Vectra is a CREST-accredited penetration testing company with Australian testers and offices in six Australian cities. We check every finding by hand and show you how to fix it.
Vectra provides penetration testing services in Australia for business and government. We are a CREST-accredited penetration testing provider, operating since 2001. Our testers are based in Australia and work nationally. A pen test is a controlled, authorised attack on your systems that shows which weak points an attacker could really use, and how far they could get. We combine commercial tools, open-source tradecraft and custom tooling built for you, so you never get a template report reused for every client. A senior tester checks every finding by hand and ranks it by business impact. You get clear fix guidance, and a retest proves the fix worked.
Here is how a Vectra penetration test works, in brief, with the detail for each point further down this page.
Each test is scoped and quoted to your environment. Tell us what you need tested and why, and we will prepare a scoped quote.
CREST-accredited penetration testing provider, with six CREST accreditations across security testing and red teaming.
Testers based in Australia. Every test is led by a CREST-registered Practitioner or Senior Consultant.
Adelaide (headquarters and 24/7 SOC), Sydney, Melbourne, Perth, Canberra and Brisbane.
Web application, API, network, cloud, mobile app, wireless, OT and ICS, AI agent, and phishing and social engineering.
Executive report, technical report with repeatable steps, ranked fix roadmap and developer debrief.
A retest window for every finding rated High or above.
Reports map to PCI DSS, ISO 27001, APRA CPS 234, the SOCI Act, Essential Eight and IRAP.
Penetration testing is an authorised, simulated attack on your systems. A tester acts like a real attacker, within rules you agree to. The aim is to find weak points, prove which ones can be used and show what an attacker could reach. A pen test answers a practical question. What could someone do to us today, and how do we stop it?
A vulnerability scan lists known weak points. A penetration test tries to use them, links them together and measures the real impact. Scanning finds issues often and at scale, while testing proves which of them matter. Many organisations need both. See our vulnerability scanning and ASV services for the scanning side.
Scanners find what is easy. People find what matters. Output from tools such as Nessus, Burp and OWASP ZAP feeds our triage step, and then a tester works by hand. Every High-severity issue is exploited by hand to confirm its impact. Our testers look for broken access control, business-logic flaws and chains of small issues that a scanner cannot see. We never put raw scanner dumps in a report.
Organisations usually test for one of three reasons. A regulator or standard asks for it, such as PCI DSS or APRA CPS 234. A customer or partner asks for proof of security. Or a big change is coming, like a new app, a move to the cloud or a network redesign.
Each attack surface fails in its own way, so each needs its own tools, test cases and proof. Choose one test, or combine them where an attacker could move between layers.
Websites, portals, single-page and thick-client apps.
REST, GraphQL and gRPC APIs, on their own or with the app that uses them.
The perimeter, the internal network and the infrastructure behind it.
The paths an attacker would use through your cloud accounts.
iOS and Android apps, tested against OWASP MASVS.
Can someone in radio range get into your network?
Safe, passive-first testing inside strict safety limits.
Chatbots, AI assistants and agents.
How your staff and controls respond to a realistic attack.
All testing is done in Australia.
Our testers are based in Australia and work nationally. Vectra started in Adelaide in 2001 as an offensive-security practice. Since 2022 we have been part of Ensign InfoSecurity, so local testing is backed by the depth of the Ensign group.
CREST accreditation is a check on the company, not on one person: CREST looks at how a firm is run, and how it delivers and quality-checks its work. That gives you an independent view of a provider before you let it attack your systems.
Vectra is a CREST-accredited penetration testing provider. Our accreditations are listed on the CREST Marketplace, so you can check them yourself.
Every test is led by a CREST-registered Practitioner or Senior Consultant. A senior tester checks every finding before it reaches your report.
Between them, our testers hold OSCP, OSEP, CEH, eCPPT, CRTP, CRTE, CRT and GICSP. Not everyone holds every credential. If your work needs a named credential, we confirm who is assigned when we scope it.
Our testers are based in Australia and work nationally. Data storage and access are agreed for each engagement.
Our consultants also hold CISA, CISM, CISSP, PCI-QSA and IRAP credentials. Our IRAP assessors are endorsed by the Australian Signals Directorate.
Six separate CREST accreditations, across security testing and red teaming.
CREST Security Testing
CREST Security Testing
CREST Security Testing
CREST Security Testing
CREST Red Teaming
CREST Red Teaming
Every test follows the same six CREST-aligned steps, from scope to retest. Web and API tests follow the OWASP Top 10 and ASVS Level 2. Mobile tests follow OWASP MASVS.
A named engineer scopes the test. We agree the rules of engagement, confirm escalation contacts and lock the test window.
We rank what matters to your business. Threat trees and abuse cases go into the scope pack before testing starts.
Passive and active discovery maps your attack surface the way an attacker would see it, not the way your asset register describes it.
We verify every issue by hand and capture the full chain of evidence. Every finding rated High or above gets a proof of exploit.
We follow each foothold to see how far an attacker could get. We also record where your SOC team had a chance to detect us.
You get an executive narrative, a technical walkthrough, fix guidance, a developer debrief and a retest session.
Every finding is repeatable, ranked and ready to fix. Each engagement includes the following.
A separate report for the board and executive team. It turns findings into business, legal and reputational terms, ready for risk committees and regulators.
Every finding comes with exact steps, affected assets and screen captures of the exploit chain, so your team can repeat it. Raw scanner output is never included.
Findings are ranked by business impact, with developer-ready fix guidance and a suggested code fix where it applies. We map them to PCI DSS, Essential Eight, ISO 27001 or APRA CPS 234 where required.
A findings debrief, plus a paired session with your developers. Your developers hear why each issue matters and how to fix it.
Every finding rated High or above includes a retest window. We test again after your fix, so the fix gets confirmed, not assumed.
Track fixes in one portal. Current and past findings are searchable by asset, tester, severity and framework, with trends across tests and teams.
Many tests start with a compliance duty. We map each report to the framework you answer to, so the evidence is ready for your auditor or regulator. Testing also helps show the reasonable steps the Privacy Act expects.
Penetration testing and segmentation testing under requirement 11.4. Our pen test team works alongside our PCI QSAs, so the evidence fits your assessment.
A pen test gives evidence that your technical controls work in practice. That supports your certification audit and the reviews that follow it.
APRA-regulated entities must test the controls that protect their information assets. A pen test is one way to show those controls work.
Testing shows whether your Essential Eight controls hold up against a real attacker.
Testing of IT systems and IT-to-OT paths gives evidence for your risk management program under the SOCI Act.
Test results can feed an IRAP assessment of a government system. Our IRAP assessors are endorsed by the Australian Signals Directorate.
Our clients include ASX 100 and ASX 200 companies, federal, state and local government, and defence. We also test for manufacturing, insurance, gaming and wagering, and large service providers.
Payment platforms, customer portals and the APIs behind them, tested with PCI DSS and APRA CPS 234 in mind.
Federal, state and local government systems. Panel listings and ASD-endorsed IRAP assessors make it simpler to engage us.
Healthcare penetration testing for patient portals, clinical apps and the networks that hold health information.
Energy, water, telecommunications and other SOCI Act sectors, with safe, passive-first testing of OT systems.
Booking systems, operational networks and the partner links that keep goods and people moving.
Online stores, payment pages and loyalty apps, where a single flaw can expose customer and card data.
We have six offices across Australia, and our testers work nationally, so you can engage us from anywhere in the country. Each city page covers local sectors, compliance needs and procurement routes.
145 South Terrace, Adelaide SA 5000. Phone +61 8 8208 0800.
3 Spring Street, Sydney NSW 2000. Phone +61 2 9276 1800.
454 Collins Street, Melbourne VIC 3000. Phone +61 3 9036 3800.
Level 3, 1060 Hay Street, West Perth WA 6005. Phone +61 8 6365 4090.
Our government office in the Australian Capital Territory. Phone +61 2 9276 1800.
Our Queensland office in Brisbane. Phone 1800 816 044.
Government and regulated buyers can reach Vectra through set panels, registers and contract routes. A panel can cut the work of engaging a penetration testing service provider.
You still need to follow your own buying rules and test value for money. Confirm our current status when you buy. Tell us who is buying and what you need, and we will help you find the right route.
Advanced Supplier on the NSW ICT Services Scheme, SCM0020.
On the eProjects Panel, the Cyber Security Services Panel and eProjects Plus.
Appointed supplier on the eServices Register. You buy through the Victorian Digital Marketplace.
We work with Queensland buyers under the QITC Contracting Framework, the state's ICT contract terms.
Listed in SWIFT's Directory of Cyber Security Service Providers for Asia-Pacific.
Use these checks to compare penetration testing companies in Australia, including us. A good provider will answer each one clearly and in writing.
CREST accreditation you can check yourself on the CREST Marketplace
Named tester credentials that fit your scope, such as OSCP, OSEP or CRT
Manual testing that proves impact, not a scanner report with a new cover
A written scope, rules of engagement and escalation contacts before testing starts
A clear retest policy that says which findings are retested and when
Reports that both your board and your developers can act on
Where the testers are based and how your data is handled
Findings mapped to the frameworks you answer to
A penetration test, or pen test, is a controlled attack on your systems by a skilled tester, with your written permission. It shows which weak points an attacker could really use and what they could reach from there. Unlike a scan, a person proves the impact of each issue. You get a ranked list of fixes. A pen test can cover web apps, APIs, networks, cloud, mobile apps, Wi-Fi or OT systems.
A vulnerability scan is automated: it lists known weak points across many systems, and it suits frequent checks. A pen test is led by a person, who tries to use the weak points, links them together and proves the real impact. A pen test also finds logic and access-control flaws that scanners miss. Many organisations run both, and we offer both.
Yes. Vectra is a CREST-accredited penetration testing provider with six CREST accreditations. They cover penetration testing, vulnerability assessment, app security testing, mobile app security testing, threat-led pen testing and STAR-FS intelligence-led pen testing. Every test is led by a CREST-registered Practitioner or Senior Consultant. You can check our accreditations on the CREST Marketplace.
It depends on your risk, your regulatory duties and how fast your technology changes. Many organisations test at least once a year and after significant changes. Higher-risk systems may need testing more often, and PCI DSS sets its own testing rules for in-scope systems. Running the same scope each year also lets you see trends and prove that your program is improving.
Both, depending on the scope. When we test production, we use throttled request rates, pre-approved limits on destructive actions and a live bridge to your team. When we test staging, we first check that its set-up really matches production, so the findings still apply to the live system.
Yes. Requirement 11.4 covers penetration testing, including segmentation testing. Our pen test team handles 11.4 testing as a standalone job or alongside a PCI DSS assessment. Requirement 11.3 covers vulnerability scans, including the quarterly external ASV scans in 11.3.2, which we offer through our vulnerability scanning service. Vectra was Australia's first PCI QSA company.
Yes. All testing is done in Australia, by testers based in Australia. We work nationally and have offices in Adelaide, Sydney, Melbourne, Perth, Canberra and Brisbane. Vectra is part of Ensign InfoSecurity, so our local team can draw on the wider group's research and specialist skills when a job needs them.
Tell us what you want tested and why. Useful details include the targets, such as the number of apps, APIs, IP addresses or sites. Tell us how many user roles there are and what sign-in is needed. Say whether we test production or staging, when you need it done, and any compliance driver. Each test is scoped and quoted to your environment.
Yes. Every finding rated High or above includes a retest window. When your team has fixed an issue, we test it again and record the result, so you have evidence that the fix works. You also get 90 days of portal access to track fixes across your teams.
Yes. A combined scope helps where an attacker could move between layers. Common pairs are an external network test followed by an internal test, or a web application and its API tested together. Any engagement can also move up to a stealth red team scope, which adds social engineering, physical and cloud goals.
Yes. Attackers now use AI to speed up reconnaissance, write convincing phishing lures and find weak points faster. Our testers use AI-assisted techniques in the same way where they suit the scope, so your defences are tested against the speed and scale of a modern attacker. Every finding is still checked by hand.
Often, yes. Vectra is an Advanced Supplier on the NSW ICT Services Scheme (SCM0020). We are on South Australia's eProjects Panel, Cyber Security Services Panel and eProjects Plus, and on Victoria's eServices Register. We also work with Queensland buyers under the QITC Contracting Framework. Our procurement panels page explains each route.
Speak to us about your cyber governance and compliance requirements.
Message sent
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.