Website Cyber Risk
for Boards & Directors
Directors are accountable for how their organisation protects personal information. We give boards independent technical evidence of the reasonable steps taken to secure websites, member portals and data.
- Board-Ready Reports
- Evidence of Reasonable Steps
- No Jargon
Over a decade of website security expertise
Cyber Risk Is Now a Board Responsibility
APP 11 of the Privacy Act requires organisations to take reasonable steps to protect personal information, and since December 2024 it expressly includes technical and organisational measures. Penalties for serious interferences with privacy have also increased.
The AICD’s Cyber Security Governance Principles put cyber oversight squarely with directors, and the ACNC treats cyber security as a governance responsibility for charity boards. Directors’ duty of care and diligence extends to material risks, and cyber is one of them.
Yet most boards have never seen an independent assessment of the website and member systems that hold their organisation’s most sensitive data.
Evidence Your
Board Can
Actually
Use
Evidence Your Board
Can Actually Use
Evidence Your Board
Can Actually Use
Our Website Security Audit is built for the boardroom. It produces a one-page risk summary in plain English, a full technical report with every finding rated and its fix, and a walkthrough your audit and risk committee can attend.
We look at the places breaches actually start: outdated and end-of-life platforms, abandoned plugins, third-party scripts, member portals, payment pages, vendor access and where personal information really goes.
It is documented evidence of reasonable steps, not a compliance certificate, and we never give legal advice.
What Boards
Get From
Us
What Boards
Get From Us
What Boards
Get From Us
Plain-English Risk Summary
One page your directors can read in five minutes: risk rating, top issues and what they take to fix.
Independent Technical Evidence
A documented, dated assessment by engineers independent of the people who built and run the site, ready for your risk register.
A Clear Remediation Path
Every finding comes with a fix and a priority, so management can act and the board can track progress.
Data Breaches Notified to the OAIC in 2025
Association Breaches Notified in 2025
Of Association Breaches in H2 2025 Were Malicious
Of Australians Concerned About Data Breaches (2026)
How It Works
We confirm your platforms, member systems and data flows, and give you a fixed price before anything starts.
Step 2: Independent
Assessment
Our engineers review your website, integrations and data handling over five business days.
Step 3: Board
Briefing
You get the one-page summary, the full technical report and a walkthrough for your audit and risk committee.
Brands We Have Helped
What People Say
Makes the Magic Happen
“Love the professional finishes . Dustin and the team know how to make the magic happen.”
Sam Hunter
Corporate Headshot Photographer
Always Shows Up
“I have hired Pixelbird many times to build websites and to host. I recommend Dustin and his team without question.”
Kym Bolger
Social Media Marketing
Responsive Professionalism
“Dustin is friendly and good to work with. He is good at finding better ways to provide solutions and automate the processes.”
Ivan Huang
CPA
What You Can Expect
What Boards Need
Pixelbird Audit
Typical IT Report
Plain-English Summary
With Us
One page, written for directors
With Them
Technical jargon
Independence
With Us
Assessed by engineers independent of the build
With Them
Marked by the people who built it
Website & Portal Focus
With Us
Where member data actually lives
With Them
Networks and laptops only
Third-Party Risk
With Us
Vendors, plugins and scripts mapped
With Them
Not covered
End-of-Life Software
With Us
Unsupported platforms identified
With Them
Rarely mentioned
Personal Information
With Us
Data flows mapped against APP 11
With Them
Not assessed
Rated Findings
With Us
Each issue rated with its fix
With Them
A long list with no priorities
Evidence Trail
With Us
Dated report for your risk register
With Them
Verbal assurance
Committee Walkthrough
With Us
45 minutes with the engineer
With Them
None
Price
With Us
Fixed, from $1,950
With Them
Buried in the IT budget
Frequently Asked Questions
Are directors personally liable for a data breach?
Directors have duties of care and diligence, and regulators expect boards to oversee cyber risk. Whether liability arises depends on the circumstances, so get legal advice. An independent assessment helps show the board took reasonable steps.
Does the Privacy Act apply to our organisation?
Generally if your annual turnover is over $3 million, you provide a health service or you trade in personal information, among other cases. Not-for-profits can be covered too. Get advice on your own position.
Isn’t this our IT provider’s job?
Your IT provider looks after networks, devices and email, and often the Essential Eight controls on them. Websites, member portals and their plugins are often outside their scope, and no one can independently assess systems they manage themselves.
Will the report make us compliant?
No report makes an organisation compliant. Ours is independent technical evidence of the steps you’ve taken and what remains, which is what boards and their advisers need to make decisions.
How often should a board commission this?
At least annually, and after any major change such as a new platform, member portal or vendor. Many clients pair it with a care plan so issues are fixed as they’re found.