How is a pen test different from vulnerability scanning?

Vulnerability scanning is continuous and automated - it tells you what might be exploitable. A penetration test is a manual, point-in-time engagement where a human tester actually attempts exploitation and chains findings together into real attack paths. Mature programs run both.

Will testing disrupt our systems?

Testing is performed under agreed rules of engagement with defined windows, exclusions and escalation contacts. Destructive techniques are never used without explicit approval, and production-sensitive systems can be tested in controlled modes.

How long does an engagement take?

Most single-scope engagements (one web app, or an external network test) run 1–2 weeks of testing plus reporting. Larger multi-scope engagements are phased. You'll get a fixed timeline and price at scoping.

Is the retest really included?

Yes. Once you've remediated, we verify the fixes and issue an updated report - included in the engagement price, not an add-on.

Will the report satisfy our auditors and customers?

The report includes an executive summary, methodology, detailed findings with evidence and reproduction steps, and a remediation-verified retest letter - the format auditors, insurers and enterprise procurement teams expect.

Who does the testing?

Australian-based AUCyber security engineers. Testing is never offshored or subcontracted, and all engagement data stays onshore.

How often should we test?

At minimum annually, and after significant changes - new applications, major releases, infrastructure changes or acquisitions. Many customers pair an annual test with continuous vulnerability scanning in between.

PENETRATION TESTING

Find out what an attacker could do before one does.

Manual, goal-driven penetration testing by Australian security engineers - web apps, external and internal networks, cloud and Microsoft 365 - with reporting your board and your engineers can both act on.

Onshore testers

Manual

Hands-on, not just scans

Retest

Fix verification included

Essential Eight aligned

WHY MOST PEN TESTS DISAPPOINT

A rebadged vulnerability scan is not a penetration test.

Plenty of 'pen test' reports are automated scanner output with a new cover page. A real test is a human adversary working towards a goal - your customer data, your domain, your money - and showing you exactly how they got there.

Scanner output in a suit

Automated findings without exploitation or context tell you what might be wrong - not what an attacker can actually do.

Reports nobody can action

A 90-page PDF of CVSS scores with no attack narrative, no priorities and no fix guidance ends up as shelf-ware.

Scope that misses the real risk

Testing one web app while your virtual private network (VPN), M365 tenant and staff credentials sit untested leaves the doors attackers actually use wide open.

No verification the fix worked

Without a retest, 'we patched it' is an assumption. Many providers charge extra to confirm - or don't offer it at all.

WHAT YOU GET

Real adversarial testing, clear evidence, verified fixes

Every engagement is scoped to your actual risk, executed manually by experienced testers, and closed out with a retest - so the finding count goes down, not just gets documented.

Web application & API testing

Authenticated and unauthenticated testing aligned to the Open Worldwide Application Security Project (OWASP) Top 10 and the OWASP Testing Guide - business logic flaws included, not just injection checks.

External network testing

Your internet-facing footprint tested the way an attacker sees it: exposed services, VPNs, mail, remote access and forgotten hosts.

Internal network & Active Directory

Assumed-breach testing from inside the network - privilege escalation, lateral movement and paths to domain compromise.

Cloud & M365 testing

Configuration and attack-path testing across Azure, Amazon Web Services (AWS) and M365 tenants - identity, conditional access, and privilege abuse.

Social engineering & phishing

Targeted phishing and credential-capture campaigns that test your people and your technical controls together.

Clear reporting + retest included

An executive summary your board understands, technical findings your engineers can fix, and a retest to verify the fixes landed.

WHO IT'S FOR

Built for organisations that need proof, not guesswork

Whether it's a compliance requirement, a customer demand, or board-level assurance - the engagement is scoped to the question you need answered.

SaaS

SaaS & software companies

Pre-release and annual testing of web apps and application programming interfaces (APIs) - increasingly a contractual requirement from enterprise customers.

Public sector / regulated

Government & regulated sectors

Testing aligned to the Information Security Manual (ISM), Essential Eight and Information Security Registered Assessors Program (IRAP) expectations, delivered by Australian-based, security-cleared-friendly testers.

Enterprise IT

Corporate IT estates

Internal, external and Microsoft 365 testing to validate your security investment and find the paths your tooling misses.

High-trust industries

Healthcare, legal & finance

Industries holding sensitive personal data, where a breach is a reportable event - and a pen test is the cheapest breach you'll ever have.

UNDER THE HOOD

How an engagement runs

Structured methodology, human execution, evidence at every step.

Methodology

Frameworks: OWASP, Penetration Testing Execution Standard (PTES), MITRE ATT&CK
Approach: Manual testing supported by tooling - never scanner-only
Test types: Black box, grey box, white box, assumed breach
Rules of engagement: Agreed scope, windows and escalation contacts before any testing

Coverage

Applications: Web apps, APIs, mobile backends
Infrastructure: External and internal networks, Wi-Fi, VPN
Cloud & identity: Azure, AWS, M365, Active Directory / Entra ID
People: Phishing and social engineering (optional)

Delivery

Testers: Australian-based security engineers
Reporting: Executive summary + technical findings with reproduction steps
Debrief: Walkthrough call with your technical team included
Retest: Fix verification retest included in every engagement

Compliance alignment

Frameworks: Essential Eight, ISM, ISO 27001, SOC 2, PCI DSS
Evidence: Report and retest letter suitable for auditors and customers
Data handling: All engagement data stored onshore in Australia
Cadence: One-off, annual, or per-release programs

WHO TRUSTS US

Testing that stands up to scrutiny

Our reports are read by boards, auditors, insurers and enterprise customers - and they hold up.

ISO 27001 certified

Australian-based testers

FAQ

Common questions about Penetration Testing

Anything more specific - drop us a note below.

READY WHEN YOU ARE

Get an attacker's view of your business - on your terms.

Scoping is free and takes one call. Most engagements start within 2–3 weeks of sign-off.

Vulnerability Scanning

Continuous, automated visibility between point-in-time tests.

Managed SIEM/SOC

See whether your detection stack catches the techniques we used.

Incident Response

If a test finding is already being exploited, our IR team steps in fast.

Let's talk specifics

A short note about your environment is enough to start the conversation.