Frenchelephant is a Brisbane-based cyber security consultancy specialising in identity, governance, and security strategy for Australian organisations navigating an increasingly contested digital landscape.
Most cyber programs fail not on technology, but on translation — between technical risk and board accountability, between vendor promises and operational reality. Frenchelephant exists to close that gap.
Founded by a senior practitioner with deep experience across enterprise identity, security architecture, and Australian regulatory frameworks, Frenchelephant brings vendor-independent counsel to organisations who want clarity, not catalogues.
The practice draws on more than a decade of work alongside Australian enterprises, government, and financial institutions — and on continuing engagement with the global identity and zero-trust ecosystem.
Engagements are deliberately small in number and senior in delivery. You work with the principal, not a team you've never met.
No account managers, no rotating team. Every engagement is delivered by the same person — which is the point.
Principal Consultant · Frenchelephant
Dan Boucaut is a senior cyber security practitioner with more than eight years of regional leadership across the Australian and New Zealand identity and security market. His career spans enterprise security architecture, customer and partner engagement at a global cyber security vendor, and governance practice at board level.
He is a Certified Information Systems Security Professional (CISSP) and a Graduate of the Australian Institute of Company Directors (GAICD) — a combination that lets him operate fluently in both the technical and governance layers of security decision-making. He currently serves as a volunteer National Chair of an Australian not-for-profit, bringing active board-level governance experience to every client engagement.
His primary focus is identity — specifically the intersection of workforce, customer, and non-human identity with zero-trust architectures and the emerging challenge of agentic systems acting at scale on behalf of humans. He works exclusively with organisations where independent, senior counsel matters more than headcount.
Engagements are scoped to specific outcomes — a board paper, an architecture decision, a vendor short-list, a recovery plan — rather than open-ended retainers.
Strategy, architecture, and vendor selection for organisations re-platforming or maturing their identity estate.
Translating cyber risk into language that boards can govern and executives can fund.
Independent assessment of identity, endpoint, and security platforms — without channel incentives.
Trusted counsel for directors, CEOs, and CISOs facing material cyber decisions — informed by AICD governance practice.
Formal credentials matter; lived experience matters more. Both are listed here.
Certified Information Systems Security Professional — ISC². The benchmark certification for senior security practitioners.
Graduate of the Australian Institute of Company Directors — formal grounding in director duties, governance, and board practice.
Sustained governance experience in the Australian not-for-profit sector, including federated structures and ACNC compliance.
Regional responsibility across identity security, customer engagement, and partner ecosystem development in Australia and New Zealand.
Architecture and consulting engagements across financial services, government, and large enterprise customers.
Governance leadership of a federated Australian not-for-profit, including policy, member frameworks, and council oversight.
Occasional writing on identity, governance, and the practical reality of running cyber programs in Australia.
As autonomous agents move from demo to deployment, the identity questions shift from "who is using this" to "what is acting on whose behalf, and with what authority."
Coming soon · 6 min readA typical IAM programme takes eighteen months from vendor selection to stabilisation. A hardware refresh takes three to four years. The Olympic opening ceremony is fixed. The maths is uncomfortable.
Read now · 7 min read Security StrategyA day where every threat actor puts down the keyboard and rests. No zero-days, no phishing, no CVEs. For most organisations, nothing would change — and that is the uncomfortable part.
Read now · 6 min readNo newsletter cadence, no marketing. When a new essay is published you'll get one email — the piece itself, nothing else.
Every engagement starts with a conversation. This form helps us make sure the first call is useful from the outset.
Frenchelephant works best where there is a specific decision or challenge in front of you — not where the brief is to simply "improve security" without a focal point. If any of the following sound familiar, we should talk.
Initial discussions are confidential and without obligation. Response within one business day.
All fields are held in confidence. We do not share your information with third parties.
Thank you. Dan will be in touch within one business day to arrange an initial conversation.
Initial discussions are confidential and without obligation. Whether you have a specific decision in front of you or a vaguer sense that something needs to change, a thirty-minute call usually clarifies whether and how Frenchelephant can help.