01
Independent by design
Independent advice, with nothing to sell
Instead of
A product or platform to buy
You know the risk is realDo you know where you stand?
Cyber and responsible-AI advice led by a former CISO, with nothing to sell you but the truth about your risk.
Clarity for your next move Protection for what matters
01Governance and Risk
The outer layer: leaders who understand the risk and have the evidence to decide. Board reporting, policy alignment and a cyber committee that works.
Explore service
02Audit and Assessment
Independent assurance that your controls do what you think they do, against the framework that matters to you.
Explore service
03Privacy and Data Protection
Making sure the personal information people trust you with is collected, stored and shared safely.
Explore service
04Responsible AI
Governance and risk assessment for the AI tools your staff are already using, aligned to ISO 42001.
Explore service
05Cybersecurity Uplift
A maturity baseline, a roadmap sized to your team, and hands-on help to deliver it.
Explore service
06Incident Resilience
The inner layer: when something does get through, a practised plan keeps services running for the people who rely on you.
Explore serviceStart with your question
Audit and AssessmentExplore this serviceWhere we'd start
Audit and Assessment
We review your controls against the framework your auditor will use, then show you the gaps while there is still time to fix them.
Usual first step
A readiness review against ISO 27001, Essential Eight, NIST CSF 2.0, IRAP or CMMC
- The gaps, found before your auditor finds them
- Fixes ranked so your team knows what comes first
- Evidence organised and ready to hand over
[Short approved quote from a client who prepared for an audit]
Cyber advice without the usual baggage
02
Senior expertise
A former CISO on your engagement
Instead of
A junior consultant once the contract is signed
03
A plan you can use
A ranked plan your team can actually deliver
Instead of
A thick report and a checklist
04
Calm, practical support
Calm, practical next steps
Instead of
Fear about the next attack
[Approved testimonial from Goodstart Early Learning, one or two sentences about the outcome.]
[Outcome headline for a health client]
Hunter New England PHN
Read the case study2 of 3: Hunter New England PHN
Led by someone who has sat in your chair
Video to be suppliedA conversation with Kat
Kat McCrabb
Founder, Flame Tree Cyber
- Former CISO
- IRAP assessor
- ISO 27001 Lead Auditor
- ISO 42001
- CISM
- CRISC
- AISA Queensland committee
Four steps from first call to a plan
- 01
We talk
30 minutes on your situation, obligations and deadlines.
- 02
We scope
A written proposal: what we'll look at, against which standard, by when.
- 03
We assess
Alongside your team, asking for evidence once, not five times.
- 04
You get a plan
Findings ranked by risk, a roadmap and a board-ready summary.
Who we help
- 01
Education
Schools, early learning and education offices protecting student and family information.
- 02
Healthcare
Primary health networks and care providers keeping patient information safe.
- 03
Not-for-profit
Charities and community services protecting donor and client data on a careful budget.
- 04
Local government
Councils keeping essential services running and community trust intact.
Find out where you stand in 30 minutes
A free first call with a senior practitioner. No obligation and no sales pitch. We reply within [one business day, to confirm].
Or call
We only use your details to reply to you.