Assessment disclosure

Why this page exists

A cyber security assessment is a snapshot taken under defined conditions, with defined evidence, against a defined framework. This page sets out exactly what those words mean at Obscura: what our reports promise, what they don’t, and how you should read them.

1. The framework

Our flagship engagement assesses your firm against the Australian Signals Directorate’s Essential Eight Maturity Model, using ASD’s published Essential Eight Maturity Model and Assessment Process Guide. Vulnerability findings are scored using CVSS v3.1. Web-application findings reference the OWASP Top 10.

We do not invent maturity criteria. We do not score against private or proprietary frameworks. Anything we mark as ML0, ML1, ML2 or ML3 is defensible against the published ASD definition.

2. Evidence quality

Every finding in an Obscura report carries an evidence tier. We are explicit about this because the strength of the evidence determines how confidently you can act on the finding.

• Excellent: simulated testing. We performed an action and observed the system’s response (e.g., dropping a test macro and confirming Office blocked it).
• Good: direct configuration query. We retrieved the actual configuration from the system (e.g., PowerShell, Microsoft Graph, Workspace Admin APIs, scanner output).
• Fair: exported settings or screenshots. We reviewed point-in-time exports or screenshots that you provided.
• Poor: verbal assurance. A staff member told us. Findings at this tier are clearly marked and we recommend re-assessing them with stronger evidence.

3. Sampling

Where 100% coverage is not feasible, we sample. Our defaults:

• Privileged accounts: 100% reviewed.
• Servers: 100% if fewer than three, otherwise a minimum 30% sample weighted toward business-critical roles.
• Workstations: 100% if fewer than 11, otherwise a minimum 30% sample.
• Mobile devices: minimum 50% sample.
• SaaS applications: 100% of those in the agreed scope.

The exact sample set is listed in the appendix of every report.

4. AI-assisted analysis

We use large language models, currently those provided by Anthropic, to accelerate parts of analysis and the first draft of every report. We do this transparently for three reasons:

1. It is faster, and we pass that speed on as price.
2. Used correctly, it improves consistency across engagements.
3. You deserve to know how your report was produced.

Every finding is human-reviewed. Before any report ships, your engagement lead validates each finding against source evidence, re-tests where appropriate, and personally signs the cover page. AI does not sign reports. Obscura does.

We do not feed the AI any data that you have not authorised us to feed it under the engagement Statement of Work. We do not use your data to train any model.

5. What we do not claim

Reading a report from Obscura, you should understand that we are not claiming:

• That your environment is “secure”. Security is not a binary state.
• That every vulnerability has been found. Scanners and methodologies have known limits.
• That remediation will not introduce new issues. Change always carries risk.
• That the maturity score will remain accurate beyond the assessment window. New vulnerabilities and configuration drift happen daily.
• That third parties (your IT provider, your hosting provider, your SaaS vendors) will perform as documented.

What we do claim: the findings in the report are real, validated, mapped accurately to the framework, and were observed at the date listed on the cover page.

6. Authorisation and the law

All testing is conducted under written authorisation from a person empowered to give it for your organisation. This protects both parties under Part 10.7 of the Criminal Code Act 1995 (Cth). We do not perform any activity not listed in the signed scope.

7. Liability

Engagement-level liability is capped at the fees paid for the engagement, the industry standard. The cap is stated in your signed Master Services Agreement.

Nothing in this disclosure excludes any non-excludable obligation under Australian law.

8. Questions

If anything on this page is unclear before, during, or after an engagement, ask. We would rather over-explain than under-disclose.

[email protected]