Sam Andrews

Executive Director
Sam plays a key role in leading services to deliver quality outcomes for our clients.
Talk to an expert
Highlights

Career highlights

Sam has over 20 years of experience in the IT and cyber security sector, working with enterprise and government clients across New Zealand, Australia and the UK. With a strong background in consulting and leadership, Sam specialises in helping organisations understand, prioritise and respond to evolving digital risks. His approach blends strategic vision with operational pragmatism, supporting clients from early maturity through to embedded security programs.

Sam drives strategic growth across Bastion, helping shape the direction of our consulting services to meet evolving client needs. He works closely with government and enterprise organisations to align security initiatives with business priorities, ensuring risk management delivers real impact.

Cyber security news

Latest advisories

Stay ahead of emerging threats with our expert blog posts, research, and industry updates.
PHP-FPM (PHP Source) - Stored Cross-Site Scripting (XSS) (CVE-2026-6735)
During a security engagement, Conrad Draper discovered a stored XSS vulnerability in the PHP-FPM status endpoint which was due to a lack of input sanitisation of the request URI. This affects the request URI when displaying stored content within the
Union-Based SQL Injection in ERPNext / Frappe Framework (CVE-2026-29081)
During some research, Cale discovered an authenticated SQL injection vulnerability in Frappe Framework, affecting the latest version of ERPNext, including cloud-hosted instances.
TimePictra (Microchip) – Stored Cross-Site Scripting (XSS) (CVE-2026-3010)
During a security engagement, Steve Nyan Lin discovered a stored XSS vulnerability in the TimePictra web application which was due to a lack of input filtering. This affects the neName parameter when creating new network elements.
Discover our services

We have the tools to pinpoint risks

Whether it’s hidden vulnerabilities or patterns you might miss, we help you stay one step ahead and make confident, informed decisions. Understand how our services can help your business uncover critical risks

Talk to an expert
Employee Cyber Training & Awareness
Your people are your first line of defence. Our cyber training builds awareness and sharpens their instincts.
Advisory
When clarity is critical and stakes are high, our advisory services deliver strategic, executive-level security expertise that empowers decision-making.