Web application
Web application penetration testing
Manual testing of citizen and staff portals against the OWASP Top 10 and ASVS Level 2. We test both signed in and signed out.
Advisory
Penetration Testing Canberra
CREST-accredited penetration testing for Canberra businesses and organisations, including Australian Government agencies and the ACT Government.
Penetration testing services Canberra
A penetration test shows how an attacker could break into your systems, and what they could reach once inside. Vectra is a CREST-accredited firm for penetration testing, operating since 2001. Every test is led by a CREST-registered Practitioner or Senior Consultant. We test web apps, APIs, networks, cloud, mobile apps, wireless and OT systems for Canberra businesses and organisations, Australian Government agencies and the ACT Government.
Types of penetration testing for Canberra organisations
Most agencies start with the online services people use and the cloud platforms behind them. Each test type below has its own page with the full scope and what you get.
API
API penetration testing
REST, GraphQL and gRPC APIs checked for broken access control and data exposure. This matters most when agencies share data.
Cloud
Cloud penetration testing
Agency and supplier cloud set-ups tested for weak identity settings, exposed services and ways to move between accounts.
Network
Network penetration testing
We look at internet exposure, remote access, segmentation and Active Directory attack paths, the way an attacker would.
Mobile
Mobile app penetration testing
iOS and Android apps tested against OWASP MASVS, along with the backend services they rely on.
Red team
Red team testing
Red and purple team exercises that chase a set goal. They are backed by our CREST Threat-led Pen Test and STAR-FS accreditations.
Every pen test is scoped and quoted to your environment.
Tell us what you want tested and what is driving it, and we will agree the scope, the rules of engagement and the escalation contacts with you before sending a scoped quote.
Penetration testing mapped to the ISM, PSPF and Essential Eight
Canberra agencies rarely test out of curiosity. A test usually has to show whether set government controls work. The report must then be clear enough for your security team, your assessors and your Accountable Authority to rely on it.
Information Security Manual
The ISM is the control catalogue the Australian Signals Directorate sets for government systems. We link each finding to the ISM control it relates to. Your team can see which control failed, how we got past it and what fix will close the gap.
Protective Security Policy Framework
Under the PSPF, non-corporate Commonwealth entities must apply ISM controls and the Essential Eight. Their Accountable Authority attests to compliance each year. Results from an independent test give that attestation firmer ground than policy documents on their own.
Essential Eight
The Essential Eight is a set of baseline strategies with three maturity levels. A pen test shows whether multi-factor authentication, limits on admin rights, patching and application control really stop an attacker. It tests what is in place, not what is written down.
An IRAP assessment does not certify a system. Your authorising officer still makes the call.
A penetration test gives that officer evidence of how the controls hold up under a real attack.
How a penetration test supports an IRAP assessment
IRAP assessors check a system against the ISM. They gather evidence through interviews, examination and technical testing, then report on how controls are implemented and how effective they are.
A penetration test provides much of that technical evidence. Timed well, it also gives your team the chance to remediate weaknesses before the assessor reaches them.
-
01
Before the assessment
Test the system early to find exploitable weaknesses while there is still time to remediate them and gather better evidence.
-
02
During the assessment
Supply verified technical results that show whether the controls in the assessment boundary work as designed.
-
03
After the assessment
Retest the remediated findings, so control owners can demonstrate the fixes before reassessment or the next risk decision.
-
04
When the system changes
Test new components and significant changes, which can then inform a delta assessment against the current ISM release.
Who tests sensitive government systems
Government systems need testers you can trust with whatever they discover. Our testing is run by Australian citizens with the right clearances for your domain.
We confirm who is assigned, and the credentials they hold, when we scope the work. If your system needs a particular clearance, raise it at the start so the right people are allocated.
-
Evidence handling agreed in advance
Before testing begins, we agree how test data and evidence will be stored and who can access them.
-
A named team
A named team coordinates your engagement from scoping to the final report, with clear accountability throughout.
-
CREST-led testing
A CREST-registered Practitioner or Senior Consultant leads every test, supported by testers who hold credentials such as OSCP, OSEP, CRTP and CRTE.
-
Controlled production testing
On live systems we throttle request rates, agree limits on disruptive actions and maintain a live bridge to your security team.
Buying penetration testing as a Commonwealth or ACT buyer
Canberra buyers have many procurement routes, and the terms of panels and marketplaces change over time. You remain responsible for your own procurement rules and value-for-money test, so it pays to confirm the route before you approach the market.
We can help with that groundwork, and we supply the accreditation, insurance and capability details that government due diligence usually requires.
-
01
Describe the purchase
Give us the agency or entity, the system involved and the approximate scope and value.
-
02
Confirm the route
We check the current panel, marketplace or contract pathway with you, along with the right category and limits.
-
03
Scope the test
We align the statement of work and the evidence we provide with your request for quote and your rules.
-
04
Contract and deliver
Once your approvals are complete, the agreed Australian team begins the engagement.
Penetration testing across Australia
These pages explain the local buying and compliance rules in other states.
Australia-wide
Penetration testing services
Every test type, our CREST-aligned method and our six CREST accreditations.
New South Wales
Sydney
NSW Government buyers can use our listing as an Advanced Supplier on the ICT Services Scheme, SCM0020.
Victoria
Melbourne
Testing for Victorian Government agencies and business, with our eServices Register listing.
Canberra penetration testing FAQs
Do you work with Commonwealth agencies?
Yes. Our customer base includes federal, state and local government as well as Defence. We support agencies through the ISM lifecycle, from security architecture and penetration testing to IRAP assessment and 24/7 monitoring. Each penetration test is scoped to the agency's systems, its threat model and the frameworks it must report against.
Can a pen test support our IRAP assessment?
Yes. IRAP assessors use interviews, document review and technical testing to judge how well controls work, and a penetration test supplies that technical evidence. Testing before the formal assessment also gives you time to remediate weaknesses first. Remember that IRAP does not certify a system. Your authorising officer still decides whether the remaining risk is acceptable.
Do you map pentest findings to the ISM?
Yes. Each finding can be linked to the relevant Information Security Manual control, so your team can see which control failed and why. Reports can also be mapped to the Essential Eight. That makes it easier to update your System Security Plan, your risk register and your PSPF reporting once testing is complete.
Who will test our system?
A CREST-registered Practitioner or Senior Consultant leads every Vectra penetration test. Our testing is run by Australian citizens with the right clearances for your domain. If your system needs a particular clearance or credential, tell us during scoping and we will confirm exactly who is assigned before work begins.
Can you test a cloud service before we offer it to government?
Yes. Cloud and software providers often need independent evidence of their security before agencies will buy. We test the service, its APIs and its cloud configuration, then retest your remediation. If you also need an IRAP assessment, our ASD-endorsed assessors can explain how the penetration test results will fit into that process.
How do Canberra agencies buy penetration testing from Vectra?
Tell us who is buying, the approximate value and the service you need. We then check the current panel, marketplace or contract route with you and confirm the right category before the request for quote is released. Your agency still completes its own value-for-money and approval steps, as its procurement rules require.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.