csirtfoundry.com

What It Is

CSIRT Foundry is a privately held company founded in 2011 and based in Melbourne, Australia. It positions itself as a developer of software tools that help security teams “improve incident response.” Rather than promoting a fixed platform like a typical off-the-shelf security product, it emphasizes custom software development from a security and IR perspective, helping teams reduce repetitive work, improve focus, and lower analyst fatigue.

Core Capabilities and Analysis

In terms of protection type, CSIRT Foundry is more focused on incident response, analysis workflow automation, and security operations support, rather than perimeter or endpoint protection. The text mentions experience with phishing site and log file handling, phishing monitoring systems, dashboards, malware analysis, and sensor network visualization, making it suitable for improving day-to-day CSIRT workflows. Deployment model, specific architecture, and cloud or on-premises support are not publicly explained. For management and alerting, it can only be confirmed that the company has experience developing dashboards and monitoring systems; it does not disclose alert rules, ticket workflows, or audit capabilities. Integration capabilities are also not listed explicitly, though its service model appears likely to be customized around a customer’s existing processes.

Pricing and Compliance

The captured text does not provide pricing models, plans, quote ranges, or payment methods, so commercial cost cannot be assessed. On the compliance side, the text only notes that founder Chris Horsley holds a CISSP and has worked and taught at national-level CSIRTs such as AusCERT and JPCERT/CC. This strengthens professional credibility, but it is not equivalent to company- or product-level certifications such as ISO or SOC 2.

Pros and Cons

Its main strength is a strong hands-on background, especially in understanding CSIRT-heavy workflows, international collaboration, and automation needs. For security analysis scenarios that standard tools struggle to cover, custom development may offer significant value. The downside is limited public information: there is no clear product list, deployment documentation, SLA, support channels, or pricing. Buyers would need substantial communication and confirmation before procurement.

Who It’s For and Access from China

It is better suited to organizations that already have a security team or CSIRT, or that need to redesign IR workflows, rather than SMBs looking to quickly purchase a standardized protection product. The text does not mention access from China, payment options, or local service availability, so these remain unknown. If a more mature platform-style alternative is needed, consider SOAR or IR tools such as Splunk SOAR, Cortex XSOAR, TheHive, Shuffle, or domestic security operations/orchestration automation solutions.