Skip to content

St John WA

December 2025

Driving Confidence in Cyber Governance Across Australia’s Largest Ambulance Service

St John WA, Australia's largest ambulance service, replaced a fragmented mix of spreadsheets and legacy tools with CyberHQ®. As a result, they achieved real-time visibility across cyber posture, risk, and compliance, and transforming how it reports to its board and auditors.

Challenge

Managing Complexity Without Losing Visibility

For more than 130 years, St John WA has served as Western Australia's primary ambulance provider and one of the largest single ambulance services in the world by geography. Alongside emergency response, the organisation delivers first aid training, urgent care, patient transport, and a wide range of community health services.

The cybersecurity stakes are clear: protecting the sensitive health data of millions of Western Australians while keeping ambulances, clinics, and digital systems available every second of the day. That mission demands governance that is both rigorous and responsive.

The reality did not match that requirement. Over time, governance and risk management practices had become fragmented across spreadsheets, Word documents, and various internal tools. There was no single, accurate view of the organisation's cyber posture. Every audit or board report required manually compiling data from multiple disconnected sources.

"You end up cobbling together tools just to keep up. Reporting to the board or responding to audits meant digging through multiple systems and manually compiling data. It was time-consuming, slow, and not dynamic."

Andrew Bullen, Manager of Cyber Security, St John WA

As a highly audited organisation operating under government contract, St John WA needed a platform that could centralise cyber data, align risk and compliance, and deliver consistent visibility to executives, the board, and auditors without the cost and complexity that had made legacy GRC tools unworkable for a small internal team.

Why CyberHQ®

Built for Security Teams, Not GRC Administrators

St John WA ran a competitive review before selecting CyberHQ®. The selection criteria centered on a specific gap: the organisation needed a platform powerful enough to manage cyber posture, risk, and compliance across frameworks, but intuitive enough for day-to-day use by a small internal team — without the overhead of enterprise GRC tooling.

The decision criteria centered on three things:

  • Built for security teams, not GRC administrators: the platform had to speak the operational language of a cybersecurity function, not require translation from a generic compliance framework.

  • A way out of spreadsheets without enterprise overhead: the team needed Command Discipline: a single source of truth for risks, issues, and controls, without the implementation cost and operational burden that had disqualified legacy GRC platforms.

  • Board-ready reporting without manual reconstruction: executives and auditors needed clear, current information on demand, not a data-compilation exercise before every meeting.

"(CyberHQ®)  puts everything in one place — our maturity, risks, issues, and improvement programs — and makes it easy to show exactly how our initiatives reduce risk and improve posture."

Andrew Bullen, Manager of Cyber Security, St John WA

Solution

Full Visibility Across Posture, Risk, and Compliance in Under a Week

The Avertro team provisioned St John WA's CyberHQ® environment® within days and provided hands-on training. The speed of deployment was not incidental; it reflected the platform's design for cybersecurity teams rather than large-scale enterprise implementation cycles.

Risk and Framework Management

Fully aligned with St John WA's risk appetite and reporting language, replacing disconnected spreadsheets with a structured, live view of posture.

Project and Program Tracking

Improvement initiatives automatically linked to measurable maturity uplift and risk reduction, connecting investment to outcome.

Issue Capture and Management

Staff can self-report security issues directly in the platform, improving transparency and governance coverage across the organisation.

Executive and Board Reporting

Visual, cross-framework dashboards delivered without manual duplication, enabling on-demand answers to board questions.

"With CyberHQ®, I can answer questions in seconds and demonstrate how a project directly reduces risk."

Andrew Bullen, Manager of Cyber Security, St John WA

Results

Clarity, Confidence, and Control 

An operating model that scales with the business. As RDC.AI's assurance footprint grows, the structure behind managing it does not require proportional effort to maintain.

common-file-text-clock

Manual Reporting Eliminated

Hours of manual effort previously required for board and audit reporting have been replaced by automated posture tracking and integrated dashboards.

Check-Badge--Streamline-Ultimate

Audit Readiness, Always On

Evidence and supporting data are linked and current within the platform, removing the need to scramble and compile ahead of each audit cycle.

Iris-Scan-1--Streamline-Ultimate

Real-Time Posture Visibility

Maturity, issues, and risk movement are visible in real time. This gives the security team a live, accurate picture rather than a point-in-time snapshot.

Business Case Justification

Board Confidence Established

Visual reporting aligned to NIST and Essential Eight means the board can see how cyber investment directly reduces risk in a format they understand.

Looking Ahead

A Foundational Platform for an Increasingly Complex Security Function

CyberHQ® has become the operational foundation for St John WA's cybersecurity function. It drives informed decision-making, speeds up governance cycles, and creates greater assurance for executive leadership and the board.

For St John WA, the relationship with Avertro has extended beyond the platform itself. Customer feedback is consistently incorporated into the product roadmap, and new capabilities, including AI-driven insights for risk prioritisation and communicating cyber investment value, continue to add operational benefit.

As the organisation's security obligations grow alongside its service footprint, the platform provides a structure that can absorb that complexity without requiring a proportional increase in team resources or tooling overhead.

See CyberHQ® configured to your environment

Book a 30-minute interactive session to see how CyberHQ® integrates with your existing tools, frameworks and environment.

Book a Demo