Whole-of-government cyber reporting

Every agency.
One trusted view of cyber risk.

xthreatsecure connects the security tools your agencies already run, turns their findings into a common, evidence-linked picture, and gives executives clear answers on exposure, coverage and remediation, without another round of spreadsheet submissions.

Explore the architecture Talk to us
  • Australian hosted
  • Agency isolated
  • Evidence-linked
  • Human reviewed AI

The reporting challenge

Cyber posture is reported in fragments

Each agency runs its own mix of SIEM, endpoint, vulnerability and identity tooling, and each reports upward in its own way. Central teams spend weeks reconciling submissions that are already out of date by the time they reach the executive.

Fragmented tooling

Dozens of platforms, each with its own data model, severity scale and naming of assets and services.

Manual submissions

Spreadsheets, forms and narrative reports that cost a lot of effort to produce and are hard to verify.

Inconsistent measures

Agencies calculate risk differently, so comparisons across portfolios and over time are unreliable.

Slow executive insight

Shared exposures and stalled remediation surface late, after the window to act has narrowed.

Why xthreatsecure

Reporting you can trace back to the evidence

xthreatsecure is designed as a whole-of-government capability, not another agency tool. It collects what agencies already hold, validates and normalises it once, and publishes governed measures every stakeholder can rely on.

  • Reuses existing agency investments with no rip-and-replace
  • Versioned, transparent risk calculations using governed rules
  • Every figure links back to source records and lineage
  • AI that assists analysts, with citations, confidence and human review

Sovereign by design

Australian hosting with agency-level isolation of data and access.

Evidence first

Source evidence and lineage are kept alongside every normalised record.

Framework aligned

Maps findings to the Essential Eight, IS18 requirements and agency policy.

Executive ready

Plain-language summaries and drill-down from government to entity.

How it works

From agency signals to executive answers in eight stages

A single governed pipeline takes raw findings from agency tools and submissions and turns them into trusted measures, insights and workflows.

  1. 01

    Collect

    APIs, files, forms and federated summaries from agency sources.

  2. 02

    Validate

    Identity, schema and quality checks, with quarantine for anything suspect.

  3. 03

    Normalise

    A common model, entity resolution and deduplication across tools.

  4. 04

    Enrich

    Threat context, control mapping and service criticality.

  5. 05

    Govern

    Governed stores for evidence, records, history, the knowledge graph and the vector index.

  6. 06

    Analyse

    Versioned risk calculations, comparisons, priorities and confidence.

  7. 07

    Augment

    Governed AI for matching, mapping, correlation, anomalies and grounded language.

  8. 08

    Report

    Executive dashboards, evidence-linked summaries and remediation workflows.

Proposed architecture

The xthreatsecure reference architecture

A conceptual view of how agency information flows through the platform. Connectors and scope are agreed with each agency during discovery.

Agency information sources

Illustrative source ecosystem
  • SIEM & analyticsSentinel · Splunk · Elastic
  • SOAR & responseSplunk SOAR · Playbooks
  • EndpointFalcon · SentinelOne · Defender
  • Vulnerability & cloudTenable · Qualys · AWS · Azure
  • Identity & deviceEntra · Intune
  • API & deliverySalt Security · Harness
  • Logs & observabilityDatadog · New Relic · LogicMonitor
  • Assets, ITSM & GRCLucendus · ServiceNow · Archer
  • Threat intelligenceRecorded Future · CrowdStrike
  • AssuranceRisk registers · Assessments
  1. 01CollectAPIs · Files · Forms · Federated summaries
  2. 02ValidateIdentity · Schema · Quality · Quarantine
  3. 03NormaliseCommon model · Entity resolution · Deduplication
  4. 04EnrichThreat context · Controls · Service criticality
Enrichment & knowledge inputs
  • CVE / CWE
  • CISA KEV
  • EPSS
  • MITRE ATT&CK
  • Essential Eight
  • IS18 requirements
  • Agency policies
  • Approved remediation guidance
05

Governed information stores

  • Source evidence & lineage
  • Normalised records
  • Historical measures
  • Knowledge graph
  • Approved knowledge & vector index
06

Risk & analytical services

  • Versioned risk calculationsFormal scores use governed rules
  • Agency comparisons & trendsCross-agency insight over time
  • Exposure & remediation prioritiesPrioritise risk, track progress
  • Coverage, freshness & confidenceData quality and completeness
07

AI enrichment & model services

  • Semantic matching & dedupLink related findings
  • Classification & control mappingSuggest domains and mappings
  • Knowledge-graph correlationShared dependencies and impacts
  • Anomaly & trend modelsRecurring gaps, stalled actions
  • RAG & grounded languageEvidence-linked explanations
  • NLP & dashboard generationPlain-language queries

Approved model gateway · Embeddings & reranking · LLMs · Statistical / ML models

08

Executive reporting & workflows

  • Executive dashboards
  • Evidence-linked summaries
  • Self-service dashboard builder
  • Agency drill-down
  • Assurance & remediation
GovernmentPortfolioAgencyEntity
  • Security across all stagesAustralian hosting · Agency isolation · Identity · Encryption · Audit
  • AI governancePermission-aware retrieval · Citations & confidence · Human review · Model evaluation · No public-model training
  • Platform operationsConnector health · Data quality · Monitoring · Recovery · Change control

Conceptual design, subject to discovery and security assessment.

Source ecosystem

Works with the tools agencies already run

xthreatsecure collects from security platforms, operational systems and assurance artefacts. The list below is illustrative. Connectors are confirmed with each agency during discovery.

SIEM & security analytics

  • Microsoft Sentinel
  • Splunk
  • Elastic Security

SOAR & response

  • Splunk SOAR
  • Sentinel playbooks

Endpoint security

  • CrowdStrike Falcon
  • SentinelOne
  • Defender XDR

Vulnerability & cloud

  • Tenable
  • Qualys
  • AWS Security Hub
  • Defender for Cloud

Identity & device management

  • Microsoft Entra
  • Intune

API & software delivery

  • Salt Security
  • Harness

Logs & observability

  • Datadog
  • New Relic
  • LogicMonitor

Assets, ITSM & GRC

  • Lucendus
  • ServiceNow
  • Archer

Threat intelligence

  • Recorded Future
  • CrowdStrike intelligence

Assurance & submissions

  • Risk registers
  • Assessments
  • Excel
  • Forms

Enriched with trusted knowledge

  • CVE / CWE
  • CISA KEV
  • EPSS
  • MITRE ATT&CK
  • Essential Eight
  • IS18 requirements
  • Agency policies
  • Approved remediation guidance

Analytics & AI with governance

Formal risk measures, plus AI that shows its working

Official scores come from versioned, governed rules. AI services help analysts match, map, correlate and explain, and every AI output is grounded in approved evidence and open to human review.

06 Risk & analytical services

  • Versioned risk calculations

    Transparent scoring with governed, auditable rule versions.

  • Agency comparisons & trends

    Like-for-like insight across agencies and over time.

  • Exposure & remediation priorities

    Focus effort on what matters and track progress to closure.

  • Coverage, freshness & confidence

    Shows how complete and current the underlying data is.

07 AI enrichment & model services

  • Semantic matching & deduplication

    Embedding models link related findings across tools.

  • Classification & control mapping

    Suggested domains and framework mappings for analyst approval.

  • Knowledge-graph correlation

    Shows shared dependencies and service impacts.

  • Anomaly & trend models

    Flags unusual changes, recurring gaps and stalled actions.

  • RAG & grounded language models

    Evidence-linked explanations and recommendations.

  • NLP & dashboard generation

    Plain-language queries and self-service views.

AI governance built in

  • Permission-aware retrievalUsers only see what their role permits.
  • Citations & confidenceEvery answer shows its sources and confidence.
  • Human reviewAnalysts approve mappings and recommendations.
  • Model evaluationModels are tested and monitored before and after release.
  • No public-model trainingAgency data never trains public models.

All models are accessed through an approved model gateway covering embeddings and reranking, LLMs, and statistical and ML models.

Security & sovereignty

Secured at every stage, hosted in Australia

The controls that protect agency data are part of the architecture itself. They apply to every stage of the pipeline.

  • Australian hosting

    Data stored and processed onshore.

  • Agency isolation

    Each agency's data and access are logically separated.

  • Identity

    Strong, role-based access tied to agency identity.

  • Encryption

    Data protected in transit and at rest.

  • Audit

    A traceable record of every access and change.

Platform operations

  • Connector health
  • Data quality
  • Monitoring
  • Recovery
  • Change control

Executive reporting & workflows

Ask a question. Get an answer you can defend.

Executives and portfolio leads ask in plain language. xthreatsecure answers with governed metrics and cites the source records behind them. Users can drill from the whole of government down to a single entity.

  • Executive dashboards

    Risk, exposure and assurance at a glance.

  • Evidence-linked summaries

    Source traceability and clear context.

  • Self-service dashboard builder

    Custom views and export options.

  • Agency drill-down

    From government to entity level.

  • Assurance & remediation

    Track actions and support reporting.

“Show shared critical exposures and overdue actions across my portfolio”

Example response (illustrative)

  • Critical exposures shared by multiple agencies, grouped by common dependency
  • Remediation actions past their due date, by owner and agency
  • Coverage and freshness of the data behind each figure

Citations to source records · confidence indicator · human review status

  1. Government
  2. Portfolio
  3. Agency
  4. Entity

Outcomes

Clear decisions, not just more dashboards

A single, consistent picture

Every agency is measured on the same basis, so leaders can compare, prioritise and fund with confidence.

Less manual reporting effort

Automated collection replaces most recurring spreadsheet submissions and frees security teams to remediate.

Earlier sight of shared risk

Correlation across agencies shows common exposures and dependencies before they become incidents.

Defensible reporting

Each measure traces back to source evidence, lineage and a versioned calculation.

Remediation that closes

Overdue and stalled actions are visible and tracked through to assurance.

Trustworthy AI adoption

AI assistance with citations, confidence, human review and no public-model training.

Our approach

A staged path from discovery to whole-of-government

  1. 1

    Discovery

    Map agency sources, reporting obligations and priority questions. Agree on connectors and the common model.

  2. 2

    Security assessment

    Validate hosting, isolation, identity and data-handling controls against government requirements.

  3. 3

    Pilot

    Onboard a small group of agencies and test measures, AI governance and executive views with real stakeholders.

  4. 4

    Scale

    Expand agency by agency, with connector health, data quality and change control in place.

  5. 5

    Continuous improvement

    Refine risk rules, models and dashboards as threats, frameworks and priorities change.

FAQ

Frequently asked questions

Does xthreatsecure replace our existing security tools?

No. xthreatsecure collects from the SIEM, endpoint, vulnerability, identity, ITSM and GRC platforms agencies already run, and from assurance artefacts such as risk registers and assessments. It adds a governed reporting layer on top. It doesn't replace your operational tooling.

Where is data hosted?

The platform is designed for Australian hosting, with agency-level isolation, strong identity controls, encryption and full audit. Final hosting arrangements are confirmed through discovery and security assessment.

Can one agency see another agency's data?

Not by default. Data is isolated per agency, and retrieval is permission-aware, including retrieval for AI features. Cross-agency views show only governed, aggregated measures to people whose role permits them.

How is AI governed?

All models run through an approved model gateway. AI outputs include citations and confidence, analysts review mappings and recommendations, models are evaluated before and after release, and agency data is never used to train public models. Formal risk scores always come from versioned, governed rules, never from a language model.

Which frameworks does reporting align to?

Findings can be mapped to the Essential Eight, IS18 requirements and agency policies. They're enriched with CVE/CWE, CISA KEV, EPSS and MITRE ATT&CK context, plus approved remediation guidance.

What if an agency can't connect a tool directly?

Collection supports APIs, file drops, structured forms and federated summaries. Agencies with constrained environments can share summarised measures and still take part in whole-of-government reporting.

How do executives know a number is trustworthy?

Every measure links back to source evidence and lineage, a versioned calculation, and coverage, freshness and confidence indicators. Executives can see what a figure says and how much weight it can bear.

Is the architecture final?

No. The architecture on this page is a conceptual design. It will be refined through discovery with participating agencies and a formal security assessment.

Ready to bring cyber reporting together?

Talk to the xthreatsecure team about a discovery workshop for your portfolio or jurisdiction. We'll map your sources, reporting obligations and the questions your executives need answered.

Talk to us Review the architecture See our approach