Web application penetration testing
Portals, customer apps and internal systems, tested against the OWASP Top 10 and ASVS Level 2, including business logic and sign-in abuse.
Advisory
Penetration Testing Adelaide
CREST-accredited penetration testing for Adelaide businesses and organisations, including local councils and South Australian Government.
Penetration testing services Adelaide
A penetration test shows how an attacker could break into your systems, and what they could reach once inside. Vectra is a CREST-accredited firm for penetration testing, operating since 2001. Every test is led by a CREST-registered Practitioner or Senior Consultant. We test web apps, APIs, networks, cloud, mobile apps, wireless and OT systems for South Australian businesses, organisations, government agencies and councils.
Types of penetration testing for Adelaide organisations
Each test answers a different question about your risk. Choose the one that fits, or combine several in a single scope where an attacker could move between layers.
API penetration testing
REST, GraphQL and gRPC APIs, tested with and without valid sign-in, to show what a caller can reach that it should not.
Network penetration testing
External tests show what the internet can reach, and internal tests show how far an attacker could move once inside.
Cloud penetration testing
AWS, Azure and Google Cloud environments, tested for weak settings, risky identity paths and exposed services.
Mobile app penetration testing
iOS and Android apps tested against OWASP MASVS, with the backend API included in the scope.
Wireless penetration testing
Guest and corporate Wi-Fi, checked to see whether someone in radio range could get into your network.
OT and ICS penetration testing
SCADA, HMI and historian layers, tested passive-first under strict safety limits.
Phishing testing
A controlled campaign shows how staff respond to a real-looking lure, and whether their reports reach the right team.
Every pen test is scoped and quoted to your environment.
Tell us what you want tested and what is driving it, and we will agree the scope, the rules of engagement and the escalation contacts with you before sending a scoped quote.
Penetration testing for South Australian Government and suppliers
South Australian agencies can buy cyber work from Vectra through three SA Government panels. A panel saves you from checking a new supplier from scratch each time, although you still need to show value for money and follow your own buying rules.
SA agencies, and the businesses that supply them, are often asked to prove that their security controls work. A penetration test gives independent evidence of that, so tell us at scoping which framework, policy or contract clause you need to meet. We will confirm how the report can support it.
-
Cyber Security Services Panel
The dedicated route for cyber work. It covers assessment, audit, policy, strategy, security design and investigations.
-
eProjects Panel
For project-based ICT work, such as systems work, integration and project services.
-
eProjects Plus
For larger ICT projects on pre-agreed panel terms, including professional services and integration.
-
Before you buy
Panel terms can change, so confirm our status, scope and categories at the time you buy, and we will help you check the route.
Penetration testing for South Australia's key sectors
Each sector in South Australia carries its own risks and regulatory obligations. We shape the pen test to fit the sector, not the other way round.
Government
State agencies and local councils
We work with federal, state and local government. Each finding can be linked to the relevant ISM control, so agency teams can track fixes against the controls they report on.
Defence
Defence and defence suppliers
Defence is part of our customer base, and defence suppliers are frequently asked for evidence against the ISM and the Essential Eight. Our reports are pre-mapped to the Essential Eight to support that evidence.
Health
Health services and their suppliers
Clinical systems need care, so we plan testing around clinical workflow. Medical devices on the network are found passively, rather than probed the way a generic pentest would probe them.
Energy and water
Critical infrastructure and OT
Operators have legal duties under the SOCI Act, and our OT testing is passive-first across SCADA, HMI and historian layers. Active scanning needs written engineering approval and a tested maintenance window.
Finance
Banks, insurers and super funds
APRA CPS 234 asks you to test your controls on a regular plan and act on what the tests find. Our reports are pre-mapped to CPS 234, so the evidence is ready for your Board.
Payments
Card payments and e-commerce
Vectra is a PCI QSA company. Our pen tests cover PCI DSS requirement 11.4, including segmentation testing, and we also provide ASV scans for the quarterly external scans.
How an Adelaide pen test works
Every engagement follows the same CREST-aligned method, scaled to your scope. Our penetration testing services page sets out all six steps. In summary, this is what to expect from an engagement.
A scope built around your reason for testing
A named engineer agrees the scope, the rules of engagement and the escalation contacts with you. If the test is for a panel contract, an audit or a board report, say so at the start. We then shape the work so the report answers that need.
Findings proven by hand
Scanners help with triage, but every High-severity issue is exploited by hand to confirm its impact, and raw scanner output never goes into the report. When a live system is in scope, we throttle request rates and agree limits on risky actions first.
Pen test findings your SOC team can use
During post-exploitation, testers note each point where your security team had a chance to detect the attack. Those notes come with the report, so your team can tune its alerts as well as fix the flaws.
What you receive
You get a findings debrief, an executive report and a developer walkthrough. Every High-severity finding and above includes a retest window, so the fix is confirmed rather than assumed. You also get 90 days of portal access to track fixes.
Who leads the test
A CREST-registered Practitioner or Senior Consultant leads every test. Across the team, testers hold OSCP, OSEP, CEH, eCPPT, CRTP, CRTE, CRT and GICSP credentials. Not every tester holds every one, so if your work needs a named credential, we confirm who is assigned when we scope it.
What CREST accreditation means for you
CREST is a company accreditation, not a personal one. It checks how a firm is run, and how it delivers and quality-checks its work. We hold six CREST accreditations across security testing and red teaming. You can verify them on the CREST Marketplace.
Penetration testing across Australia
One engagement can cover systems in several states. Each city page sets out the local buying routes and sectors.
Sydney
For NSW agencies buying through the ICT Services Scheme, SCM0020, and for banks and payment firms.
Melbourne
For Victorian buyers using the eServices Register, and for super funds, insurers and health services.
Perth
For Western Australian businesses and agencies, from web apps to industrial systems.
Canberra
For federal agencies and their suppliers, with each finding linked to the relevant ISM control.
Brisbane
For Queensland organisations, including Government buyers contracting under QITC.
Australia-wide
Every test type, our six-step method and what you receive, on one page.
Adelaide penetration testing FAQs
Is Vectra on South Australian Government panels?
Yes, we are on three SA Government panels: the eProjects Panel, the Cyber Security Services Panel and eProjects Plus. The Cyber Security Services Panel is the dedicated route for cyber work such as assessment and audit. Panel terms can change, so confirm our status and categories at the time you buy. Our procurement page has the current details.
Can a pen test report support SA Government security requirements?
It can, because our reports are pre-mapped to the Essential Eight, ISO 27001, IRAP, PCI DSS, APRA CPS 234 and the SOCI Act. Each finding can also be linked to the relevant ISM control. If your agency or your contract names another framework or policy, tell us at scoping and we will confirm how the report can support it.
Do you pen test for South Australian councils?
Yes, we work with federal, state and local government, and we support councils across Australia. Penetration testing is part of our council program, alongside vulnerability scanning and security monitoring. We scope each test around the council's own systems, the services it runs online and the personal data it holds, so the findings match the risks it carries.
Can you pen test OT systems for SA utilities?
Yes, our OT and ICS testing is passive-first across SCADA, HMI and historian layers. Active scanning only goes ahead with written engineering approval and a tested maintenance window. Operators of critical infrastructure assets also carry duties under the SOCI Act, and our reports are pre-mapped to it, so the findings support that evidence.
Do you run application and phishing tests together?
Yes. Application penetration testing covers web apps, single-page apps, APIs and thick-client software, tested against the OWASP Top 10 and ASVS Level 2. Phishing testing runs a controlled campaign built for your organisation. It measures how staff respond and whether their reports reach the right team. The two can sit in one scope.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.