Advisory

Penetration Testing Brisbane

CREST-accredited penetration testing for Brisbane businesses and organisations, including local councils and Queensland Government.

Penetration testing services Brisbane

A penetration test shows how an attacker could break into your systems, and what they could reach once inside. Vectra is a CREST-accredited firm for penetration testing, operating since 2001. Every test is led by a CREST-registered Practitioner or Senior Consultant. We test web apps, APIs, networks, cloud, mobile apps, wireless and OT systems for Queensland businesses, organisations, government agencies and councils.

Penetration Testing Brisbane

Types of penetration testing for Brisbane organisations

Each test type has its own page that explains the scope, the approach and what you receive.

Web application

Web application penetration testing

Manual testing against the OWASP Top 10 and ASVS Level 2, including business logic and sign-in flaws.

Web application penetration testing
API

API penetration testing

REST, GraphQL and gRPC interfaces tested for broken authorisation, data exposure and abuse.

API penetration testing
Network

Network penetration testing

Perimeter services, remote access, segmentation and Active Directory privilege escalation paths.

Network penetration testing
Cloud

Cloud penetration testing

Identity configuration, exposed services, container platforms and movement between cloud accounts.

Cloud penetration testing
Mobile

Mobile app penetration testing

Apps assessed against OWASP MASVS, with the backend API included in the same engagement.

Mobile app penetration testing
OT and ICS

OT and ICS penetration testing

Safety-first testing for energy, water and industrial operators, starting with passive methods.

OT and ICS penetration testing

Every pen test is scoped and quoted to your environment.

Tell us what you want tested and what is driving it, and we will agree the scope, the rules of engagement and the escalation contacts with you before sending a scoped quote.

Get a scoped quote

Penetration testing for Queensland Government agencies and suppliers

Queensland Government agencies, councils and government-owned corporations hold large amounts of personal data and run services the public depends on. A penetration test provides independent evidence that the controls protecting those services actually work.

We map findings to the frameworks agencies already use, including the Essential Eight and ISO 27001. Where an agency also applies the Information Security Manual, each finding can be linked to the relevant ISM control.

Read about QITC and our other procurement routes

  • QITC contracting

    QITC is the Queensland Government's standard set of ICT contract terms, with General, Comprehensive, Supplier Terms and Bespoke options.

  • Your own sourcing route

    QITC sets the contract, not the supplier. Each purchase still needs a sourcing route, and we help you confirm it before the request for quote goes out.

  • Due diligence

    We supply the accreditation, insurance and staff credential details that public sector supplier checks usually require.

  • Suppliers to government

    If a Queensland agency has asked your business for a recent penetration test, we scope it around the system that agency will rely on.

QITC is a way to contract, not a supplier panel.

It sets the terms of the agreement. Each Queensland Government purchase still needs its own sourcing route, and we can help you work out which one applies.

Penetration testing for Queensland's key sectors

Queensland's economy spreads across energy, resources, transport, health, tourism and a growing technology sector. Each one exposes different systems to attack, so we shape the test around the systems that matter most in your industry.

We do not run a generic checklist. We scope each test to your systems, your threat model and the rules that apply to you.

Critical infrastructure security

  • Energy, water and critical infrastructure

    Passive-first OT testing of SCADA, HMI and historian layers, with segmentation checked against IEC 62443 and findings that support SOCI Act evidence.

  • Ports, airports and logistics

    Testing of the web, mobile, kiosk and API systems that freight and passenger operations depend on, alongside corporate networks.

  • Health and aged care

    Network, web, mobile and cloud testing planned around clinical workflows, so patient-facing systems are not disrupted.

  • Software and digital businesses

    Growing software firms often need a penetration test to win an enterprise or government customer. We scope the test to that customer's expectations.

  • Finance and insurance

    Testing that gives APRA-regulated entities evidence for CPS 234, which expects information security controls to be tested regularly.

PCI DSS penetration testing for tourism, hospitality and retail

Hotels, resorts, tour operators and online retailers take card payments every day. That puts their booking engines, checkout pages and payment systems in scope for PCI DSS.

Vectra is a PCI DSS Qualified Security Assessor company. Our penetration tests cover the testing that card environments need, and the report is written so your assessor can rely on it.

  • Requirement 11.4 testing

    External and internal penetration testing of the cardholder data environment, as PCI DSS requirement 11.4 expects.

  • Segmentation testing

    We test whether the walls around your card environment really keep the rest of the network out, so your PCI scope stays as small as it should be.

  • Booking engines and checkout pages

    Manual testing of the flows guests and shoppers use, including business logic flaws such as skipping a payment step.

  • Payment APIs and third-party scripts

    We test the interfaces and scripts that touch card data, which are often added by partners and easy to overlook.

  • Quarterly ASV scans

    We can also provide supported ASV scans for the quarterly external scanning requirement.

How we test live systems and what you receive

Most Queensland organisations want their live systems tested, because that is what an attacker would target. The work has to be safe for your customers and your staff.

Testing live systems safely

When we test production systems, we throttle request rates and agree limits on any potentially disruptive action. A live bridge stays open to your team for the whole testing window, so your team can raise any concern while testing runs.You receive a findings debrief, an executive narrative report and a developer walkthrough, plus 90 days of portal access. Every High-severity finding and above gets a retest window once you have fixed it. Our penetration testing overview explains the full methodology.

Penetration testing across Australia

These pages cover local procurement and compliance in other states and territories.

Australia-wide

Penetration testing services

Our full range of test types, our methodology and our CREST accreditations.

Penetration Testing
Australian Capital Territory

Canberra

Testing for Commonwealth agencies and suppliers, mapped to the ISM and the Essential Eight.

Penetration Testing Canberra

Brisbane penetration testing FAQs

Can Queensland Government agencies contract with Vectra under QITC?

Yes. We work with Queensland buyers through the appropriate route and QITC form. QITC is the Queensland Government's standard ICT contract framework rather than a supplier panel, and it offers General, Comprehensive, Supplier Terms and Bespoke options. Each purchase still needs its own sourcing route, and we can help you identify the one that fits.

Can you run PCI DSS penetration testing for Queensland merchants?

Yes. Vectra is a PCI DSS Qualified Security Assessor company, and our penetration tests cover the requirement 11.4 testing that card environments need, including segmentation testing. That suits hotels, booking platforms and online retailers that accept card payments. We can also provide supported ASV scans for the quarterly external scanning requirement.

Can you pen test OT for Queensland energy and water operators?

Yes. Our OT testing covers SCADA, HMI and historian layers, and it starts with passive observation. Nothing active happens on a control network until your engineers approve it in writing and a maintenance window and rollback plan are in place. Findings are mapped to IEC 62443 and support your evidence under the SOCI Act.

Can a pentest help us win a government or enterprise contract?

Often, yes. Large customers and agencies frequently ask a software or service provider for a recent independent penetration test before they sign. We scope the test around the system that customer will rely on, then give you a report your customer can review. A retest after you fix the findings shows the issues were closed.

Can you test our booking or payment platform without disrupting customers?

Yes. When we test live systems, we throttle request rates and agree limits on any potentially disruptive action before we start. A live bridge stays open to your team for the whole testing window, so anyone can raise a concern straight away. If a system cannot take test load at certain times, we agree a window that avoids them.

How often should a Brisbane business commission a penetration test?

Many organisations test at least once a year and again after significant changes, such as a new platform, a major release or a cloud migration. Some obligations set their own timing. PCI DSS asks for regular testing of card environments, and APRA's CPS 234 expects information security controls to be tested regularly. We help you set a sensible cycle during scoping.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.