⬢ Buyer's Guide · Updated May 2026
What is Penetration Testing ?
A plain-language guide to what penetration testing actually is, how it works, who needs it, what to expect, and how it differs from adjacent terms like vulnerability scanning, red team and security audit.
Human-led penetration testing with audit-ready evidence
Built for Australian buyers who need real exploit validation, clean remediation priorities, and reporting that can be shared with auditors and customers.
Engagement snapshot
Scope, cost and evidence mapped upfront
A quick summary of what buyers usually compare before booking a scoping call.
Quick Answer
What is Penetration Testing?
Penetration testing is a manual security assessment where certified ethical hackers attempt to exploit your systems the same way real attackers would — with written authorisation, defined scope and a goal of producing a documented list of what they could break.
Quick answer
What is Penetration Testing?
Penetration testing is a manual security assessment where certified ethical hackers attempt to exploit your systems the same way real attackers would — with written authorisation, defined scope and a goal of producing a documented list of what they could break.
A pentest answers a different question from a security scan or a paper audit. A scan asks “what might be wrong?” An audit asks “is the program documented?” A penetration test asks “can attackers actually get in — and if so, how, and what would they reach?” The output is a short list of proven, exploitable findings with severity, evidence and remediation guidance, suitable as audit evidence under ISO 27001, SOC 2, PCI DSS, APRA CPS 234 and equivalent frameworks.
How It Works
The Five Stages of a Penetration Test
Most penetration testing engagements follow this five-stage flow. Time per stage varies with scope; total elapsed time for a typical engagement is 7–14 business days.
1
Scoping
Agree what systems are in scope, what user roles to test, and what’s off-limits. Usually a 30-minute call.
2
Reconnaissance
Map the attack surface — subdomains, APIs, technology stack, authentication flows. AI accelerates this.
3
Exploitation
Human testers manually attempt to exploit findings — bypass authentication, escalate privilege, access data.
4
Reporting
Audit-ready report with executive summary, technical detail per finding, evidence, and remediation guidance.
5
Retest
After you remediate, testers confirm each finding is closed. The evidence auditors actually want.
Not the Same Thing
Penetration Testing vs Vulnerability Scanning vs Security Audit
These three are often confused — and they shouldn’t be. Each answers a different question, costs different amounts, and is required for different purposes.
Capability
Penetration Testing
Vulnerability Scanning
Security Audit
Method
Manual exploitation by certified testers
Automated signature-matching
Documentation review + interviews
Output
Short list of proven, exploitable findings
Long list of potential issues
Compliance gap analysis
Time
5–14 business days typical
Hours to run, ongoing
1–4 weeks typical
Cost
AUD $2,500–$40,000+
Software licence (lower)
AUD $10,000–$100,000+
Audit Acceptance
✓ Primary evidence for ISO, SOC 2, PCI, APRA
~ Supporting evidence only
✓ Required for certification
What it Proves
That attackers can or can’t break in
What might be wrong (unverified)
Whether controls exist on paper
Who Needs One
Who Needs a Penetration Test?
Most organisations book pentests for one of these six reasons. If any apply, you probably need one.
Compliance-Driven
Required for ISO 27001, SOC 2, PCI DSS, APRA CPS 234, HIPAA. The single most common reason organisations book a pentest.
Enterprise Sales
Enterprise customers ask for a recent pentest report or letter of attestation before signing — especially in regulated industries.
Pre-Launch
New product, major release, or migration to a new platform. Catch security flaws before customers do.
Annual Re-Test
Most security programs schedule one full pentest per year as a baseline assurance signal — independent of major changes.
Post-Incident
After a breach, near-miss, or security review reveals concerns. Validates that fixes worked and finds what was missed.
Regulator-Requested
APRA, ASIC, OAIC, or sector regulator has asked for evidence of security testing in the past 12 months.
Definitions
Key Terms You'll Encounter
The cybersecurity industry has a vocabulary problem. Here’s plain-English translation for the terms that come up most in penetration testing conversations.
Pentest
Industry shorthand for ‘penetration test’. Identical meaning.
Ethical
Older term used interchangeably with penetration testing. Same activity.
Red
Adversary-simulation engagement — broader and longer than a pentest, often months. Tests detection and response, not just vulnerability discovery.
Blue
Your defenders — security operations, detection engineers, incident responders. Opposite of red team.
Purple
Collaborative engagement where red and blue work together to improve detection in real time.
White
How much information the tester gets up front. White box = full source code and architecture; black box = nothing; grey box = the middle (typical for most pentests).
VAPT
Vulnerability Assessment and Penetration Testing. A combined offering — automated scanning plus manual exploitation.
PTaaS
Pentest-as-a-Service — penetration testing delivered through a subscription platform rather than as a fixed-price project.
CREST
International accreditation body for cybersecurity service providers and individuals. The credential most commonly required by Australian Government and APRA-regulated procurement.
OSCP
Offensive Security Certified Professional — practical hands-on certification widely held by penetration testers. Pairs well with CREST credentials.
CVSS
Common Vulnerability Scoring System — standard numerical severity score (0–10) attached to every finding.
Letter
A signed letter from the testing firm confirming testing occurred. The artefact most auditors specifically request.
Buyer's Checklist
How to Choose a Penetration Testing Provider
Eight questions worth asking any pentest firm before signing. The answers separate the credible providers from the scanner-resellers.
Buyer’s Checklist
How to Choose a Penetration Testing Provider
Eight questions worth asking any pentest firm before signing. The answers separate the credible providers from the scanner-resellers.
The Eight Questions
- Are the testers CREST-certified? (Or holding equivalent recognised credentials — OSCP, OSCE3, CRTO.)
- Will the report identify the testers by name? (Required by auditors for credential verification.)
- Is the methodology documented and aligned to a recognised framework? (OWASP, NIST SP 800-115, PTES, MITRE ATT&CK.)
- Is remediation retest included or charged separately? (Free retest matters for ISO / SOC 2 closure evidence.)
- Are findings manually validated, or just scanner output? (Manual validation = near-zero false positives.)
- Is the report audit-ready for your specific framework? (ISO 27001, SOC 2, PCI DSS, APRA CPS 234, HIPAA.)
- Will sensitive findings stay in Australian jurisdiction? (Matters for APRA, IRAP, Privacy Act-regulated entities.)
- Is the quote fixed-price or hourly-billed? (Fixed-price is easier to budget and signals the firm’s confidence in scope.)
FAQ
Penetration Testing — Common Questions
Direct answers to the questions buyers ask most. Updated May 2026.
What is penetration testing in simple terms?
Penetration testing is when you hire certified ethical hackers to try to break into your systems the way real attackers would. They use the same techniques as malicious hackers — but with permission, with a written scope, and with a goal of telling you what they found so you can fix it. The output is a report listing what they could exploit, with evidence and remediation guidance.
How is penetration testing different from a vulnerability scan?
A vulnerability scan is an automated tool that compares your systems against a database of known issues and produces a list of potential problems. A penetration test is a manual exercise where certified humans actually try to exploit those issues — and find the ones scanners can’t detect (business logic flaws, authorisation bypass, multi-step attack chains). Scans produce noisy long lists; pentests produce short lists of proven, exploitable findings. Most compliance frameworks require both as separate controls.
How is penetration testing different from a red team engagement?
Both involve simulated attacks, but the scope and goals differ. A penetration test is bounded — usually one application or environment, fixed timeline (5–14 days), goal is comprehensive vulnerability discovery. A red team engagement is open-ended — full attack-simulation across your organisation, often months long, goal is testing your detection and response (your blue team) as much as your prevention. Most organisations need a pentest annually; only mature security programs run red team exercises.
Is penetration testing legal?
Yes — provided you have written authorisation from the system owner before any testing begins. Every legitimate penetration test starts with a signed scope document (often called a Rules of Engagement letter) that defines what the tester is authorised to do. Testing without authorisation is illegal under Australian computer-crime law and globally. Penva Security signs an NDA before scoping and a Rules of Engagement before testing on every engagement.
How often should we get a penetration test?
The standard baseline is annually, plus after any significant change — new product launch, major architecture change, post-acquisition integration, or in response to a security incident. Some frameworks specify minimums (PCI DSS v4.0.1 requires annual + post-significant-change; ISO 27001 leaves it to your risk assessment; APRA CPS 234 expects ‘sufficient frequency’ to maintain assurance). High-velocity SaaS teams shipping weekly often add Pay-As-You-Go testing on top of an annual baseline.
How much does penetration testing cost in Australia?
Most Australian penetration tests cost between AUD $2,500 and AUD $40,000 per engagement. The range depends on what’s being tested (a single web app is at the lower end; an enterprise environment with multiple apps, APIs, internal infrastructure and a red team component is at the higher end). See our cost guide for the cost drivers and what typical scopes price at.
Who performs penetration testing?
Penetration testing is performed by qualified human testers — typically holding CREST credentials (CRT, CPSA), OSCP, OSCE3, or equivalent. The testers should be named in the engagement and on the final report. Australian Government and APRA-regulated procurement specifically expect CREST-certified individuals. Beware of providers that won’t tell you who the testers are or that rely entirely on automated tools.
What does a penetration test report contain?
A proper penetration test report contains: an executive summary (non-technical, for board / audit / customer use), a methodology section (what frameworks the testers followed), a scope statement (what was and wasn’t tested), a list of findings (each with severity score, evidence, business impact, and remediation guidance), and an attestation page (signed letter confirming testing occurred). The full PDF report typically runs 30–80 pages.
Will a penetration test slow down or break our systems?
A well-scoped pentest is non-disruptive — testers work carefully against production or staging systems with explicit rules about what to avoid (denial-of-service testing, destructive payloads, third-party integrations). Most engagements run against staging environments specifically to remove operational risk. The rare exception is internal infrastructure pentests where some controlled exploitation in production may be necessary; scope and risk are explicitly agreed during scoping.
What happens after we get the report?
Three things. First, your development or operations team works through the findings in severity order to remediate them. Second, the testing firm typically holds a 1:1 walkthrough call to clarify findings and discuss remediation approaches. Third — and this is the part most buyers forget — a remediation retest validates that each fix actually closes the vulnerability. The retest is what your auditor will specifically ask for; engagements that include free retest are better value than those charging for it separately.
Can AI replace penetration testing?
Not in 2026, and not for the foreseeable future. AI is excellent at the reconnaissance and coverage parts of testing — mapping the attack surface, finding known vulnerabilities, running thousands of payload variations. AI consistently misses business logic flaws, authorisation bypass, IDOR chains, and the multi-step attack paths that cause most real breaches. The current best practice in 2026 is human-led + AI: AI handles breadth, humans handle exploitation and judgment. Auditors are not currently accepting AI-only testing as compliance evidence.
Is a penetration test the same as a security audit?
No. A security audit reviews documentation, policies, processes, and control evidence — usually for a certification (ISO 27001, SOC 2). It asks ‘do you have the right controls on paper, and can you prove they’re operating?’ A penetration test is a technical exercise that actually attempts to exploit your systems — it asks ‘do your controls actually work when attacked?’ Most compliance frameworks require both: the audit confirms the program exists, the pentest confirms the technology stands up.
Next step
Ready to Talk to a CREST-Certified Pentest Provider?
Free 30-minute scoping call. Fixed-price quote within 24 hours. Human-led + AI testing. Audit-ready reports. Free retest within 60 days.
Ready to Talk to a CREST-Certified Pentest Provider?
Free 30-minute scoping call. Fixed-price quote within 24 hours. Human-led + AI testing. Audit-ready reports. Free retest within 60 days.