Audit-ready penetration testing · Sydney, Australia

Yes, that's the design point. Every finding carries CVSS 3.1, CWE class, OWASP category, and cross-references to ISO 27001 (A.8.29), SOC 2 (CC7.1), PCI-DSS (11.3) and GDPR (Art. 32). Reports are reviewed and signed by a certified security professional, with chain-of-custody evidence (timestamps, hashes, raw HTTP captures) attached. The same artifact answers ISO, SOC 2, and PCI auditor questions without re-formatting.

Day 0 to 1 you scope (we generate the SOW and rules of engagement). Day 1 to 3 the assessment runs: reconnaissance, validation, exploitation chains. Once the assessment completes, a certified security professional reviews and signs the report, typically within 2–5 business days. You get a signed PDF, not a 'preliminary draft'.

Included. Once you remediate, we re-test, evidence the fix, and reissue a signed letter, bundled with the original engagement, no second SOW. You hand the auditor the original report plus the re-test addendum and close the finding. Most firms quote the re-test at 50% to 60% of the original engagement; we treat it as part of the work.

Per finding: the raw HTTP request and response captured during the test, timestamp, the exact reproduction steps, a SHA-256 proof hash, and (where relevant) screenshots and traffic captures. Auditors who ask 'how do I know the test was actually performed?' get a definitive answer instead of a sentence in a PDF.

A team of AI agents runs the testing, mapping the attack surface, probing, and chaining exploits at a depth and consistency that's hard for a single tester to reach. A certified security professional then reviews the findings, validates the exploitation chains, and signs the report your auditor receives. That human attestation is what auditors accept.

We're a Sydney team and most of our customers are Australian, across financial services, healthcare, and government-adjacent SaaS. The signed report cross-references ISO 27001, SOC 2, PCI-DSS, HIPAA and GDPR. Our free External Security Check maps what it finds to the Essential Eight and CIS controls it touches. We do not currently map APRA CPS 234, and we don't run IRAP assessments. We'd rather tell you that now than have you find out at audit time.

Pricing is on request. Our On-Demand pentest returns the signed report typically within 2–5 business days once the assessment completes, with a re-test included and no second SOW. Traditional engagements are quoted per scope and vary widely by firm, so the comparison that matters is against your own last invoice and your own last lead time rather than an industry average. Bring both to a scoping call and compare our quote against them.

Scan traffic is encrypted in transit (TLS 1.3). Findings and evidence are encrypted at rest. Credentials for authenticated scans are encrypted, used once, and never written to our database (the scanning worker decrypts them in memory for that run only), unless you opt into the encrypted vault, which seals them for reuse and decrypts them only inside the scanning worker. Either way they never land in logs or evidence. Reports are deleted on request; retention is configurable. Trust Centre has the full breakdown: sub-processors, residency, incident response, the lot.