AI-Powered Security Assessment
Answer scenario-based questions to discover which compliance frameworks your organisation needs, identify critical gaps, and get a prioritised roadmap — completely free.
18
Questions
5
Phases
20+
Frameworks
5 min
To Complete
Phase 1: Regulatory Context
1 of 18
Where is your organisation primarily based?
Your jurisdiction determines which regulatory frameworks are mandatory vs. voluntary.
Phase 1: Regulatory Context
2 of 18
Which industry best describes your organisation?
Why this matters: Different industries have sector-specific regulations that mandate certain security frameworks. A hospital must comply with health data laws, while a bank faces prudential standards — choosing the wrong framework wastes time and budget.
Phase 1: Regulatory Context
3 of 18
Does your organisation handle government data or hold government contracts?
Scenario: Your company wins a contract to build software for a federal agency. The contract requires you to handle PROTECTED-level data. You now need an IRAP assessment at PROTECTED level before you can access any government systems. Without it, the contract cannot proceed.
Phase 1: Regulatory Context
4 of 18
What types of sensitive data does your organisation process?
Select ALL that apply. Each data type triggers specific regulatory requirements.
Select all that apply
Phase 1: Data Privacy & Consent
5 of 18
How does your organisation manage data privacy obligations?
Scenario: A customer exercises their “right to be forgotten” under GDPR. Your team needs to locate every system that holds this person’s data, verify deletion, and provide evidence within 30 days. Without a privacy governance framework, this becomes a panicked, manual scramble across 20 systems — with no audit trail proving you complied.
Phase 1: Data Privacy & Consent
6 of 18
How do you manage user consent for data collection and processing?
Scenario: Your marketing team wants to email 50,000 customers about a new product. Legal asks: “Can you prove each person consented to marketing communications? Can you show when they consented, what they consented to, and whether any have withdrawn?” If your answer involves a spreadsheet, you have a consent management gap.
Phase 1: Data Privacy & Consent
7 of 18
Does your organisation transfer personal data across national borders?
Scenario: Your Australian company uses AWS US-East for hosting, Google Workspace (US-based), and a Philippines-based BPO for customer support. Under the Australian Privacy Act APP 8, you must ensure overseas recipients comply with the APPs. Under GDPR, transfers outside the EU require Standard Contractual Clauses. Violations carry fines up to 4% of global turnover.
Phase 2: Threat & Risk Landscape
8 of 18
How many employees and managed identities does your organisation have?
Why this matters: An organisation with 50 employees managing 200 cloud accounts has fundamentally different identity governance needs than one with 20,000 employees across 15 countries. The scale determines whether manual processes will work or if you need automated lifecycle management.
Phase 2: Threat & Risk Landscape
9 of 18
Has your organisation experienced a security incident in the last 24 months?
Scenario: After a phishing attack compromised an executive’s email, the attacker used their credentials to access the finance system and initiate fraudulent wire transfers. The board now demands a full security assessment and evidence that controls are in place to prevent recurrence.
Phase 2: Threat & Risk Landscape
10 of 18
Do your clients or partners require you to demonstrate compliance?
Scenario: A Fortune 500 prospect sends you a vendor security questionnaire. They require a SOC 2 Type II report before they’ll sign the contract. Your competitor already has one. Without it, you lose the deal worth $2M annually.
Phase 2: Threat & Risk Landscape
11 of 18
How many third-party SaaS applications and vendors have access to your data?
Why this matters: The MOVEit breach (2023) and Optus breach (2022) demonstrated how third-party supply chain risk can be catastrophic. Each vendor with access to your data is a potential attack vector that needs governance.
Phase 3: Current Security Posture
12 of 18
How do you currently manage user access and identity lifecycle?
Scenario: An employee resigned last Friday. On Monday, their Active Directory account is still active, their Jira access is unchanged, and their GitHub repos still have their SSH keys. HR sent an email to IT, but nobody actioned it yet. Sound familiar?
Phase 3: Current Security Posture
13 of 18
What is your infrastructure and cloud environment?
This determines your attack surface and which cloud security frameworks apply.
Phase 3: Current Security Posture
14 of 18
Which security controls do you currently have in place?
Select ALL that apply. This helps us identify gaps against recommended frameworks.
Select all that apply
Phase 3: Current Security Posture
15 of 18
What keeps you up at night? Select your top identity security concern.
Scenario: Your CISO presents to the board. The first question is: “Can you tell me exactly who has access to our crown jewels right now?” If you can’t answer confidently in under 60 seconds, you have an identity governance problem.
Phase 4: Readiness & Priorities
16 of 18
Are any of these sector-specific regulations applicable to you?
Select ALL that apply. These trigger mandatory framework requirements.
Select all that apply
Phase 4: Readiness & Priorities
17 of 18
What is your approximate annual budget for security and compliance tooling?
Context: The average mid-market Australian company spends 5–8% of IT budget on cybersecurity. Legacy IGA platforms (e.g., on-premise solutions) typically cost A$80K–250K/year. Activitee delivers equivalent capability from A$8K/year.
Phase 4: Readiness & Priorities
18 of 18
What is driving the urgency for this assessment?
Understanding your timeline helps us prioritise recommendations.