Cyber controls read from each practice's own systems, shared by the practice, in one view for the licensee.
In October 2026 the Supreme Court of NSW ordered Fortnum Private Wealth to pay a penalty over how it managed cybersecurity risk across its advice network. The agreed facts read like a description of the self-assessment model.
Penalty. Fortnum admitted it failed to adequately manage cybersecurity risk across its network, and the Court ordered a $1.35 million penalty.
One licensee, a whole network. Fortnum's network comprised more than 80 advice practices and more than 200 authorised representatives.
Self-assessment wasn't enough. Leadership knew only around 44% of authorised representatives had completed the cyber self-assessment questionnaire, and only 12% the accompanying attestation of cybersecurity measures.
No baseline was set. Fortnum did not mandate mitigation strategies aligned with the Essential Eight.
Sources: ASIC media release 26-244MR and Clayton Utz, "Another win for ASIC on cybersecurity failures" (21 October 2026).
Each practice's score, whether it meets the baseline you set, whether it has slipped since last month, and the date of its latest evidence pack. Read every morning from the practice's own Microsoft 365 and security tools.
We start with the practices in your network that Evisent already manages, because their evidence is already being read every morning. You see the network view for 90 days, we agree the baseline with you, and we review together what it showed.
Tell us about your network. We confirm which of your practices we already manage.
Each practice chooses whether to share with you. Nothing is shared without that choice.
Who meets the baseline, who has slipped, and evidence on file, read every morning.
We go through what the pilot showed, and what a wider rollout would need.
The pilot is by application and carries no published price.
The licensee sees counts and percentages, such as how many users have MFA enforced, not which ones don't. Staff names are left off by default.
Each practice decides whether to share with its licensee, and can revoke it at any time.
Every open of a shared view is logged, so the practice can see when its evidence was viewed.
Evidence is read from each practice's own systems with read-only permissions and hosted in Azure Australia East. No AI reads client data.
An engineer will reply to set up a 30-minute call, and we'll say plainly whether the pilot fits.
Four fields. We reply to every one.
For the pilot, we start with practices in your network that Evisent already manages, because their evidence is already being read every morning. Practices with other IT providers are something we would scope with you during the pilot.
Counts and percentages for each practice that chooses to share: its score, whether it meets the agreed baseline, whether it has slipped, and the date of its latest evidence pack. Staff names are left off by default.
Yes. Each practice chooses to share and can revoke it at any time. Every open of a shared view is logged.
No. It is evidence of configuration, read from each practice's own systems. It is not an audit, a certification or an opinion of compliance, and a high score doesn't mean a practice can't be breached.