Talk to Penva Security Multiple Ways. Australian Team.

Email [email protected] with a one-paragraph description of what you want tested, your compliance framework (SOC 2, ISO 27001, APRA CPS 234, PCI DSS, etc.), and your rough timeline. We’ll respond within one business day with either a fixed-price quote or a few clarifying questions plus a scoping call proposal. The full quote turnaround after scoping is 24 hours standard.

No – the scoping call exists exactly for buyers who aren’t sure what they need. Tell us what you’re trying to achieve (SOC 2 evidence, an APRA tripartite review, pre-launch security validation, etc.) and we’ll work out the right scope together. We’d rather help you get scope right than receive a perfectly-formed RFP.

Yes – for Melbourne-based clients, we welcome in-person scoping conversations at our office or yours. For Sydney, Brisbane, or other interstate engagements, we travel for scoping, kickoff, and final readout sessions. Most testing itself runs remote (it’s faster and equally effective), but we believe in-person meetings matter for the human conversations around engagement design.

Three different urgency paths. (1) For active security incidents or vulnerability disclosures, use [email protected] – 48-hour initial response SLA, see /responsible-disclosure/ for full process. (2) For urgent scoping needs (e.g., audit deadline in 2 weeks), email [email protected] with ‘URGENT’ in the subject line – we prioritise these. (3) For business-hours urgency, phone is faster than email.

For sales enquiries ([email protected]): we respond within one business day standard. Out-of-hours enquiries get acknowledged the next business morning. For security incidents ([email protected]): we monitor this inbox outside business hours and respond within 48 hours regardless of time of day, including weekends.

The minimum useful set: (1) what system you want tested (web app, API, cloud infrastructure, mobile app), (2) what compliance framework you’re working toward, (3) your rough timeline (urgent / 1-3 months / 3-6 months / flexible), (4) any specific requirements (e.g., on-site presence, named tester attestation, specific test methodology). The more you can include, the more useful our first response. Missing information just becomes the first question in a scoping call.

Yes – we monitor LinkedIn DMs and respond, but for engagement enquiries we always direct to [email protected] because email creates a written record both parties can reference during procurement. For general security community engagement, LinkedIn works fine. For confidential or NDA-protected information, email is required.

Penva Security is headquartered in Melbourne, Victoria, Australia. ABN 81 686 956 383. Our office is in the Melbourne CBD – exact address shared after the first scoping conversation. For in-person meetings before that, we typically meet at a CBD café or your office, whichever works.

Penva Security’s focus is Australian clients – businesses headquartered in Australia or with substantial Australian operations. We occasionally work with New Zealand clients (CREST ANZ also covers NZ) and with US clients who have Australian subsidiaries needing AU-jurisdiction testing. For purely overseas engagements without an Australian compliance driver, we’d direct you to a local CREST-aligned firm in your region.

Email is faster than the contact form because it bypasses any form-handling routing – you reach our team inbox directly. The form on this page exists for buyers who prefer that channel; both reach the same place. For urgent enquiries, email or phone is faster. For procurement teams who need written engagement context, email is required.