Know what a stranger can reach on your public sites. Every morning.
In June an AI crawler found an old Services Australia statistics portal, was refused, kept going, took files that were not yet public and wrote files to the server. Nobody in the agency saw it happen. The agency found out in September, from an email to its public inbox. Fenceline is the answer to the question every accountable authority has been asked since: could that happen here.
Files on your public sites that were never meant to be published, and the internal names and paths they give away.
Public-facing forms, upload points and interfaces that would take content from a stranger who was never let in.
Whether anyone would be alerted if either of those happened, or whether you would find out by email.
What we do
Four checks, run the way a stranger or a crawler would see your sites, with a letter of authority in hand and our name on the door.
Inventory
Every internet-facing web property the agency owns, including the legacy sites that have fallen off the register. The June incident was an old site; ASD's posture reports have called legacy IT an enduring risk for years.
Reachable content
Everything obtainable without a credential is read and classified against what the agency says is public: its website, publication scheme, FOI disclosure log and open data listings. Reachable but unlisted is a finding.
Write surfaces
Forms, upload points and interfaces on public sites that would accept an unauthenticated write, identified by inspection, never by writing.
Detection
A logging and alerting review, or a short tabletop including an AI-agent scenario, on whether the agency would notice an unauthorised read or write on those sites.
The daily check
The review is how an agency starts. The daily check is why it stays. Every morning Fenceline walks each property again and compares it with yesterday, so a newly reachable file, a new host or a new write surface reaches you the next day rather than in next year's review.
- What it watches. Every property in your register. Sitemaps and listings are compared daily, known items are checked with light conditional requests, and new hosts in your zones are picked up from certificates and DNS. A deeper sample runs weekly.
- What triggers an alert. A reachable item not in the baseline and not in your publication register. A new host. A new interface that accepts input. A directory listing where there was none. A change to an item already marked sensitive. Everything else goes in the weekly digest.
- Who gets it. A person at the Bluebird service desk first, with the evidence. They confirm it is real, then call your contact. You get a phone call, not an automated email.
- What it is not. Not intrusion detection, and it never sees inside your network. It sees what a stranger can reach, which is exactly the thing the June incident showed nobody was watching.
stats.agency.example/reports/2026/draft-quarterly.xlsx · first seen 05:40 · classified: draft, internal markingslegacy-portal.agency.example · certificate issued yesterday · not in the property registerdata.agency.example/uploads/ · 212 items now visible · was 403 yesterdayHow it runs
Written authorisation from the accountable authority, scoped by domain list. Our crawler identifies itself, runs from fixed Australian addresses you whitelist, is rate limited and read-only. No exploitation, no credential attempts, no writes. Every document is analysed on Australian infrastructure operated by us.
Letter
The accountable authority signs the scope: domains, dates, methods, contacts. Nothing runs without it.
Whitelist
You add our fixed addresses to your web application firewall. Our requests carry our name and a contact.
Walk
Read-only, rate limited, inside the allowlist. Every item captured with a hash as evidence.
Classify onshore
Each item is judged by one locally hosted model and checked by a second. Where they disagree, a person decides. A third pass re-samples items classified public, because the failure that matters is a non-public file marked public.
Report
Findings mapped to the ISM, the Essential Eight and PSPF Policy 10, with a list the web team can act on the same day.
What you receive
- ✓Exposure register. Every property and every reachable item, classified, with evidence.
- ✓Findings report mapped to the ISM, the Essential Eight and PSPF Policy 10.
- ✓Remediation list the web team can act on the same day, as a spreadsheet or a ticket import.
- ✓Executive brief. One page for the secretary or board.
- ✓Fenceline Watch. The daily check, a quarterly full re-walk, an exposure dashboard, a governed question-and-answer layer over your findings, re-testing of remediated items, and an annual assurance statement for the audit committee.
- ✓Rapid option. Report in ten business days when the question has already been asked upstairs.
Where it sits
Fenceline answers the question the others leave open: what can a stranger reach, and would you know.
Configuration hygiene
Free for Commonwealth entities. Checks settings and known weaknesses. Does not read content, and is not available to state, territory, university or local government bodies.
Patches and TLS
Finds what is exploitable. Says nothing about whether a document should be public, and stops the day the report lands.
Certifies a system
Assesses controls against the ISM for accreditation. A different product for a different question.
Reachable, writable, noticed
Reads and judges every reachable item against what you say is public, identifies write surfaces, tests whether you would know, then checks again every morning.
Analysed onshore, on the AxoQuant sovereign stack
Locally hosted models
Classification, summarising and report drafting run on open-weights models hosted on Australian infrastructure operated by us. No offshore processing, ever. Nothing about your sites touches an overseas AI service. Every classification is checked by a second, independent model before a person signs it off.
Findings handled as sensitive
Findings are held as OFFICIAL: Sensitive at minimum, in an engagement-scoped store, with ISM-aligned handling, and destroyed on engagement close unless you ask us to keep them.
Delivered by Bluebird Advisory
A Commonwealth panel supplier and DISP member with Australian delivery staff and a service desk. Available to Commonwealth non-corporate and corporate entities, state and territory agencies, universities and local government.
Book a Fenceline Review
Fixed price per program year: the baseline review plus the daily watch, on a three-year term. A ten-business-day Rapid option is available when the question has already been asked upstairs. Ask for the service sheet or book a scoping call.