We are a membership-based organisation offering a peer sharing network, a unique intelligence sharing platform, human-triaged intelligence services, and a range of cyber defensive capabilities. Our members represent Australia’s critical infrastructure and essential services.
Cross-sectoral
Not-for-profit
100+ member organisations
100+
4
19
A unique intelligence sharing platform and community, managed threat intelligence services, and a
suite of cyber defensive capabilities - available to every member, regardless of maturity level.
Members gain access to a peer sharing network immediately. Intel from the members and open sources is anonymised, triaged, enriched, and proactively shared across the network.
Threat Intel Forums
Human and machine-to-machine sharing
Supply Chain Working Group
A curated flow of human-triaged threat intelligence, in-depth technical analysis, and specific, actionable recommendations - applicable across organisation sizes and maturity levels.
In-depth vulnerability and threat advisories
Detections and Knowledge
TriageBot and Automated Threat Feeds
Membership includes high-value services like Attack Surface Monitoring, Software Bill of Materials (SBOM), CVE-matching and patch prioritisation, and a member-only honeypot network feeding indicators of compromise directly into detections and advisories.
Attack Surface Monitoring and SBOM
Leaked credential monitoring
Australian Honeypots and data-loss Crawler
A peer-sharing community. 19 defensive capabilities. Every member.
Advisories, position papers, and perspectives on news and policy from our subject matter experts.
Announcements
October 28, 2026
On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials as the evolution of their Essential Eight (E8) framework
Read.webp)
Informational
September 3, 2026
AI-enabled consumer wearables have moved beyond far-fetched gadgets into something people use in everyday life, from your local barista to the stranger next to you on the train.
Read.webp)
Informational
August 28, 2026
The Gentlemen is an established criminal ransomware-as-a-service syndicate with a differentiated pricing model: taking a smaller margin from its affiliates.
ReadAll of our members can access the full suite of defensive capabilities and the peer sharing network.
01
02
03
Efficient use of time is critical. Cyber security is not your only area of responsibility. Members at this size cite the ease of actionability of our advisories and analysis. Services such as Attack Surface Monitoring and SBOM are included in membership. The peer community and Analyst-on-Demand are also valued resources.
01
02
03
Advisories arrive triaged and mapped to Australian critical infrastructure sectors, and automated threat feeds drop straight into the tooling you already run. Detections, the vulnerability database and the SBOM register cut research time for every decision, so the work your team prioritises is response rather than collection.
01
02
03
SOC analysts can cross-reference their SIEM (Splunk, Falcon, Sentinel, etc.) alerts against our OpenCTI reports and utilise our bespoke detection rules, based on common attack vectors, in our member portal.
Three steps from the first conversation to defensive uplift, with a complimentary trial before any commitment.
A brief conversation or form submission to understand your unique challenges and existing capabilities. We will assess how our model could benefit your organisation.
A complimentary 45-day trial of our full platform and services. Cyber defensive capabilities are enabled to monitor your attack surface and you gain access to the full suite of services.
Engage our team and a peer network through our regular intelligence sharing forums, Slack channel, analyst-on-demand, and Member Portal.
2026
Melbourne
CI-ISAC's David Sandell will be on a panel during the Association of Superannuation Funds of Australia (ASFA) annual conference. The conference will unite industry leaders, innovators and regulators to rise to the challenge of delivering strong member outcomes amid accelerating change.
Read More2026
Brisbane
A live training exercise built for Queensland health professionals including capture the flag and threat hunting exercises. Complimentary breakfast, lunch, and a networking event are included.
Read More2026
Sydney
This is an opportunity for our members to hear first-hand from our Chair and CEO on how CI-ISAC has evolved over the past year, what's in store for 2027, and contribute to approving resolutions to our Constitution and Directors.
Read MoreCI-ISAC is Australia's only cross-sectoral intelligence sharing community for critical infrastructure and essential services. Our 100+ member organisations receive a curated flow of human-triaged threat intelligence, in-depth technical analysis, and specific, actionable recommendations — applicable across sizes and maturity levels. Our not-for-profit status allows our members to access tools, analysts, and cyber intelligence services that are significantly more expensive at market rates.
Critical infrastructure operators and essential service providers with Australian operations. Local government and sector associations also find value in membership. If you unsure about eligibility, use the "Contact Us" button at the top and we'll let you know.
CI-ISAC was founded with the mission to defend Australia's critical infrastructure. So every member receives all 19 products and the same level of intelligence, on the same terms. There is no bronze, silver or gold levels. There are no additional fees for new products and services, which we release regularly. A single IT lead and a mature Security Operations Centre get the same advisories and recommendations.
CI-ISAC is a bi-directional sharing partner in the ACSC's CTIS program. CI-ISAC adds context from its own observations and passes the result to members who may not have the means to consume CTIS directly. The ACSC also operates the CHIPS scanning service for large providers; CI-ISAC runs attack surface and SBOM services for all members, including smaller entities.
Any submissions members choose to share are triaged, analysed, enriched and anonymised by CI-ISAC before it reaches the network. Everything carries a TLP designation that sets how far it can travel, from TLP:RED for the named recipients only through to TLP:CLEAR, which may be shared externally without restriction. For more information on TLP designations, find a link in the footer.
While entities of that size find tremendous value in membership, roughly 56% of our members are defined as large ($50m+ ARR). SOC analysts can cross-reference their SIEM (Splunk, Falcon, Sentinel, etc.) alerts against our OpenCTI reports and utilise our bespoke detection rules, based on common attack vectors, in the member portal.
Our NFP status allows CI-ISAC to provide a combined suite of services and capabilities at a fraction of current commercial rates, and this is why capabilities like Attack Surface Monitoring and SBOM are delivered as part of membership instead of add-on services. We reinvest membership fees into increasing capabilities for members and adding support functions, not marketing.
Yes. Our intelligence services and sourcing is Australian-centric and human-triaged by the analyst team, scoped to Australian critical infrastructure and essential services rather than global feeds. Our specific Australian-focus and peer intelligence sharing community is part of what differentiates us from peers.
