Sovereign by design. Sector-aware by default.
xCIRT exists because Australian critical infrastructure deserves incident response that is built, staffed, and operated here — not adapted from elsewhere.
Why xCIRT exists
Australia's critical infrastructure operators are increasingly exposed where IT, OT, and IoT converge. Cloud-connected control systems, SCADA, PLCs, and field IoT widen the attack surface, while obligations under the SOCI Act and the Critical Infrastructure Risk Management Program raise the bar for response capability.
Most operators do not have a sovereign provider that can respond to incidents touching both cloud and the plant floor. Foreign primes carry data-residency questions. Generic Australian IT security firms rarely have native OT/IoT incident response depth. xCIRT is built for that gap.
We cover the full cloud-to-edge path — from hyperscaler workloads down to ICS, SCADA, PLCs, IIoT gateways, and connected field assets — delivered by Australian responders, with Australian data custody, under Australian law.
What guides every engagement.
Sovereignty
Australian-owned, Australian-staffed, onshore data — without compromise. Sovereignty is not a feature, it is the operating model.
Operational respect
Containment that respects safety-critical operations. No "pull the cable" reflexes on production OT. Decisions made jointly with your operations team.
Sector-aware delivery
Responders matched to your sector. Electricity, water, gas, ports, rail, aviation — the language and constraints differ, and so should the playbooks.
Matthew Gurr
Matt founded xCIRT to bring sovereign, OT-aware incident response to Australian critical infrastructure operators. He has spent his career in cybersecurity, security architecture, and incident response, with deep exposure to regulated and high-stakes environments.
He is based in Brisbane and is a passionate believer in Australian cyber sovereignty — that the data, decisions, and people protecting the systems we depend on should be Australian.
LinkedIn →Need an Australian responder, now?
Retainer engagements, scoped pilots, and SOCI-readiness packages. Talk to us about what your critical-infrastructure estate needs.