Research, field notes, and technical deep-dives from the Aussie Pentest team.
Health is Australia's most breached sector. What the Privacy Act, My Health Record 2026 rules and RACGP standards expect from clinics, the controls that matter and what to test.
Cyber security for Australian law firms: how trust account fraud happens, VLSB+C minimum controls, new AML/CTF privacy obligations, costs and what to test first.
SMB1001 explained for Australian SMBs: the five tiers from Bronze to Diamond, what Gold requires, how it compares to the Essential Eight, costs, and how to evidence your controls.
How Australian businesses can protect against ransomware: the Essential Eight controls that matter, the 72-hour payment reporting rule, and how to test your defences.
What a cyber security audit covers in Australia, the five main types, what each costs, and how to pick the one your insurer, client or board will accept.
How Australian businesses should answer vendor security questionnaires: what clients ask, why they ask, and the evidence that actually satisfies a reviewer.
What DISP requires for cyber security: full Essential Eight Maturity Level Two, the Cyber Security Questionnaire, Annual Security Reports, audits and where pentesting fits.
What the SOCI Act requires for cyber security: 12 and 72 hour incident reporting, the CIRMP, Essential Eight ML1 or ISO 27001, pentesting and supplier duties.
ASD replaced the Essential Eight with ASD Essentials on 15 October 2026. What changed, why maturity levels don't carry over, and what Australian businesses should do now.
Does SOC 2 require a penetration test? What CC4.1 and CC7.1 expect, Type 1 vs Type 2 timing, what auditors look for, scope for SaaS and Australian costs.
Which Australian businesses need a PCI DSS pentest? Requirement 11.4 explained: SAQ A-EP vs SAQ D, ASV scans vs pentests, segmentation testing, scoping and costs.
Does ISO 27001 require penetration testing? What Annex A 8.8 and 8.29 expect, what Australian auditors look for, how often to test, and what it costs.
What Active Directory and Entra ID penetration testing covers for Australian SMBs, how it differs from a network scan, costs and when you need it.
What social engineering testing and phishing simulations cover for Australian SMBs, how they differ from awareness training, what they cost and when you need them.
What network penetration testing covers for Australian businesses, what it costs, how external and internal tests differ, and when you actually need one.
What a web app pentest tests, how it differs from a scan, what Australian businesses pay, how to scope it and how it supports Privacy Act and E8 evidence.
What a vCISO costs in Australia: retainer pricing from $2,500/month, what each tier includes, what's extra, and how it compares with hiring a full-time CISO.
What the Privacy Act and APP 11 'reasonable steps' require for cyber security, who's covered, where pentesting fits, NDB duties, penalties and what testing costs.
What CPS 234 says about control testing, where penetration testing fits, what APRA's audits found, what suppliers get asked for, and what a test costs in Australia.
What a cloud pentest covers in AWS, Azure and Microsoft 365, what providers allow, how APP 11, Essential Eight and CPS 234 apply, and what it costs in Australia.
API pentesting finds auth and object-level flaws scanners miss. Learn what Australian SMBs should scope, how OWASP API Top 10 applies, and what it costs.
Black, grey and white box pentests differ by how much testers know upfront. Learn which approach Australian SMBs should choose for depth, budget and compliance.
External pentests show whether strangers on the internet can get in; internal pentests show how far an attacker gets once inside. Here's which Australian SMBs need first, and why.
Preparing for a penetration test means locking scope, access, and rules of engagement before testers start — not hoping a scan PDF will satisfy your board, insurer, or buyer. Use this Australian SMB checklist to get ready without wasting the engagement.
Most Australian SMBs need a human-led penetration test at least annually and after significant change, with frequent scanning in between. Here's how to set a cadence that fits your risk and budget.
Essential Eight Maturity Level 1 is a solid cyber baseline for most Australian SMBs; Maturity Level 2 is the practical bar for DISP and many tenders. Here's how to choose without over-scoping.
ASD is evolving Essential Eight into an Essentials series. Keep implementing E8 now, baseline maturity with evidence, and treat the transition as a parallel run — not a pause.
A credible pentest report for Australian SMBs covers executive summary, severity-ranked findings, PoC evidence, remediation guidance, and retest notes — use it for insurers, tenders, and board packs.
Essential Eight isn’t a blanket law for every Australian SMB — see who PSPF binds, what DISP ML2 requires, and when tenders or insurers make E8 practical.
For Australian SMBs, a vulnerability assessment finds and triages weaknesses; a penetration test exercises real-world attack scenarios to prove impact. Choose without mistaking a scan for a pentest.
Australian MSPs can offer human-led penetration testing under their own brand via prepaid white-label blocks — without hiring a pentest team or losing the client relationship.
What does an Essential Eight assessment cost in Australia? Published fixed fee $4,950+GST for <=50 seats - what's included, what isn't, and how it compares to uplift and pentest spend.
For most Australian SMBs under insurance, tender, or DISP pressure, Essential Eight technical maturity comes first; ISO 27001 is the governance wrapper when enterprise buyers need an ISMS certificate.
Penetration testing has a reputation for costing $20,000 and taking months to book, but that's no longer the whole picture.
With easier access to AI tools and a flood of "vibe coded" apps hitting the market, vulnerable applications are becoming more and more common.
Australian SMB web apps most often stumble on broken access control, injection, misconfiguration, and weak authentication — the same OWASP Top 10 classes, explained with practical fixes.
Australian cyber insurers typically want enforced MFA, tested backups, patching evidence, and often third-party assessment artefacts—not a vague “secure” promise. Match the ask to the right evidence.
Essential Eight is Australia’s technical cyber baseline — not a vendor badge. What’s mandatory, what an assessment costs, and when SMBs need evidence for insurance, tenders, or DISP.
Penetration testing isn't just for large enterprises anymore. This post is on whether small businesses actually need it, and what happens if you skip it.
A vulnerability scan is not a penetration test — and an $80 assessment is not a $5,000 engagement. Here’s how Australian SMBs choose the right depth without overpaying or under-proving.
What Melbourne-based small and medium businesses should know before booking a penetration test, from local considerations to what a Melbourne provider should offer.
Why does one pentest cost $5,000 and another $20,000? A breakdown of what actually drives penetration testing pricing for Australian SMBs, and how you can pick the right tier.
A practical guide to evaluating penetration testing providers in Australia: what you should be looking for, real pricing benchmarks, and questions to ask providers before you sign.