Penetration Testing
Find out how an attacker would actually get in, before one does
Human-led penetration testing across web applications, APIs, mobile apps, and cloud infrastructure, run by a senior engineer, not a scanner. Engagements can also be scoped as a vulnerability assessment or a full VAPT report for procurement, compliance, and customer security questionnaires.
Who this is for
Before a customer security questionnaire
Answering “do you pentest your application?” with a real, dated report instead of “not yet” keeps procurement moving instead of stalling a deal.
Before you ship something new
A new product, a rebuilt auth flow, a new API. Better a tester finds the gap on your terms than a stranger finds it on theirs.
Meeting a compliance or contract requirement
SOC 2, ISO 27001, PCI DSS, or a clause in a customer contract calling for an annual penetration test, and you want a report that actually satisfies the auditor, not just ticks a box.
What's included
Scoped to what you actually need tested. Most engagements cover one or two of the categories below; larger environments combine them.
Web Application Testing
- Manual testing aligned to the OWASP Top 10 and OWASP ASVS
- Authentication, session management, and business logic testing
- Injection, access control, and input validation testing
API Testing
- REST and GraphQL endpoint testing
- Broken object- and function-level authorization checks
- Rate limiting, abuse cases, and input handling
Mobile Application Testing
- iOS and Android static and dynamic analysis
- Local data storage and insecure data-at-rest review
- API communication, certificate pinning, and session handling
External Infrastructure Testing
- External perimeter and internet-facing attack surface testing
- Cloud configuration and privilege escalation paths
- Exposed service and network edge testing
Internal Infrastructure Testing
- Internal network and segmentation testing, where in scope
- Lateral movement and privilege escalation paths from an assumed-breach position
- Internal service and host configuration review
Reporting & Retest
- Full written report with clear evidence, risk ratings, and remediation guidance
- Executive summary written for auditors, customers, and the board, not just engineers
- 60-minute walkthrough call with the engineer who did the testing
- One round of retesting included, to confirm fixes actually closed the gap
And once the retest is signed off, we don't disappear either. We stay available for any follow-up questions as you work through remediation.
Built on recognized testing standards
Testing follows established methodology, not an ad-hoc checklist, so the report holds up with auditors, customers, and your own engineering team.
OWASP Testing Guide & ASVS
The baseline for web and API application testing, covering the vulnerability classes attackers actually use.
PTES & NIST SP 800-115
Structured phases for infrastructure and network testing, reconnaissance through exploitation, run safely and within agreed rules of engagement.
Mapped to SOC 2, ISO 27001 & PCI DSS
Findings and reporting formatted to satisfy the technical testing requirements auditors and customer security teams actually check for.
How a test runs
1. Scoping call
Free 30 minutes to confirm what's in scope, roughly how big it is, and a fixed price before anything is booked.
2. Rules of engagement
A written scope and rules of engagement, signed by both sides, with a testing window booked around your release calendar. No surprise outages.
3. The test
Manual, human-led testing by a senior engineer. Anything critical gets flagged the moment we find it, not held back for the final report.
4. Report, walkthrough & retest
A prioritized written report, a 60-minute call to go through it, and one round of retesting once fixes are in, to confirm the gap is actually closed.
Questions people ask before booking
How long does a penetration test take?+
Most engagements run one to two weeks of testing, plus report writing, depending on how much is in scope. You'll get an exact timeline on the free scoping call once we know what's being tested.
Is this real testing, or just an automated scan?+
Real, human-led testing. Automated tools support the work, but a senior engineer is the one probing your application by hand, chaining findings together, and testing the business logic a scanner can't understand. You get a report backed by a real person, not a printout.
Will testing affect production or cause downtime?+
Testing runs under an agreed rules of engagement, timed around your release calendar, and excludes destructive or denial-of-service techniques by default. Where possible we test against staging; where production testing is genuinely needed, it's scheduled and scoped carefully in advance so there are no surprises.
Does this help with SOC 2, ISO 27001, PCI DSS, or a customer questionnaire?+
Yes. Testing follows the OWASP Testing Guide, ASVS, and PTES/NIST SP 800-115, and the report is formatted to satisfy what auditors and customer security teams look for: a dated, evidenced pentest report and an executive summary you can hand straight to a questionnaire or an auditor.
What access do you need?+
Most engagements start black-box: no access beyond what's public. For authenticated testing, we'll ask for a couple of standard test accounts at the access level you want tested, nothing more.
What do we get at the end?+
A written report covering every finding, ranked by risk and effort to fix, an executive summary, a 60-minute walkthrough call with the engineer who did the testing, and one round of retesting once fixes are in.
What does it cost, and when do I pay?+
Pricing is scoped to what's being tested and confirmed on the free scoping call. Once agreed, it's a flat fee paid at checkout before testing starts, same as everywhere else on this site: no hourly billing, no surprise add-ons.
Ready to find out what's actually exposed?
From A$3,499 AUD for a standard single-application test. Exact scope and price confirmed on a free call.
Talk it through first. Free.
30 minutes, no pitch. If a full test doesn't make sense for you yet, we'll say so.
Also want to know where your AWS environment stands? See the AWS Security & Architecture Review. Need ongoing coverage after the fixes are in? See Continuous Security Monitoring.