ST4S Penetration Testing
Security Evidence for Education
Penva Security tests digital products used by Australian and New Zealand schools, focusing on student data, teacher and administrator access, tenant separation, registration flows, APIs and cloud services.
The engagement produces practical security evidence for your ST4S preparation, with tester credentials, clear remediation guidance and an updated report after fixes are verified.
- Certified Testers
- Security Compliance
- Manual Pentesting
What Is ST4S Penetration Testing?
Penetration testing supports the technical evidence behind an ST4S submission, but it does not replace the full ST4S assessment. The most useful test follows real school workflows, role boundaries, tenant design, integrations and the types of information the service handles.
Security Areas ST4S Suppliers Need to Address
The framework considers the product as schools actually use it, including authentication, student privacy, administrative access, third parties and any AI-enabled functionality.
Authentication and Account Security
Authorisation and Tenant Isolation
Privacy and Information Protection
Secure Product Functionality
Cloud and Third-Party Services
Safety, Privacy and Security Testing
Evidence Built Around Real School Workflows
Penva tests the product from the viewpoints that matter most: external users, students, teachers, school administrators and support or platform administrators.
Student Access Cross-User Data Testing
Testing that one student cannot access or alter another student’s information, including direct-object references, exports, files and API responses.
School Tenants Isolation and Role Boundaries
Registration Invite and Approval Workflows
Product Scope Web, Mobile, API and Cloud
A joined-up assessment of the product’s real architecture, including exposed APIs, mobile traffic, cloud configuration and third-party integrations.
Submission Evidence Report, Credentials and Retest
Get an Instant Penetration Testing Estimate
Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.
What type of penetration testing do you need?
Choose the main service you want quoted.
Edit option values
Use this table to assign a dollar value to each option. Open this panel with ?penvaPricing=1 at the end of the page URL.
For permanent changes, copy the pricing config and paste it into the PRICE_OVERRIDES section inside this Elementor HTML widget. Front-end prices are only used to display an estimate and should not be treated as a fixed quote.
ST4S Penetration Testing - Common Questions
Questions commonly asked by software suppliers preparing products for school-sector review. Updated July 2026.
The evidence required depends on the product, assessment tier and applicable criteria. Security testing is particularly relevant for products that process student information, provide authenticated functions or expose internet-facing applications and APIs. The ST4S team determines final assessment requirements.
ST4S version 2026.1 was released in July 2026 and is the latest framework version. Suppliers already in an assessment may be working under another active version, so the applicable version should be confirmed before finalising evidence.
A useful grey-box assessment usually needs representative student, teacher and administrator accounts. For multi-tenant services, accounts in at least two school tenants help verify that users cannot cross school boundaries.
Yes. These workflows are important because they often determine who can join a school, class or tenant. We test for code guessing, approval bypass, impersonation, privilege escalation and unintended account linking.
Yes. The scope can include web applications, iOS and Android apps, APIs, cloud configuration and third-party integrations so the report reflects the complete product rather than one interface.
Yes, where they are eligible and in scope. Testing can cover prompt abuse, disclosure of personal information, unsafe output paths, access-control issues and the way AI sessions interact with student and school data.
Yes. One retest within 60 days is included for fixed-price engagements. We repeat the original exploitation method and issue an updated report that can be used as evidence of closure.