Home / Sectors
Sectors we work in
These are sectors we have delivered testing in. Each carries obligations that belong to you, not to us, and continuous testing produces evidence towards them.
Whose obligations these are
Worth being precise about. Frameworks such as APRA CPS 234, the ASD Essential Eight, the SOCI Act and PCI DSS place obligations on you as the regulated entity. TEQNIX is not certified against them and cannot certify you against them.
What we provide is the testing evidence those obligations call for, produced through the year rather than in the month before an attestation is due. Formal audit and certification are an assessor's work.
Where we have delivered
| Sector | What tends to matter | Obligations you may carry |
|---|---|---|
| Financial services | Customer-facing portals, payment paths, and third-party integrations. Exposure created by a release is the common failure. | APRA CPS 234, PCI DSS, Privacy Act 1988 |
| Insurance | Quote and claims applications holding personal and health information, and broker integrations. | APRA CPS 234, Privacy Act 1988 |
| Technology | Multi-tenant platforms where a single isolation failure reaches every customer, and fast-moving infrastructure. | Customer contractual security requirements, Privacy Act 1988 |
| Energy | Corporate and customer-facing systems, and the boundary between them and operational environments. | SOCI Act 2018, ASD Essential Eight |
| Retail | Storefronts, loyalty systems and payment flows, plus the third-party scripts nobody inventoried. | PCI DSS, Privacy Act 1988 |
| Healthcare | Patient-facing portals and integrations carrying health information, which is sensitive information under Australian law. | Privacy Act 1988, My Health Records Act |
| Education, including universities | Large, sprawling external estates with decades of accumulated hosts, and student-facing systems holding personal information. | Privacy Act 1988 |
One note on energy. We test corporate and internet-facing systems, including the boundary with operational environments. We do not test operational technology or industrial control systems themselves.
If your sector is not listed
The service is not sector-specific. What changes between sectors is which obligations you are evidencing and which systems carry the most consequence, and both come out during scoping. If your sector is not listed, it simply means we have not delivered there yet.