Web application penetration testing
Customer portals, booking sites and staff systems, tested by hand against the OWASP Top 10 and ASVS Level 2.
Advisory
Penetration Testing Melbourne
CREST-accredited penetration testing for Melbourne businesses and organisations, including local councils and Victorian Government.
Penetration testing services Melbourne
A penetration test shows how an attacker could break into your systems, and what they could reach once inside. Vectra is a CREST-accredited firm for penetration testing, operating since 2001. Every test is led by a CREST-registered Practitioner or Senior Consultant. We test web apps, APIs, networks, cloud, mobile apps, wireless and OT systems for Victorian businesses, organisations, government agencies and councils.
Types of penetration testing for Melbourne organisations
Each test answers a different question about your risk. Choose the one that fits, or combine several in a single scope where an attacker could move between layers.
API penetration testing
The APIs behind your apps and partner integrations, checked for broken access control and data exposure.
Network penetration testing
Internet-facing services and internal networks, including Active Directory attack paths and segmentation.
Cloud penetration testing
AWS, Azure and Google Cloud accounts, tested for weak identity settings and paths between environments.
Mobile app penetration testing
iOS and Android apps tested against OWASP MASVS, with the back-end API in the same scope.
Wireless penetration testing
Staff and guest Wi-Fi, tested for weak sign-in and gaps between guest and corporate zones.
OT and ICS penetration testing
SCADA and control systems, tested passive-first within strict safety limits.
Every pen test is scoped and quoted to your environment.
Tell us what you want tested and what is driving it, and we will agree the scope, the rules of engagement and the escalation contacts with you before sending a scoped quote.
Choosing a penetration testing company in Melbourne
Melbourne organisations have plenty of penetration testing companies to choose from. These questions help you compare providers on evidence rather than marketing.
We have answered each question for Vectra, so you can hold us to the same standard you apply to everyone else.
-
Is the firm accredited, and can you verify it?
Vectra is a CREST-accredited firm for penetration testing. CREST assesses how a company operates, delivers and quality-checks its work, and you can verify our six accreditations on the CREST Marketplace.
-
Who actually leads the test?
A CREST-registered Practitioner or Senior Consultant leads every Vectra test. Across the team, testers hold OSCP, OSEP, CEH, eCPPT, CRTP, CRTE, CRT and GICSP, and we confirm who is assigned when we scope the work.
-
Are findings proven, or only scanned?
Scanner output feeds our triage, but every High-severity issue is exploited by hand to confirm its impact. Raw scanner dumps never appear in our reports.
-
Will the report satisfy your auditors?
Reports are pre-mapped to PCI DSS, ISO 27001, APRA CPS 234, the SOCI Act, the Essential Eight and IRAP, with a separate executive narrative for leadership.
-
What happens after the report?
You receive a findings debrief and a developer walkthrough, a retest window for every High-severity finding and above, and 90 days of portal access to track remediation.
-
Can you track progress over time?
If you test every year, we keep the baseline scope. Trend dashboards then show where your security program is improving across tests, assets and teams, and where it is slipping.
Penetration testing for Victorian Government agencies and suppliers
The eServices Register is Victoria's whole-of-government register for ICT services, cloud, software, set-up, upkeep and managed services. Our panel listing names Vectra as an appointed eServices supplier. Agencies buy through the Victorian Digital Marketplace.
Victorian agencies, and the suppliers that hold government information, are expected to protect it and to show that their controls work. A penetration test gives them independent proof. Tell us at scoping which standard or contract clause you report against, and we will confirm how the report can support it.
Before you buy or renew, Victorian rules ask you to check a supplier's eServices subscription and insurance in Supplier Hub.
-
Register
The eServices Register, the main route for Victorian agencies to buy ICT services.
-
How agencies buy
Through the Victorian Digital Marketplace, under the register's terms.
-
Control mapping
Each finding can be linked to the relevant ISM control and exported into your agency's GRC tool.
-
Local government
We work with councils across Australia, and pen testing is part of the security program we run for councils.
Penetration testing for Melbourne's key sectors
Melbourne's economy spans superannuation and insurance, health and research, freight and logistics, gaming and manufacturing. Each sector brings its own regulators and attack patterns, and we scope testing accordingly.
APRA
Superannuation funds and insurers
APRA regulates general, life and private health insurers, and super fund trustees too. CPS 234 expects you to test your controls on a set schedule, and CPS 230 asks you to keep critical operations running through a cyber attack.
Health
Hospitals, health services and research
Clinical systems carry patient safety risk, so testing is planned with your clinical governance lead. Research and clinical-trial data needs the same care as patient records.
Logistics
Ports, freight and logistics
We cover airports, freight forwarders and port operators. Penetration tests span web, mobile, kiosk and API systems, and transport operators often carry SOCI Act and MTOFSA duties.
Gaming
Gaming and wagering
Online platforms combine payments, customer accounts and heavy traffic. Account takeover and logic flaws in betting or payout flows are the risks we look for first.
Manufacturing
Manufacturing and industrial sites
Where plant systems are in scope, our OT testing is passive-first. Active scanning requires written engineering approval, a tested maintenance window and a rollback plan.
Retail
Retail and e-commerce
Checkout, API, mobile and third-party tag testing protects card data where it is most exposed. As a PCI QSA company, we test card environments to PCI DSS requirement 11.4, including segmentation.
Infrastructure and application pen testing for Victorian organisations
Many organisations need assurance at two layers: the systems the business runs on, and the apps that customers and staff use each day. We can test either layer on its own, or both in one scope where an attacker could move between them.
Infrastructure penetration testing
An infrastructure test treats your servers, storage, virtual machines, containers, Active Directory and cloud set-up as one connected estate. Testers look for weak Active Directory tiers and Kerberoasting chains, check Kubernetes and container runtimes, and test your backup and recovery paths. Attackers ignore the lines between your internal teams, so the test does too. Our network penetration testing page covers external and internal network tests in more detail.
Web application penetration testing
Application testing covers customer portals, single-page apps and thick-client software against the OWASP Top 10 and ASVS Level 2. Testers work both signed out and as signed-in users. They look for the business-logic flaws and sign-in abuse that automated tools miss. See web application penetration testing and API penetration testing.
Cloud and mobile penetration testing
Cloud penetration testing checks AWS, Azure and Google Cloud for risky identity paths, weak settings and exposed services. Mobile penetration testing checks iOS and Android apps against OWASP MASVS, using binary analysis and runtime tools such as Frida and Objection.
Planning a pentest program that improves each year
A single test gives you a snapshot. A repeated program shows whether your security is getting better. Our penetration testing services page explains the full six-step methodology, and this is how it plays out over time.
Choosing between production and staging
We can test either one, depending on scope. When we test staging, we first confirm that its configuration really matches production, so the results hold true for the live system. Production work uses throttled request rates and pre-approved limits on destructive actions.
Deliverables from each test
Each engagement ends with a findings debrief, an executive narrative report and a developer walkthrough. Every finding comes with steps to reproduce it, the affected assets and developer-ready remediation advice, and High-severity findings and above include a retest window.
Comparing results year on year
All current and past findings sit in one portal, searchable by asset, severity and framework. When you repeat a test against the same baseline scope, trend dashboards show where your program is improving and where it is regressing, without stitching together old PDF reports.
Penetration testing across Australia
A single engagement can cover systems in Victoria and interstate. Each city page sets out the buying routes and sectors that matter there.
Sydney
For financial services, payment firms and NSW Government buyers on SCM0020.
Adelaide
For South Australian agencies, councils, defence suppliers and energy operators.
Canberra
Testing for federal agencies, mapped to the ISM, PSPF and Essential Eight.
Brisbane
Penetration testing for Brisbane and the rest of Queensland.
Perth
Penetration testing for Western Australian organisations.
Australia-wide
The complete guide to our test types, method and reporting.
Melbourne penetration testing FAQs
Is Vectra on the Victorian eServices Register?
Yes. Our panel listing names Vectra as an appointed eServices supplier, and Victorian agencies buy through the Victorian Digital Marketplace. Before you buy or renew, Victorian rules ask you to check our eServices subscription and insurance in Supplier Hub. Register terms can change, so confirm our status at the time you buy.
Can a penetration test support Victorian Government security obligations?
Yes. A pen test gives independent evidence that your controls work as intended. Our reports are pre-mapped to the Essential Eight, ISO 27001 and IRAP, and each finding can be linked to the relevant ISM control. Tell us at scoping which Victorian standard or contract clause you report against, and we will confirm how the report can support it.
Do you test for super funds and insurers?
Yes. Our clients include insurance companies, and we support banks, insurers, superannuation funds and RSE licensees under APRA's standards. CPS 234 expects regulated entities to test their controls on a regular schedule, and our reports are pre-mapped to it. We also design scenario tests for CPS 230 operational resilience.
Can you pen test hospital and health systems safely?
Yes. We plan the work around clinical workflow, weekend elective lists and imaging bookings, and we will not touch production PACS or LIS systems without sign-off from your clinical governance lead. Medical devices such as infusion pumps are found through passive discovery, so they are not probed the way a generic pentest would probe them.
Do you offer cloud and mobile penetration testing?
Yes. Cloud penetration testing covers AWS, Azure and Google Cloud, focusing on identity paths, misconfiguration and exposed services. Mobile penetration testing covers iOS and Android apps against OWASP MASVS, using binary analysis and runtime tools. The backend API the app talks to is included in the same scope, because that is where much of the risk sits.
Do you test online gaming and wagering platforms?
Yes. Gaming and wagering is one of the sectors our testers work in. These platforms combine payments, customer accounts and heavy traffic, so web, API and mobile tests often run together in one scope. Where card data is involved, we can also test to PCI DSS requirement 11.4, including segmentation.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.