How do you let staff keep using the macros and scripts they need without lowering your guard against malicious code?
OrgSeal
Vet it. Sign it. Trust it.
OrgSeal is a self-service portal that assesses Microsoft Office macros, PowerShell, and executables for malicious behaviour — and digitally signs the ones that are safe. The fast, auditable way to let your people keep using the code they need, without leaving the door open.
Two independent checks before signing
Signs only what is proven clean
Built in Australia for Australian compliance
Macros and scripts are useful. They're also how attackers get in.
Office macros, PowerShell, and unsigned executables remain one of the most common ways malicious code reaches a workstation. The safe answer — block everything unsigned — works, right up until the finance team needs their spreadsheet macro or an engineer needs a deployment script.
The usual alternatives are all bad in their own way:
- Allow everything unsigned, and you've accepted the risk.
- Block everything unsigned, and you've broken the business.
- Assess each file by hand, and you've built a queue your security team will never clear.
- OrgSeal removes the trade-off: every file is assessed automatically, and only the clean ones get signed.
Can you show an assessor exactly how every macro was vetted before it was signed — file by file?
How long is the review queue when every macro, script, and executable has to be checked by hand?
What happens when malicious code stays dormant the moment it senses a sandbox, then runs later?
An executable has no source to read. What's your second opinion before you sign it?
Can you evidence macro and executable controls across every Australian framework you're assessed against?
How do you keep signed files valid after your code-signing certificate expires?
Assess automatically. Sign only what's clean.
OrgSeal runs every file through a two-stage evaluation, then applies the correct digital signature only to the ones that pass. Most tools make one kind of check and trust it. OrgSeal makes two — because the ways code hides are different, and one method's blind spot is the other's strength. And the second check is matched to the file — source is read as source, and binaries are judged on what the rest of the world has already found in them.
When the result is anything other than conclusively clean, the file is held for a person to review — never signed on a guess. Single files or bulk uploads, through the portal or straight from your own systems via API.
Tier 1 — Behavioural detonation
- Each file is detonated in an isolated sandbox and watched at the system level — what it touches, what it runs, where it tries to connect.
- Catches code that behaves maliciously when it executes, including macros and scripts written to evade simpler scanning.
Tier 2 — Independent second opinion
- Macros and scripts are read as code: macro source is extracted and analysed directly, and scripts are analysed as the source they already are.
- Executables and installers are checked against the consensus of around 70 anti-malware engines, matched by hash — the file itself never leaves your network.
- Catches what detonation can miss: code that stays dormant when it senses a sandbox, time-delayed payloads, source tampered so that what runs isn't what you're reading, and binaries the wider world has already seen and flagged.
Fail-safe by design
- A confirmed malicious detonation can never be overridden.
- Anything short of a conclusively clean result is held for human review, never signed on doubt.
- A check that errors or times out is never treated as a pass. The file is held.
Three steps. No specialist skills required.
OrgSeal takes a file from upload to a trusted, signed result — with a decision recorded at every step:
- Upload a file through the portal — a macro-enabled document, a PowerShell or other script, or an executable. No security expertise needed.
- OrgSeal runs it through the two-stage engine: dangerous files are rejected with the reasons recorded, and clean files are signed with the correct signature for the file type.
- Download a signed file ready to run under your trusted-publisher policy, with every sign-or-reject decision logged for audit.
Single files or bulk uploads, through the portal or straight from your own systems via API — with a full audit trail either way.
Self-service uploadsTwo-stage assessment
Audit-ready by default
Built for the obligations you actually have to meet.
Controls on Office macros and executable code are now written into Australian security frameworks across government, health, and critical infrastructure. OrgSeal helps you meet them — and gives your assessors the evidence they ask for.
Mapped to the frameworks you're assessed against:
- ACSC Essential Eight
- Protective Security Policy Framework (PSPF)
- Australian Digital Health Agency (ADHA)
- Australian Energy Sector Cyber Security Framework (AESCSF)
Self-service uploadsTwo-stage assessmentAudit-ready by default