-risk case your accreditation authority needs to sign off.
Learn more →Structured assessment of privacy risk for new projects, systems and data flows, aligned to the NZ Privacy Act 2020 and Office of the Privacy Commissioner guidance, with clear, defensible findings.
Learn more →Secure AI adoption, end to end: AI readiness assessments, shadow AI reviews, and AI governance frameworks aligned to ISO/IEC 42001, the NIST AI RMF and the CSA AI Controls Matrix, so you can adopt AI fast and prove it is governed.
Learn more →AI governance is a risk discipline, not a policy exercise. We establish what your people may use AI for, on what data, and with what oversight, then record those decisions so they stand up to scrutiny.
AI readiness assessment and shadow AI review. A register of every AI use case, the assets and data each one touches, and the threats acting on them, risk rated with named owners.
AI acceptable use policy in plain language. An approved tools list, limits on what data may be entered that reflect your privacy, confidentiality and contractual obligations, and a simple route to request something new, so staff know exactly what they can and cannot do.
AI governance framework aligned to ISO/IEC 42001, the NIST AI RMF and the CSA AI Controls Matrix. Proportionate controls, human oversight where it matters, and accountability that holds up to scrutiny.
ISO/IEC 42001 readiness and an evidence pack for clients, insurers and auditors. With governance settled, you can widen AI use with confidence.
Our assurance and strategy work is live today. Next, we're adding a 24/7 managed capability and offensive testing, delivered with carefully chosen partners, so Mosaic covers you end to end. Register your interest and we'll tell you the moment they launch.
Continuous, expert-led detection and response across your endpoints, identity and cloud, without you building a team.
Round-the-clock monitoring, with analysts covering your business hours and overnight cover from partner teams in other time zones.
Hands-on testing of your applications, networks and cloud to prove what an attacker could really do, and how to stop them.
Every engagement follows the same disciplined path, so your security becomes deliberate, measurable and something you can prove.
We map your assets, the threats acting on them, and your current maturity against the frameworks that matter to your business and your customers.
We turn findings into a prioritised, board-ready roadmap of pragmatic actions matched to your risk appetite and budget.
We help you close the gaps: controls, governance, architecture and maturity uplift against your chosen framework, with hands-on support.
We validate the result independently and keep measuring it, so you can demonstrate your posture with confidence.
We don't resell products, so our only agenda is your security. We start with your business risk, turn it into decisions your board can act on, and build protection in layers, like a mosaic, so nothing rests on a single control.
We take no product commissions and have nothing to sell but our expertise, so every recommendation is made in your interest, not ours.
Tools can't rescue a weak strategy. We get the thinking, governance and priorities right first, then let the technology follow.
We translate the frameworks that matter, from the Essential Eight and SMB1001 to NIST CSF 2.0, NZISM and ISO 27001, along with your obligations under the NZ Privacy Act 2020, into plain, affordable actions sized for a small or medium business, so you become genuinely cyber-secure and cyber-safe, not just compliant on paper.
Plain-English reporting, prioritised actions and measurable outcomes, so you always know where you stand and what to do next.
Cyber-secure and cyber-safe, proven with evidence you can put in front of your board, your customers and your insurers.The Mosaic Cyber Defence promise
Mosaic is led by a practitioner with more than 25 years in senior security and technology roles, spanning CISO, CIO, CTO and COO. You work directly with that seniority, not a junior learning on your account. And because we sell no products and earn no vendor commissions, our advice answers to you, not a supplier.
Book a no-obligation conversation. We'll get to grips with your situation, show you where the real risk sits, and scope the work needed to get you there.