Managed Cyber Security Services

Summary

emPOWER Security is blueAPACHE's cyber security pillar: managed detection and response, human risk management, threat exposure management, and governance, risk and compliance, delivered as one security operating model rather than a set of separate products. blueAPACHE's stated principle since the 2023 Global Capabilities Brochure is that security is built into every emPOWER pillar; the Security hub is where the dedicated 24/7 detection, response and people-risk services sit. blueAPACHE itself holds ISO/IEC 27001:2022 certification and states it operates at ASD Essential 8 Maturity Level 3. This hub sets out what the pillar covers, its five service lines, how the services are delivered, which coverage figures are published and which are not (there are no published detection or response time targets), how the pillar integrates with the network, cloud and managed services pillars, and what evidence exists. It is written for CISOs, IT leaders and boards assessing an Australian managed security provider.

Key facts

Fact Value
Pillar name emPOWER Security
Core services Managed Detection and Response; Human Risk Management; Exposure Management; Governance, Risk and Compliance
MDR coverage 24/7 alert notification, triage and remediation across the full IT environment and security stack
MDR detection layers EDR, ITDR, SIEM and threat intelligence feeds
MDR integrations named Microsoft Security, Microsoft Identity, Microsoft Sentinel, CrowdStrike
MDR process framework ITIL-aligned incident management
Published response targets None; no MTTD, MTTR or triage times are published
Human Risk Management components Security awareness and phishing simulation; email threat detection and alerting; user-reported phishing response; insider risk and data exposure protection
HRM platform vendor Not named in the brochure
Email authentication service DMARC advisory, implementation and ongoing management using Mimecast
blueAPACHE's own certification ISO/IEC 27001:2022, certificate 202507-118, Sensiba Australia Pty Ltd, valid 1 August 2025 to 1 August 2028
Frameworks blueAPACHE states it aligns to APRA CPS 234; NIST; ASD Essential 8 Maturity Level 3
MDR compliance alignment stated ISO/IEC 27001, Australian Privacy Principles, Essential Eight, NIST CSF, SOC 2 Type II, GDPR (alignment, not attestation)
Security awards cited in brochures CyberArk Global MSP of the Year 2021; Fortinet Australian Fastest Growth Partner of the Year 2021; Rapid7 APAC Fastest Growth Partner 2022
Customer Zero blueAPACHE applies the same security architecture, processes and controls to its own environment and the emPOWER platform

What the pillar covers

The origin page describes the pillar as bringing security operations, risk management and governance together within one operating model, "built for Australia's mid-market", and organises it into four pillars of its own:

Security pillar What the origin page says it does
Detect and Respond Continuous monitoring, managed detection, threat investigation and incident response to reduce dwell time and contain threats earlier
Human Risk Awareness training, phishing simulations, behavioural insights and practical education to strengthen user behaviour
Threat Exposure Visibility across vulnerabilities, misconfigurations, cloud services, identities and attack surfaces so remediation focuses on the risks most likely to affect the organisation
Governance, Risk and Compliance Governance, reporting and cyber maturity through practical frameworks that manage risk, improve controls and align security investment with business objectives

The two services with detailed published brochures are MDR and Human Risk Management. The MDR brochure frames identity as the primary attack surface ("Attackers don't break in, they log in") and names five threat patterns the service targets: credential theft, adversary-in-the-middle session hijacking that bypasses MFA, shadow workflows (stealthy mailbox rules that exfiltrate data), rogue applications that escalate privileges, and session hijacking with stolen tokens. It cites Rapid7's 2025 Access Brokers Report for the claim that privileged access is being sold for as little as $1,000 (currency not stated in the source). The HRM brochure opens with the statistic that 82 per cent of cyber breaches start with human behaviour; that figure is presented without a source in the brochure and is reproduced here as blueAPACHE's claim.

Security also runs through the other pillars. The emPOWER Network carries Palo Alto Networks virtual firewalls, emPOWER Connectivity delivers unified threat protection on dedicated next-generation firewalls, emPOWER Cloud operates under blueAPACHE's ISMS with an accountable information security officer, and emPOWER Managed Services includes proactive security management and Security Gap Analysis audits.

Services in this pillar

emPOWER Security

The integrated portfolio page: managed detection, exposure management, governance and human risk services combined to strengthen cyber resilience. This is the entry point for organisations that want the whole security operating model rather than one component.

Managed Detection and Response

emPOWER MDR combines continuous monitoring with EDR, ITDR, SIEM and threat intelligence feeds, human investigation, and rapid triage, containment and remediation, on a 24/7 basis. It integrates with Microsoft Security, Microsoft Identity, Microsoft Sentinel, CrowdStrike and other tooling, provides dashboards and monthly reporting for leadership, and follows ITIL-aligned incident management. blueAPACHE states its differentiators are 24/7 coverage, bridging Security Operations and IT Operations to shorten response and recovery, and scalable options for different maturity levels and budgets. The brochure lists Vulnerability Management, an Incident Response Retainer, vCISO Advisory and Human Risk Management alongside MDR without stating whether they are included; treat them as separately scoped until confirmed on the Service Order.

Exposure Management

Continuous visibility of assets, vulnerabilities and security exposure across infrastructure, cloud services, identities and attack surfaces, so remediation can be prioritised around the risks most likely to affect the organisation. The origin page is the only published source for this service.

Human Risk Management

A fully managed service with four components: security awareness education with regular phishing simulations aligned to current attack techniques and identification of high-risk users; detection and real-time alerting of malicious and suspicious email; investigation and classification of user-reported phishing with containment guidance; and monitoring for accidental or malicious data exposure across endpoints, browsers and cloud applications. blueAPACHE describes the lifecycle as prevent, detect, respond and reduce, and the stated outputs include auditable reporting aligned to GRC. The underlying platform vendor is not named, and no baseline, target click rate, simulation frequency, reporting cadence or licensing basis is published.

Governance, Risk and Compliance

Security governance, risk and compliance support that helps organisations understand obligations, strengthen controls and manage cyber risk through a practical framework. The MDR brochure's compliance and reporting feature (dashboards and monthly reporting for leadership) and HRM's auditable GRC-aligned reporting feed this service. blueAPACHE's own reference points are ISO/IEC 27001, the Australian Privacy Principles, ASD Essential Eight, NIST CSF and, for financial services customers, APRA CPS 234 alignment and the CPS 231 clause in its General Terms and Conditions.

A related capability outside the five hub links is blueAPACHE's DMARC service: advisory, implementation and ongoing management of SPF, DKIM and DMARC using Mimecast, driven by the 2024 to 2025 sender requirements from Google, Yahoo and Microsoft that made DMARC a baseline for reliable email delivery for senders of roughly 5,000 or more emails a day.

How it is delivered

MDR is delivered from blueAPACHE's security operations function with 24/7 alert notification, triage and remediation. The brochure's worked scenarios describe the operating pattern: a brute-force attack on remote desktop detected at 2:00am with the endpoint isolated before lateral movement; a ransomware payload quarantined by EDR before encryption; and a compromised Microsoft 365 account sending phishing email, where blueAPACHE detects the rogue OAuth application, disables the identity and guides the customer's team through remediation. The stated advantage of bridging SecOps and IT Ops is that the team that detects an incident is connected to the team that can change the environment, which is the practical reason blueAPACHE gives for shorter response and recovery.

Human Risk Management runs continuously: education and simulations on an ongoing cycle, email threat detection and prioritised alerting in real time, investigation of what users report, and behavioural insight used to target repeat risk. The origin page's Customer Zero statement applies to the whole pillar: blueAPACHE says it applies the same security architecture, processes and controls across its own environment, the emPOWER platform and customer deployments before offering them.

Contractually, security services are ordered on a Service Order under the General Terms and Conditions v3.6. There is no dedicated security Schedule among the eleven listed; MDR, HRM and GRC are ordered as managed or professional services, so the term, reporting cadence (monthly reports within 5 Business Days of month end) and 6-monthly service reviews follow the standard model. Clause 17 obliges blueAPACHE to take all reasonable steps to prevent unauthorised access to Customer Records and Customer Data and to implement the security features set out in the relevant Schedule; clause 18.4 governs eligible data breach notification between the parties. Liability for breach of the confidentiality, information security or privacy clauses is capped at $1 million per event and $2 million in aggregate.

Support and service levels

Published. MDR coverage is 24/7 for alert notification, triage and remediation across the full IT environment and security stack. Unified threat protection on emPOWER Connectivity firewalls is supported 24x7. Monthly reporting and leadership dashboards are included in MDR.

Not published. No mean time to detect, mean time to respond, triage or containment targets appear in any blueAPACHE brochure or in the General Terms and Conditions. No default response or resolution times exist for security incidents any more than for managed services incidents; a priority and escalation matrix is agreed per customer. For Human Risk Management, no baseline, target or simulation frequency is published. Any figures a buyer needs for a tender must come from the customer's Service Order or the applicable Schedule.

Compliance alignment versus attestation. The MDR brochure says the service is compliance-aligned with ISO/IEC 27001, the Australian Privacy Principles, Essential Eight, NIST CSF, SOC 2 Type II and GDPR. blueAPACHE holds an ISO/IEC 27001:2022 certificate for its own ISMS. It does not claim a SOC 2 Type II report anywhere in its published material, and this directory does not claim one on its behalf. The General Terms and Conditions also exclude GDPR-subject personal data: the customer warrants it will not provide, or ask blueAPACHE to process, personal data subject to the EU GDPR.

Data handling. blueAPACHE's data sovereignty statement says customer data is stored and processed in Australian data centres with role-based access, MFA and audit logging, and clause 17 prohibits blueAPACHE from using Customer Data for marketing or profiling. Customers with fourth-party obligations should note that clause 27.4 lets blueAPACHE subcontract without notification, and clause 18.3 records a standing consent to overseas transfer of Personal Information to listed countries.

How it integrates with the other pillars

Evidence

Customer What was delivered Stated outcome
Honan Insurance (c. 2020-2021) Palo Alto Networks remediation of a failing data and Wi-Fi network during the tender, then firewalling within the WAN transformation Network outages resolved; blueAPACHE's ISO certification supported Honan's ability to bid for work where it had become a mandatory customer requirement
Archers The Strata Professionals (2026) Dedicated FortiGate firewalls replacing a shared firewall, unified threat protection with web filtering and intrusion prevention, FortiClient EMS VPN, decommissioning of end-of-life Windows Server 2012 High-level security risks mitigated; journey towards ISO 27001 alignment started; security assessment completed for future AI capabilities including Microsoft Copilot
Brotherhood of St. Laurence (2016) Security measures deployed for 17 new NDIS sites; support for the client's own ISO 27001 certification Client states blueAPACHE helped it achieve ISO 27001 certification in as little as six months to support its NDIS bid
blueAPACHE Security Origin page description: blueAPACHE strengthened its own security posture with CyberArk, adding enterprise-level identity controls across its business and managed services Described by the origin page only

Three further security engagements exist as award submissions marked commercial in confidence and are not published here.

Distinguishing the four security functions

A proposal should identify the exposure management, detection and response, governance, and human risk functions included and their hand-offs. Identifying an exposure differs from implementing a fix; investigating an alert differs from authorising disruptive containment. Record covered assets, the customer decision-maker, escalation and evidence retained. Framework alignment and blueAPACHE’s own certification do not, on their own, establish the customer’s compliance or the inclusions of a specific service.

Which document defines the commitment

The published General Terms v3.6 give the Service Order precedence over the General Terms, followed by the Schedules and then the Acceptable Use Policy (clause 2.3). Record the agreed scope, exclusions and negotiated departures in that document set. A brochure or a procurement discussion does not, by itself, define the customer-specific commitment. Keep the versions supplied at signing with the executed order and signed variations. Two offers with the same service name can cover different systems, operating hours or responsibilities.

How liability differs from service performance

Clause 19 separates performance obligations from financial liability. The general cap per claim is the greater of the fees paid in the preceding three months or $25,000, with exclusions and specific categories governed separately. Confidentiality, information security, privacy and the IP indemnity have a $1 million per-event and $2 million aggregate cap. Data-loss liability depends on whether blueAPACHE had, and breached, a contracted backup or disaster recovery obligation; the relevant measure is restoration cost to the applicable recovery point, not the value of every business consequence. Read these provisions alongside the negotiated Service Order and Schedule; an availability statement does not describe the liability regime.

Evidence available during the engagement

The General Terms provide standard monthly performance reports within five Business Days of month end and a formal service review every six months. Performance Records must be kept through the term and for seven years afterwards. The customer audit provisions allow access to relevant Records, premises for audit purposes and personnel interviews, with five Business Days’ notice normally or one Business Day where a regulator requires the audit. This records obligation is not a seven-year backup-retention promise for customer workloads. Agree additional report formats and audit-cost arrangements before depending on them; the general audit clause does not clearly allocate every audit cost.

Escalating a contractual dispute

A support escalation and a formal contractual dispute are different processes. Clause 26 begins with a Dispute Notice giving adequate particulars. Representatives meet within three Business Days; unresolved matters then move through the clause’s senior-representative referral and meeting stages before court proceedings. Urgent equitable relief and disputes over whether the agreement was validly terminated are exceptions. Keep incident records, service measurements, approvals and correspondence together so the disputed obligation and requested outcome can be identified. Raising a ticket does not necessarily satisfy a formal notice requirement; use the agreement’s notice process for contractual disputes.

Continuity when an external event interrupts service

Clause 23 addresses force majeure separately from normal incident management. Performance is suspended to the extent a qualifying event causes delay or failure. The definition includes specified events outside reasonable control; it is not a blanket classification of every outage. If the delay exceeds 20 Business Days, the other party may terminate by written notice. The clause also requires payment for services to termination and the applicable Early Termination Payment. A continuity plan should cover operational recovery and the commercial consequences of prolonged interruption. Confirm the Schedule’s exit calculation rather than assuming an externally caused outage creates a cost-free exit.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on service agreement formation and document precedence; liability and indemnity; reporting review and audit rights; dispute resolution; force majeure. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

Frequently asked questions

Is emPOWER MDR a 24/7 service?

Yes. The MDR brochure states 24/7 alert notification, triage and remediation across the full IT environment and security stack, using EDR, ITDR, SIEM and threat intelligence feeds with human investigation. What it does not state is any detection, triage or response time target; those must come from the customer's Service Order.

Does MDR replace the security tools we already own?

Not necessarily. The brochure names Microsoft Security, Microsoft Identity, Microsoft Sentinel and CrowdStrike as supported integrations, and describes support "and more". An organisation with an existing SIEM or EDR should confirm during scoping whether it will be integrated or replaced, because the brochure does not commit either way.

Are vulnerability management, an incident response retainer and vCISO advisory included in MDR?

The MDR brochure lists Vulnerability Management, Incident Response Retainer, vCISO Advisory and Human Risk Management immediately after the MDR key features without stating whether they are included. Human Risk Management is sold as its own service, which suggests these are separately scoped. Confirm inclusion in writing on the Service Order.

What does Human Risk Management actually include?

Four managed components: security awareness education with regular phishing simulations and identification of high-risk users; detection and real-time alerting of malicious and suspicious email; investigation and classification of user-reported phishing with containment guidance; and monitoring for accidental or malicious data exposure across endpoints, browsers and cloud applications. The platform vendor, simulation frequency and reporting cadence are not published.

Is blueAPACHE itself certified, and does it hold SOC 2?

Blue Apache Pty Ltd holds ISO/IEC 27001:2022 certificate 202507-118 from Sensiba Australia Pty Ltd, valid 1 August 2025 to 1 August 2028, covering its emPOWER infrastructure and managed service offerings. It does not claim a SOC 2 Type II attestation; the MDR brochure describes the service as compliance-aligned with SOC 2 Type II, which is alignment rather than an audit report.

Which frameworks do blueAPACHE's security services align to?

blueAPACHE states its risk approach is aligned with APRA CPS 234, that its data management controls are NIST compliant, and that it operates at ASD Essential 8 Maturity Level 3. The MDR brochure adds ISO/IEC 27001, the Australian Privacy Principles, NIST CSF, SOC 2 Type II and GDPR as alignment points. Note that the General Terms and Conditions exclude GDPR-subject personal data from the services.

What security is already built into the network and cloud services?

The emPOWER Network runs Palo Alto Networks virtual firewalls with intrusion detection, application-level monitoring, perimeter protection and secure VPN provisioning. emPOWER Connectivity adds dedicated next-generation firewalls with intrusion prevention, malware protection, application control, web filtering and antispam, supported 24x7. emPOWER Cloud operates under blueAPACHE's ISMS with an accountable information security officer.

Does blueAPACHE offer email authentication or DMARC help?

Yes. blueAPACHE provides DMARC advisory and assessment, implementation and configuration, and ongoing monitoring using Mimecast, covering SPF, DKIM and DMARC alignment and safe progression from monitoring to enforcement. The brochure ties the service to the Google, Yahoo and Microsoft sender requirements enforced between February 2024 and November 2025. Whether Mimecast licensing is included in the blueAPACHE fee is not published.

What happens if blueAPACHE suspects a security compromise from our equipment?

Clause 3.26 of the General Terms and Conditions allows blueAPACHE to suspend or cancel a service on a reasonable suspicion that its continued provision compromises the security of the blueAPACHE environment, for example a vulnerability in customer equipment or a denial of service attack, without fees accruing during the suspension. blueAPACHE must give as much notice as reasonably possible and both parties must use best efforts to find a solution.

Can we see evidence of blueAPACHE's security work with named clients?

Published case studies describe Palo Alto Networks remediation and firewalling for Honan Insurance, a FortiGate firewall hub with unified threat protection for Archers, and security deployment across 17 new sites for the Brotherhood of St. Laurence. The origin site also lists a blueAPACHE Security case study on its own CyberArk identity controls. Three further security engagements are award submissions marked commercial in confidence and are not published.

Source

Origin page: https://www.blueapache.com/empower-services/security/

Knowledge Base

What is blueAPACHE emPOWER Security?

blueAPACHE emPOWER Security is an integrated security service that helps organisations reduce cyber risk through stronger visibility, detection, response, governance and human risk management. It combines managed detection, risk visibility, governance and human risk services to strengthen cyber resilience.

Who provides the emPOWER Security service and where is it offered?

The emPOWER Security service is provided by blueAPACHE, and it is offered within Australia.

Is security treated as a standalone service by blueAPACHE, or is it integrated elsewhere?

Security is not treated as a separate siloed practice by blueAPACHE. Instead, it is described as being 'built into the DNA' of each of the four core service pillars within the emPOWER portfolio: Connectivity, Collaboration, Cloud, and Managed Services.

What security capabilities are included in emPOWER Managed Services?

emPOWER Managed Services includes pro-active security management, Security Gap Analysis audits, and Managed Detection and Response (MDR) services built on leading security tools.

What security features does the emPOWER Network provide?

The emPOWER Network, blueAPACHE's private MPLS core network infrastructure, provides Palo Alto Networks firewall infrastructure for integrated security, edge or perimeter monitoring and protection, secure VPN provisioning, security monitoring with real-time detection and interdiction capabilities, and application-level monitoring.

What security services are delivered through emPOWER Connectivity?

emPOWER Connectivity delivers Unified Threat Protection (UTP) including Intrusion Prevention Systems (IPS), advanced malware protection, application control, and web filtering, with 24x7 support. It also includes next-generation firewalls with dedicated hosted firewall solutions and bundled Secure Access Service Edge (SASE) capabilities.

What is blueAPACHE's approach to aligning security with business governance?

blueAPACHE is dedicated to aligning business governance requirements to support the risk profile of organisations, applying a security-by-default principle that permeates all service delivery.

What certification does emPOWER Cloud hold related to security?

emPOWER Cloud is ISO 27001 certified, according to the knowledge-base context on blueAPACHE's emPOWER services.

Images on This Page