About Lumaris

We know this work
from the inside.

Lumaris is an Australian advisory firm founded by practitioners who have led AI, data, cyber, and cloud programmes inside federal agencies, hospitals, and critical infrastructure operators. We work across all five domains because your risks do too.

If you are a technology or risk leader trying to get clear visibility on where you actually stand right now, you may already know how hard that is to do. We have sat where you are sitting, and we have been in the room when the hard questions land.

A Lumaris advisory session in progress

Why is Lumaris focused on AI, data, cyber and cloud together?

Lumaris was founded by practitioners who have run AI, data, cyber, and cloud transformation programmes inside Australian federal agencies, major hospital networks, and critical infrastructure operators. We built this firm because we kept seeing the same problems go unsolved. Not for lack of effort, but because the old boundaries between teams no longer addressed the threats, regulation, and complexity that organisations are now facing.

Nobody was looking across all five domains at once, and the advice available was often designed around the advisor's model rather than the client's actual situation.

The organisations we work alongside have the capability, but they are dealing with problems that do not sit neatly inside one team's remit. AI connects to data. Data lives in cloud environments. Cloud intersects with critical infrastructure. Cyber risk runs across all of it. And the people responsible for each area are not always in the same conversation.

From the inside

What experience does the Lumaris team actually have?

Everyone at Lumaris has experienced these problems first-hand. We have lived with the consequences of gaps between teams, and we built this firm to close them.

↳

We have been the enterprise architect watching a cloud migration introduce risk nobody scoped.

↳

The technology leader trying to understand how the new AI platform pulls data.

↳

The assurance lead writing findings that disappeared into a backlog.

↳

The program manager navigating a highly regulated industry with organisational demands.

That experience is why Lumaris is built the way it is. We work across all five domains because the problems do. And we come into every engagement already thinking about what your team needs to be able to do when we are gone.

50+
Programmes delivered across cyber, AI, data, cloud, and critical infrastructure
7
Sectors with hands-on delivery experience: government, defence, health, education, financial services, energy, and critical infrastructure
3
On-ground delivery across Canberra, Melbourne, and Sydney
5
Domains, converged. Every engagement connects AI, data, cyber, cloud, and critical infrastructure
Who leads the work

Principal-led, from the first conversation to the last.

Every engagement is led by a principal. Not delegated to a team you have not met. The people you speak to before an engagement begins are the same people doing the work.

Martin Barnier

Martin Barnier

Principal, Consulting Director

Martin is a strategy and architecture leader who has spent 15 years designing and delivering security and technology programmes inside Australian federal agencies, defence, health, and critical infrastructure. At Lumaris, he leads advisory engagements that connect AI governance, cyber posture, data foundations, and cloud architecture into a single programme of work, aligned to frameworks including Essential Eight, ISM, PSPF, and NIST AI RMF.

LinkedIn
Todd Noller

Todd Noller

Principal, Head of Data and AI

Todd is a delivery and technology leader with 16 years across government, defence, health, and financial services. He has led cyber transformation portfolios, stood up technology functions at executive level, and coordinated national cyber incident response across federal and state government. At Lumaris, he leads the Data and AI practice, spanning AI governance, enterprise architecture, and the security and regulatory controls that make AI deployable in regulated environments.

LinkedIn
Georgia Sole

Georgia Sole

Client Growth and Partnerships

Georgia co-founded Lumaris to bridge the gap between what Australian organisations need from their advisors and what the consulting market was actually delivering. She leads every client relationship from first conversation through engagement delivery, and is accountable for ensuring the work Lumaris does is shaped around the client's situation, not a pre-built methodology.

LinkedIn
How we work

Five things that are true of every engagement.

These are not commitments we made up for a website. They are things that have come up in real conversations with clients, often in the first meeting. We think it is worth saying them plainly.

01

We will give you an honest picture, even when it is not what you were hoping for.

If the situation is more complicated than expected, you will know early. If something can be resolved without an ongoing engagement, we will tell you that too. The most useful thing we can do in most first conversations is give you a clear view of where things actually stand.

We do not make recommendations we would not be comfortable defending in front of your board.

02

We come in with the end already in mind.

From the first week of any engagement, we are thinking about what your team needs to be able to do when we leave. Every programme we design is built to be handed over. The measure of good work, for us, is an organisation that is more capable at the end than it was at the start.

If a client still needs us as much at the end of an engagement as they did at the beginning, we have not done the job well enough.

03

We bring the right people, not just our people.

Lumaris works with a network of trusted specialists across adjacent disciplines. When a problem calls for someone with deeper or different expertise, we bring them in. The goal is the right outcome for you, and we take that seriously enough not to pretend we are the right fit for every question.

We also believe the people and organisations around us matter. When our partners and clients do well, that is part of what success looks like for us.

04

Day ninety should look better than day one.

We aim to show up on the last day of an engagement the same way we showed up on the first: fully across the work, present in the problem, and focused on what is actually needed. Where we can do better, we will. The working relationship improves as we go, and so does the advice.

We work as part of your team, not alongside it from a distance. That means by the time an engagement matures, we understand your environment well enough to give guidance that is grounded in your reality, not a theoretical version of it. Your priorities shift. Your context changes. We adjust with it, and we try to bring deeper and more relevant thinking as a result.

05

We question how we work, regularly and genuinely.

At the end of every engagement we ask ourselves whether we did it the right way, or just the familiar way. The answers have changed how we work more than once. We think that is a good sign, not an uncomfortable one.

This is not about technology or methodology. It is about staying curious about whether there is a better approach, and being willing to act on the answer when there is.

Who we work with

Is Lumaris the right fit for your organisation?

We find the best engagements start with a clear-eyed conversation about fit. Here is what tends to come up.

A good fit

Organisations where the potential is high, and the margin for error is small.

This tends to mean organisations where the data is sensitive, the services are critical, and the compliance obligations make this even more challenging to navigate. SOCI, ISO 27001, APRA, Essential Eight, or Australian Government security frameworks. See the glossary for what each one covers.

What we do not do

We focus on what we do well, and we are honest about the rest.

We are not a pure cyber services company. We do not provide penetration testing or security operations centres. Where there are intentional gaps, we have partnerships to fill them if you need them, or we will work with your existing providers.

Scale

From a four-week assessment to a large-scale programme. Same methodology, both ways.

We have overseen programmes at enterprise scale and turned around focused assessments in four weeks. What travels between the two is the methodology. What changes is the pace and the scope. Having worked client-side on large programmes, we apply that experience with pragmatism on smaller ones.

Our sectors

Health, government, education, financial services, superannuation, growing business, care services and critical infrastructure operators.

These sectors share the same characteristics: sensitive data, complex compliance, specialist staff with different risk profiles, and consequences that go beyond the organisation. We understand them because we have worked inside them.

How we show up

What you should expect from us.

↳

We bring cross-functional thinking to problems that need it, with an exit plan in mind from day one. Leaving you stronger than we found you is not a nice outcome. It is the whole point.

↳

We will ask questions that challenge the way things are currently being done. Your experience and context always shape the answer. The best outcomes come from that combination.

↳

We are not auditors. We understand what it actually feels like to operate inside a complex organisation and we design everything with that reality in mind.

↳

We will be straight with you about what we see. If something needs attention, we will say so. If you are in better shape than you thought, we will tell you that too.

Let us talk

If this sounds like the kind of team you have been looking for, we would like to hear from you.

Most conversations start simply. Someone wants to know whether we are the right fit for what they are working through. That is a perfectly good place to begin, and you will have a straightforward answer quickly.

Talk to usRead our latest thinking