Penetration testing services, from scope to retest
A specialist testing partner tries to break in under rules we agree with you, and we manage the engagement from scoping to report. Because we also run IT and security, we can fix what the test finds and arrange the retest.
★★★★★ 4.9 on Google from 60+ reviews
- ISO27001 and 9001 certified, audited externally
- 150+Organisations protected by Austin SecureShield
- 300+Client organisations that trust us with their IT
- 15Years operating as an Australian owned provider
Trusted by 300+ organisations, including
Four places attackers try first
Most engagements cover one or two of these. We help you choose based on what a client, insurer or tender has asked for and where your real exposure sits.
External network
Your public addresses, firewalls, VPNs and anything else an attacker can reach from the internet.
Internal network
What an attacker could reach after getting onto one laptop or plugging into the office network.
Web applications
Customer portals and web apps, tested for the common flaws attackers use to reach data or accounts.
Microsoft 365 and Azure
Tenant configuration, identity and sharing settings, where a single mistake can expose the whole business.
Have a project in mind? Send us the outline. A technical consultant will scope it with you and come back with a fixed price.
A pen test is not a vulnerability scan
The three are often confused, and they answer different questions. Most businesses need scanning all the time and a pen test at key moments.
| Compare | Vulnerability scanningAutomated, ongoing | Penetration testThis page | Cyber security auditReview of settings |
|---|---|---|---|
| What it does | Checks for known vulnerabilities and missing patches | A tester tries to exploit weaknesses and chain them together, as a real attacker would | Reviews settings, accounts, devices, backups and policies |
| How often | Continuously, with results reviewed and fixed | Point in time, for example yearly or after a major change | Once, then at your regular reviews |
| Who runs it | Austin, using ConnectSecure | A specialist testing partner, managed by Austin | Austin |
| What you get | A running list of vulnerabilities and their fixes | Findings with evidence and severity, then fixes and a retest | An Essential Eight score and a plan in order of risk |
| How it is priced | Included in every SecureShield plan | Fixed quote after a scoping call. Not part of any plan | Starts with a scoping call |
Swipe the table sideways to see every column.
Never had a security review? An audit first makes a pen test better value. See Cyber security audit.
Want to test how staff respond to phishing? Simulations run through our security awareness training.
One engagement, managed end to end
You deal with us from the first call to the retest. We manage the partner, the schedule and the report.
- 01
Scoping call and fixed quote
We agree what is tested, what is off limits and why the test is needed, then send a fixed quote.
- 02
Rules of engagement
Dates, test windows, contacts and a way to stop the test are agreed in writing before anything starts.
- 03
Testing
The specialist partner runs the test in the agreed window while our engineers stay on hand in case anything needs attention.
- 04
Report, fix and retest
We walk you through the findings, fix what is in our remit and arrange a retest to confirm the fixes hold.
Findings that get fixed, not filed
A pen test report is only worth what happens next. This is where a managed engagement differs from hiring a tester on your own.
One team, start to finish
You have one contact for scoping, scheduling, questions and the report. We handle the testing partner for you.
No juggling providers
Fixed by the people who run your IT
Findings go straight to the engineers who look after your systems, so fixes are planned properly and nothing sits in a PDF.
Remediation quoted up front
Checking between tests
SecureShield vulnerability scanning keeps looking for new weaknesses after the test, so you are not waiting a year to find the next one.
Included in every plan
When a pen test is the right call
We would rather point you to the right service than sell you a test you do not need yet.
A strong fit
- A client, insurer or tender asks for a penetration test report
- You have launched a new portal, web app or remote access system
- You have finished an Essential Eight uplift and want to know it holds
- You have made a major change to your network or cloud setup
Probably another option, and we will say so
- You have never had a security review, so start with a cyber security audit
- You want continuous checking, which vulnerability scanning in SecureShield covers
- You know the basics such as MFA and patching are missing, so fix those first
A report for the board and the engineers
Directors need to know what the findings mean for the business. Engineers need enough detail to fix them.
- 01
Executive summary
What was tested, what was found and what it means for the business, written so you can share it with a client or insurer.
- 02
Technical findings
Each finding with evidence, a severity rating and the steps to fix it, ranked so the worst problems are dealt with first.
- 03
Retest results
Confirmation of which findings are fixed after remediation, so you can show the gap is closed rather than just reported.
A top 50 MSP in Australia, three years running
Rated by our clients on Cloudtango, and audited every year on security, quality and cyber controls.
Top 50MSPs in Australia
- 2024
- 2025
- 2026
Ranked on client satisfaction and service depth.
Read our 25 client reviews on Cloudtango
ISO 27001
Information securityHow we handle your data, passwords and access, audited every year.
How we protect your data
ISO 9001
Quality managementDocumented processes, so every engineer works to the same standard.
How we work
SMB1001 Gold
Cyber security, Level 3The 27 control cyber standard we take clients through, held ourselves.
Check our certificatePenetration testing questions
What people ask before they commission a test. Anything else, call 1300 787 429.
What is the difference between a vulnerability scan and a penetration test?
A scan is automated and looks for known weaknesses such as missing patches. A penetration test is done by a skilled tester who tries to exploit weaknesses and link them together to see how far an attacker could get. Scanning runs all the time on SecureShield. A pen test is a point in time engagement.
How much does a penetration test cost?
It depends on what is tested and how deeply. You get a fixed quote after a scoping call, before any work starts. Penetration testing is not part of any SecureShield plan. It is a separate, one off engagement with no ongoing contract.
Will testing disrupt our systems or staff?
Tests are planned to keep risk low: agreed windows, systems that are off limits, named contacts and a way to stop the test. Our engineers stay on hand while it runs. Staff only need to be involved if the scope includes phishing simulation.
Who does the testing and are they CREST accredited?
Testing is delivered by a specialist testing partner and managed by Austin. CREST ANZ is a not for profit body that approves testing companies and certifies individual testers. If a client or tender requires CREST, tell us at the scoping call and we will confirm the credentials for your engagement.
How often should we test?
Common triggers are a client or insurer requirement, a new system facing the internet or a major change to your network. Some contracts set a yearly test. Between tests, vulnerability scanning in SecureShield keeps checking for new weaknesses.
Can you fix what the test finds?
Yes. We quote remediation after the report, fix what is in our remit and arrange a retest. If you have your own IT team or another provider, we can hand the findings to them instead.
Test it before
someone else does.
Get a fixed price pen test quote. Tell us what needs testing and why, and we will scope it, quote it and manage it through to the retest.
- A reply within two business hoursA technical consultant reads every enquiry and comes back to you.
- Proven in 90No onboarding fee, 14 days to fix anything you raise and nothing owing if you leave in the first 90 days. How it works
Or email sales@austintechnology.com.au