Human judgement for the AI-native era.
Sydney headquartered CPA firm serving Australian and US companies
Founder-built,
practitioner-led.
Rob and Paul have each built market-leading firms in cybersecurity and compliance. After years of crossing paths in the same market, they're finally building the firm they've talked about for years - together. Now they are building it for AI-native companies, AI-centric services and compliance programs increasingly operated by agents.
Founder of Pure Hacking, CXO Security, and Sekuro. Two decades building offensive-security and cyber consulting practices that serve enterprise and government.
LinkedIn
Founder of AssuranceLab, the modern security audit practice acquired by Sensiba, serving thousands of high-growth technology companies globally.
LinkedInA name, not a handoff.
Every engagement has a named senior practitioner responsible from scoping through report issuance. Our founders shape the methods and standards; experienced practitioners stay close to the evidence, the judgements and your team throughout the work.
AI can reduce coordination and detailed administration. It cannot replace professional scepticism, accountability or the independent opinion. Those remain human-led.
Rob and Paul first sat across a table from each other at Fishburners, both in the early days of their last companies. Rob was building CXO Security - penetration testing and compliance implementation. Paul was building AssuranceLab - modern SOC 2 and ISO audits.
Different sides of the same market, and the same conversation kept surfacing: compliance is fragmented. Companies end up lost, over-investing and under-investing at the same time, juggling too many providers, and quietly hoping the team assigned after the sales call is the good one.
Years of comparing notes, watching what worked and what didn't, and mental-mapping the better way.
Throughline is a registered CPA firm and Certification Body. We conduct compliance audits and issue the reports; we're not the consultants who implement your controls. That independence is the whole point.
Throughline is that firm - finally in production, just getting started.
Audits adapted to your business.
Every engagement starts the same way: by understanding where you actually are. Not where your last auditor assumed you were. Not where a checklist suggests you should be. Where you are, today, with the team and tools you actually have.
From there, our role is to give you clear, practical feedback on the controls you already run, so you can shape a program that fits. Controls adapted to your stage, your system scope and your service commitments. Evidence that already exists in your workflow. A cadence your team can sustain after we leave the room.
When the audit comes, it's a confirmation of what you already know, not a discovery of what you didn't.
A throughline is the single thread that holds an otherwise sprawling story together. Compliance, done right, is exactly that. Quietly tying your growth, risk, security and operational maturity into one coherent narrative.
What we hold to.
Quality isn't hours logged, layers added, or boxes ticked. It's alignment, pragmatism, and trust - and it shows up in every deliverable that leaves our desk.
We stand behind our commitments. Every engagement is measured by whether the outcome exceeded our client's expectations and moved their business forward.
The value in an audit firm is the passion and expertise of its people. We nurture that, invest in the best, and keep them close to the client.
We venture into the unknown to find better ways of working. Audit can be done so much better than the industry standard - and we intend to prove it.
Companies at every stage,
with one thing in common.
- Pre-seed / SeedTwo-person startups running their first PoCWhere compliance has to be lightweight enough to ship, defensible enough to sign.
- GrowthSeries A to C companies scaling fastWhere last year's controls have already been outgrown, and next year's are still being designed.
- AI-nativeCompanies building products and services around AIWhere agent access, AI-enabled changes and new operating models need credible independent assurance.
- EnterpriseEstablished companies with complex needsWhere multiple frameworks intersect and where one wrong scope decision creates years of rework.
The common thread: companies that want compliance adapted to the business they actually are.