Home / Industries / Defence & defence industry
MyRISK · Defence and defence industry
The decision was sound. The people who could explain it have been posted on.
Cyber-worthiness, supplier and security decisions are made under schedule pressure and reviewed years later — after postings, contracts and project teams have turned over. Trace preserves what was known, who authorised it, why it was reasonable, and what changed since.
Capability summary
MyRISK on one page
For capability managers, security and assurance leads, and the suppliers who answer to them.
01 · The problem
Decisions outlive the people who made them
- Risk accepted on a system so a capability can enter service on time
- A supplier or subcontractor exception granted to keep a program moving
- Control uplift deferred, with conditions nobody now tracks
- The rationale lives in email, briefs and memory — and leaves with the posting
02 · What we offer
One record of the decision, and of the controls behind it
- MyRISK Trace — preserves the evidence, rationale, authority, conditions and drift behind a high-stakes decision, so it can be replayed, not reconstructed
- MyRISK Core — controls and evidence defined once and reused wherever they are asked for
- MyRISK Essentials — a First Risk Baseline for smaller suppliers asked to prove their risk position
- MyRISK Consulting — fixed-scope work where the workflow, not the tool, is failing
03 · How it runs
Your evidence can stay inside your boundary
- Hosted service on Oracle Cloud Infrastructure in the Sydney region
- Delivered as a service: you need nothing from Oracle, and no Oracle licence or skills, to use it.
- Optionally, deployment in Oracle Cloud for Australian Government and Defence — see below
- An optional Trace gateway that runs in your own environment, for local operation and integration
- Every connection starts on your side — MyRISK does not initiate a connection into your network
- Evidence can be held as a reference, hash or metadata, so the document itself stays where it is
- When the link drops, updates queue locally and are delivered once it returns
04 · Why MyRISK
Built here, by people who have sat on both sides
- Australian owned, with its head office in Sydney
- Oracle ISV partner; the platform runs on Oracle Cloud Infrastructure
- A team with over 40 years in technology, risk and governance
- MyRISK Core was previously sold as HyperGRC — same platform, same team
The Government and Defence option
Where a program needs it, MyRISK can be deployed in Oracle Cloud for Australian Government and Defence. In Oracle's words, the region is “located in Canberra”, “dedicated for Australian Government workloads” including “defence customers and their service providers”, and “isolated from other hyperscale commercial Oracle Cloud regions”.
- Oracle states the region “has been certified for Information Security Registered Assessors Program (IRAP) at PROTECTED level and for Hosting Certification Framework (HCF) at Certified Strategic level”
- “Australian customer data is restricted and does not leave the region throughout its lifecycle”, meeting, in Oracle's words, “sovereignty requirements for locally hosted data”
An IRAP assessment of MyRISK operated controls will be provided as part of a joint MyRISK and Oracle Defence pilot.
Named a Cool Vendor™ in Gartner Coolest Vendor Innovations for Assurance: GRC and TPRM, 9 September 2026†. Read more
Where it bites first
Six decisions worth being able to replay
01
A risk accepted to enter service
What was known about the system at the time, who held the authority to accept the residual risk, and what conditions came with it.
02
A supplier or subcontractor exception
A flowed-down requirement waived or deferred to keep a program moving, and whether anyone revisited it.
03
A deferred control uplift
Why a maturity target was not reached on schedule, who accepted the gap, and what would end the deferral. Essential Eight decisions
04
A configuration exception on a fielded system
A departure from the baseline approved for operational reasons, its justification, and its review date.
05
An AI use approval
What a model was approved to do inside a capability, on what evidence, with what human oversight, and what triggers review.
—
Not only a cyber story
A schedule trade-off, a capability compromise or a contract variation carries the same weight when it is reviewed. Lead with whichever happened most recently.
Who this is for, and who it isn't
Two signals that send you somewhere else
A smaller supplier to a prime? Start with Essentials
When a prime or a contracting authority keeps asking you to prove your risk position, the first need is a current answer you can keep current — not a replay of one decision.
The tools exist and the workflow still fails? Start with Consulting
Where the entry point is an audit finding about a process, or an evidence workflow that keeps breaking, the first work is diagnosis rather than a decision record.
For your reviewers
The boundaries, in writing
What this is not
- Not a claim of DISP membership, Defence accreditation, panel standing or security clearance. Where a program requires any of these, we will provide the evidence, or the path to it, as part of due diligence.
- The IRAP and HCF certifications belong to Oracle's Government and Defence region. MyRISK has not been separately IRAP assessed, and the standard hosted service in the Sydney region is not for security-classified information.
- Independent security assessment of the Trace gateway is available on request as part of the consulting phase.
- Not “audit-ready” and not certification. Replayability is a property of the record; acceptance is your reviewer's and your accountable authority's.
- Trace complements your existing assurance, records and security systems. It replaces none of them.
†
Gartner, Coolest Vendor Innovations for Assurance: GRC and TPRM, Jie Zhang, Antonia Donaldson, Zachary Ginsburg, 9 September 2026.GARTNER, Cool Vendors is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any company, vendor, product, or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner's business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Which decision would be hardest to explain after the next posting cycle?
A risk acceptance, a supplier exception or a deferred uplift. Replay it now, while the people who made it can still fill the gaps.