About Cyber Wave

I'm Bill Robson. I started Cyber Wave because I have spent 25 years watching security advice get delivered by whoever was available rather than whoever was right and watching clients pay for seniority they never actually received.

So Cyber Wave is deliberately just me. When you engage a Fractional CISO retainer or book an incident response exercise, I'm the person who scopes it, does the work, and sits in the room. There's no bench to delegate to, which is the point.

Where the experience comes from

Two things from those years shape how I work now.

The first is that I know how attacks actually unfold, because I ran them. When I design an incident response scenario, the attack chain is one I've either executed or investigated. That's why the exercises hold up under scrutiny from technical teams, if the scenario isn't plausible, your engineers will say so within ten minutes, and they'd be right to.

The second is translation. A large part of my career has been explaining highly technical findings to partners and executives who didn't have a security background, in terms that changed what they decided to do. That skill turned out to be most of the CISO’s job. Your board doesn't need to understand the vulnerability. They need to understand the exposure, the obligation, and the decision in front of them.

I've worked across offensive and defensive security, governance and compliance, and the resource-constrained end of the market where security has to be practical or it doesn't happen at all.

How I work

Practical over theoretical. I'd rather close three real gaps than document thirty. Most organisations I meet don't need a bigger risk register, they need the top five items actually fixed.

Honest, including when it costs me. If a retainer isn't the right answer, I'll say so in the first call. If you'd be better served by an MSP, or by hiring internally, or by doing nothing for another six months, that's what I'll tell you.

Independent by design. No parent company, no reseller agreements, no vendor commissions. It's the reason I can recommend against buying something.

Who I work with

Companies between roughly 50 and 500 people, usually in one of three situations: carrying real regulatory weight (APRA, SOCI Act, Essential Eight, Privacy Act), running modern cloud or serverless infrastructure where traditional security advice doesn't quite fit, or growing fast enough that security has become a board question before anyone had time to build the function.

The common thread is constraint. These are organisations that can't throw headcount at the problem and need the thinking to be right the first time.

Outside work

I dive wrecks, mostly deep ones, beyond recreational limits. Every dive is a risk exercise before it's anything else. That's the whole argument for incident response exercises. The 2am breach is the dive at depth. Whatever your team has rehearsed, they won't invent on the spot.

Cyber Wave Consulting is an Australian cybersecurity consultancy founded

by Bill Robson and based in Victoria, Australia. We are not affiliated

with Cyber Wave LLC (Longwood, Florida), cyberWAVE (United Kingdom),

CyberWave Information Security, or any other similarly named business.