Before evaluating any penetration testing provider, understand this: automated vulnerability scanners (Nessus, OpenVAS, Qualys) can identify known CVEs from a database. They cannot chain vulnerabilities together, think creatively about how your specific environment is configured, identify business logic flaws in web applications, test whether your staff will respond to a social engineering attempt, or demonstrate what an attacker would actually be able to access if they exploited a weakness.

These are the things that a genuine penetration test – led by a certified, experienced human engineer – uncovers. And they are precisely the findings most likely to reveal catastrophic risk.

Code Hyper One's penetration testing methodology uses automated tools as the first phase of reconnaissance and discovery. Everything that follows is manual, human-led, and adversarial – an OSCP-certified engineer actively attempting to breach your environment the same way a real attacker would, using the tactics, techniques, and procedures (TTPs) documented in current threat intelligence. For deeper reading on how real attacks are structured, see our blog on How Staged Cyber Attacks Work.

1. External Network Penetration Testing

External network penetration testing targets every internet-facing asset your business exposes to the public: web servers, VPNs, remote desktop gateways, mail servers, DNS infrastructure, firewalls, and cloud-hosted services.

From the perspective of an attacker who knows only your company name or IP ranges – with no prior knowledge of your internal environment – our engineers attempt to gain unauthorised access, extract sensitive data, or establish persistence in your network.

What the test covers:

• Open port scanning and service fingerprinting across all external IP ranges
• Firewall and ACL rule assessment – identifying bypass opportunities
• VPN and remote access gateway testing (RDP, Citrix, SSL-VPN) for authentication weaknesses
• Web service enumeration and exploitation of exposed APIs and endpoints
• OSINT (open-source intelligence gathering) using public data to map attack vectors – the same sources an attacker would use before launching a campaign
• DNS zone transfer and subdomain enumeration for forgotten or misconfigured assets
• Testing for publicly disclosed CVEs against your specific software versions
• Credential stuffing and brute-force simulation against login portals

Standards applied: PTES (Penetration Testing Execution Standard) External Intelligence Gathering and Vulnerability Analysis phases; NIST SP 800-115 Technical Guide to Information Security Testing.

External penetration testing is typically the recommended starting point for businesses doing their first formal security assessment, as external exposure represents the most immediate attack surface. Pair this with vulnerability scanning for ongoing between-test coverage.

Internal network penetration testing answers the question that external testing cannot: assuming an attacker has already gained a foothold inside your network – through a compromised endpoint, a phishing email, or a rogue device – how far can they go?

This is the test that reveals lateral movement risks, Active Directory weaknesses, privilege escalation paths, and the real potential blast radius of an internal breach. For most Australian SMBs, the findings from internal pen testing are more alarming than external – because internal networks are typically configured for convenience, not least-privilege access.

What the test covers:

• Network segmentation validation – testing whether network segmentation actually prevents lateral movement between VLANs
• Active Directory enumeration and attack path analysis (Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket)
• Privilege escalation from a standard user account to domain administrator
• Service account misuse – identifying over-privileged service accounts attackable without admin credentials
• File share permission auditing – mapping what a standard user can access that they should not
• Local administrator account assessment – testing whether staff have local admin rights that enable credential extraction
• Workstation-to-workstation lateral movement simulation
• Domain controller attack simulation – demonstrating what full domain compromise looks like

Standards applied: PTES Exploitation and Post-Exploitation phases; OWASP Testing Guide for internal authentication controls; MITRE ATT&CK framework for lateral movement technique coverage.

After an internal pen test, the findings connect directly to our EDR (Endpoint Detection and Response) service – because the attack paths our testers use are the same paths EDR telemetry is designed to detect.

Web application penetration testing is the most technically specialised form of pen testing – and the most frequently underestimated. If your business runs a customer portal, SaaS platform, internal web application, payment gateway, or any API that external systems connect to, it represents a direct, accessible attack surface that requires dedicated testing by engineers with web application security expertise.

Automated web scanners miss business logic vulnerabilities entirely. They cannot understand that your application's order workflow allows a user to modify another user's cart, or that your API authentication token is predictable, or that your file upload function can be abused to execute code on your server. These vulnerabilities require a human tester who understands how the application is supposed to work and actively tests every way it can be made to behave differently.

What the test covers:

• Full OWASP Top 10 testing (injection flaws, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialisation, known vulnerable components, insufficient logging)
• Business logic testing – testing workflows for abuse cases that only a human tester would identify
• API security testing (REST, SOAP, GraphQL) – authentication, authorisation, rate limiting, input validation, and data exposure
• Authentication and session management – session fixation, cookie security, token predictability, multi-factor authentication bypass
• Authorisation testing – horizontal and vertical privilege escalation between user accounts
• Input validation – SQL injection, NoSQL injection, command injection, template injection, XML/XXE
• File upload and path traversal vulnerabilities
• Client-side security – cross-site scripting (XSS), clickjacking, CORS misconfiguration

Standards applied: OWASP Web Security Testing Guide (WSTG) v4.2; OWASP API Security Top 10; PTES Web Application Testing phase.

For a detailed breakdown of our web application testing methodology, read our guide: Web Application Penetration Testing Methodology.

If your business has Wi-Fi, it has an attack surface that extends physically beyond your office walls. Wireless penetration testing validates whether your Wi-Fi infrastructure can be used by an attacker to gain access to your internal network – from the car park, the floor above you, or a shared tenancy building.

What the test covers:

• Wireless network discovery and enumeration – identifying all access points, SSIDs, hidden networks, and rogue access points
• Encryption protocol testing – identifying networks still using WEP or vulnerable WPA/WPA2 configurations
• WPA2/WPA3 handshake capture and offline crack resistance testing
• Guest network isolation validation – verifying that guest Wi-Fi cannot be used to reach internal network segments
• Evil twin attack simulation – testing whether staff can be lured to connect to a rogue access point impersonating your corporate network
• Rogue access point detection – identifying unauthorised devices broadcasting from within your premises
• Captive portal bypass testing for guest networks
• 802.1X (EAP) implementation validation for enterprise wireless deployments

Wireless testing is particularly important for businesses in multi-tenancy office buildings, shared workspaces, retail and hospitality environments, and any site with a separate guest network that connects to the same physical infrastructure as the corporate network.

Cloud environments are configured by humans and are therefore misconfigured by humans. Cloud penetration testing examines your Azure, AWS, or Microsoft 365 environment for the misconfigurations, over-permissioned identities, and exposed storage that represent the most common source of data breaches in Australian businesses today.

What the test covers:

• Cloud Identity and Access Management (IAM) review – identifying over-privileged roles, unused admin accounts, and service principal misuse
• Storage bucket and blob storage exposure – identifying Azure Storage, S3-equivalent, or SharePoint configurations that allow public access to sensitive data
• Virtual machine and compute instance hardening – exposed management ports, default credentials, missing patches
• Network security group and firewall rule analysis – identifying overly permissive inbound and outbound rules
• Secrets and key management – API keys, connection strings, and credentials exposed in code repositories, environment variables, or cloud metadata services
• Conditional access and authentication bypass testing for Microsoft Entra ID environments
• Microsoft 365 configuration testing – Exchange transport rules, mailbox delegation, Teams external access, SharePoint permissions
• Container and Kubernetes security assessment (where applicable)

Standards applied: CIS Azure Security Benchmark; CIS AWS Foundations Benchmark; Microsoft Security Baseline; OWASP Cloud-Native Application Security Top 10.

For a broader assessment of your cloud security posture, see our cloud security assessment service.

Technical security controls fail when humans bypass them. Social engineering testing measures how vulnerable your organisation is to the psychological manipulation techniques that attackers use to extract credentials, install malware, or gain unauthorised physical access – without ever needing to exploit a technical vulnerability.

Australian businesses are disproportionately targeted by social engineering because attackers know that human behaviour is less consistently controlled than technical systems. Our social engineering testing covers:

Phishing Simulation Targeted email campaigns designed to measure how many staff click malicious links, enter credentials into fake login pages, or open weaponised attachments. Campaigns are customised to your industry, your internal communication patterns, and current threat actor lures – not generic template tests that staff have been pre-warned about. Outcomes feed directly into our security awareness training program.

Spear Phishing Highly targeted phishing attacks directed at specific high-value individuals (executives, finance staff, IT administrators) using personalised pretexts researched from open sources. For the difference between phishing and spear phishing in the Australian threat context, read our guide: Spear Phishing vs Phishing.

Vishing (Voice Phishing) Simulated phone calls to staff impersonating IT support, bank representatives, government agencies, or vendors – testing whether staff disclose credentials, transfer funds, or grant access to systems under social pressure.

Smishing (SMS Phishing) SMS-based social engineering campaigns testing staff responses to text messages containing malicious links or requests for sensitive information – increasingly relevant as attackers shift from email to mobile channels.

Physical Social Engineering Testing the physical security controls that protect your premises and equipment: tailgating (following authorised staff through secure access points), impersonation of service personnel, and testing whether staff challenge unfamiliar individuals in secure areas. Physical testing is conducted with explicit written authorisation and clear scope boundaries.

A Red Team assessment is a full-scope, adversary simulation engagement that tests your organisation's entire detection and response capability – not just the security controls on individual systems. Where standard penetration tests are transparent (your IT team knows a test is happening), a Red Team operates covertly, using the stealthy techniques of an advanced attacker to test whether your SOC, MDR, or internal security team would actually detect and contain a real attack.

What Red Team testing involves:

• Full-scope adversary simulation using MITRE ATT&CK TTPs relevant to your industry's actual threat actors
• Multi-vector attack campaigns combining technical exploitation, social engineering, and physical access attempts
• Persistence establishment – testing whether attackers can maintain access to your environment over weeks without detection
• Covert lateral movement and data exfiltration – simulating what an APT group would extract and how
• Detection and response evaluation – measuring your team's mean time to detect (MTTD) and mean time to respond (MTTR)
• Purple Team option available – a collaborative Red/Blue Team exercise where findings are shared in real time to accelerate defensive capability building

Red Team assessments are recommended for organisations that have completed multiple standard pen tests, have an in-house security team or SOC, and need to test their detection and response capability under realistic conditions – not just their preventive controls. For businesses newer to security testing, we recommend starting with external and internal network penetration testing first.

Every Code Hyper One penetration test engagement delivers:

• Dual-format report (executive summary + full technical report) within 5 business days of testing completion
• Risk-rated finding list – every vulnerability rated Critical, High, Medium, or Low with business impact assessment
• Proof-of-concept evidence – screenshots, logs, and reproduction steps for every confirmed finding
• Prioritised remediation roadmap – fixes sequenced by risk severity and remediation complexity
• Compliance mapping – findings mapped to relevant framework controls (Essential Eight, ISO 27001, PCI-DSS)
• Certificate of completion – a formal document confirming the engagement scope and standards applied
• Debrief session – a live walkthrough with your team to ensure findings are understood and actionable
• Optional retest – targeted retesting of remediated findings to confirm closure

Finding vulnerabilities is half the work. Closing them is the other half – and for many Sydney businesses without a full in-house security team, the report is the point at which progress stalls.

Code Hyper One provides post-test remediation support as an optional service extension, working with your team (or on their behalf) to implement the fixes identified during testing. This includes:

• Network reconfiguration for segmentation and firewall rule issues
• Active Directory hardening for identity and privilege escalation findings
• Patch deployment via Datto RMM for software vulnerability findings
• Microsoft 365 and Entra ID configuration remediation for cloud findings
• Email security hardening for phishing-related findings through our email security service
• Security awareness training deployment for social engineering findings via our security training program

This closed-loop model – test, remediate, retest – is how Code Hyper One's penetration testing service produces lasting security improvement rather than a report that gathers dust.

Penetration testing directly satisfies requirements across every major Australian cybersecurity framework and compliance obligation:

ASD Essential Eight At Maturity Level 2 and above, the Essential Eight requires annual penetration testing of internet-facing systems and, at ML3, internal network testing as well. Our pen test reports are formatted to map directly to Essential Eight controls, supporting your maturity assessment and documentation requirements. See our Essential Eight Checklist 2026 for the full maturity framework.

ISO 27001 ISO 27001 Annex A control A.12.6 (management of technical vulnerabilities) and A.14.2 (security in development and support processes) require systematic vulnerability assessment and penetration testing. Our reports provide the documented evidence required during ISO 27001 certification and surveillance audits. For SMBs starting their ISO 27001 journey, see our ISO 27001 for Small Business guide.

PCI-DSS Requirement 11.3 of PCI-DSS mandates penetration testing of cardholder data environments at least annually. Our web application and network testing methodology covers all required PCI-DSS penetration testing scope elements, and our reports are formatted for PCI-DSS audit submission.

Cyber Insurance Australian cyber insurers are now requiring documented evidence of annual penetration testing as a condition of policy renewal – particularly for policies above $1M in coverage. Our certificate of completion and report format satisfy insurer documentation requirements. For the full picture of what cyber insurers require in 2026, read our cyber insurance requirements guide.

NSW Government Contractors NSW Government agencies and their vendors dealing with sensitive data are increasingly required to demonstrate Essential Eight compliance and penetration testing history. Our reports are formatted to satisfy NSW Government vendor security assessment requirements.

Penetration testing is appropriate for any Sydney business that:

• Stores sensitive customer data, financial records, medical information, or personal information governed by the Privacy Act
• Processes payments online or handles cardholder data (PCI-DSS applies)
• Operates internet-facing applications, APIs, or customer portals
• Is renewing a cyber insurance policy above $500K coverage
• Is working toward Essential Eight ML2+ compliance
• Has undergone a recent cloud migration or major infrastructure change
• Has experienced a security incident and needs to understand how the attacker entered
• Is a government supplier or contractor with security assessment requirements
• Has not had a penetration test in the last 12 months and wants to know their actual risk exposure

If your business does not meet any of the above criteria but operates IT systems connected to the internet – a penetration test is still good practice. For guidance on whether you need a full pen test or a vulnerability scan first, read our comparison guide: Penetration Testing vs Vulnerability Scanning: What's the Difference.

The cost and duration of a pen test engagement depends on several factors. Understanding these helps you budget accurately and compare proposals from different providers:

Scope factors for network penetration testing:

• Number of external IP addresses and domains in scope
• Number of internal network segments and subnets
• Number of internal hosts (workstations, servers, network devices)
• Active Directory complexity (domain count, user count, group policy objects)
• Whether wireless testing is included

Scope factors for web application testing:

• Number of distinct web applications and APIs in scope
• Application complexity (number of functions, user roles, data types handled)
• Whether authenticated testing (as a logged-in user) and unauthenticated testing are both required
• Number of API endpoints

Typical engagement duration:

• External network pen test (small scope, up to 10 IPs): 1–2 days of testing
• External + internal network test (SMB environment): 3–5 days
• Web application pen test (single application, moderate complexity): 2–4 days
• Full-scope engagement (external, internal, wireless, cloud, web app): 1–2 weeks
• Red Team assessment: 2–4 weeks minimum

What to be wary of in competitor proposals: A pen test proposal that quotes a fixed price for any environment without a scoping call first is almost certainly describing an automated scan – not a manual penetration test. Every legitimate manual pen test requires a scoping conversation before a price can be provided, because scope is the primary driver of cost and duration.

Book a scoping call with Code Hyper One to receive an honest, detailed proposal specific to your environment – with a clear breakdown of scope, methodology, timeline, and deliverables.

For businesses that require ongoing assurance – not just a point-in-time test – Code Hyper One offers structured annual and continuous penetration testing programs.

Annual penetration testing program: A structured 12-month engagement that includes a full-scope pen test at the start of the engagement year, a formal debrief and remediation review at the 6-month mark, and a follow-up targeted retest before renewal. Annual programs are priced at a reduced rate compared to separate engagements and come with a dedicated point of contact for security questions throughout the year.

Continuous penetration testing: For businesses with frequent software releases, continuous deployments, or rapidly evolving infrastructure, continuous penetration testing integrates testing into the development and release cycle – conducting targeted assessments every sprint, quarter, or release window. This is particularly relevant for SaaS businesses, fintech platforms, and healthcare applications where each deployment potentially introduces new vulnerabilities.