Stop Guessing About Your Security.
Start Proving It.

Yes. We offer flexible payment plans capped at 12 months, structured around what works for your business. You choose the duration and the payment frequency — options range from daily through to monthly. If cashflow is a consideration, just raise it during scoping and we'll work out an arrangement before anything is signed.

With a larger firm, your engagement gets handed to an account manager, filtered through project coordinators, and often executed by analysts you'll never speak to. By the time a finding reaches you, it's been summarised twice and context has been lost.

With us, the person scoping your engagement is the same person running the test and writing the report. If you have a question — technical or commercial — you're speaking directly to them. No trickle-down communication, no middlemen, no translation errors. For a discipline where nuance matters, that direct line makes a meaningful difference.

Running a vulnerability scanner and calling it a security assessment is like plugging an OBD2 reader into your car, getting a fault code, and deciding you're a mechanic. The tool tells you something exists — it doesn't tell you whether it's actually exploitable, how severe the real-world impact is, or how to fix it properly.

What you're paying for with a manual pentest is the knowledge base behind the findings. A human tester chains weaknesses together, tests business logic, and follows paths an automated tool would never take. We don't just surface issues — we validate that they're real, demonstrate how they'd be exploited, and provide specific remediation guidance. Then we retest to confirm the fix actually worked.

Yes. Retesting is included as standard. Once you've worked through the findings and deployed patches, we retest each item to confirm the remediation is effective and no residual risk remains. You receive a dedicated validation report documenting what was resolved, what's partially addressed, and what still requires attention. The engagement doesn't end at report delivery.

It depends on the environment. If the system we're testing is live and publicly accessible, we'll notify you immediately for any finding where the severity warrants it — we're not going to sit on a critical vulnerability until the final report. If the system is isolated with no public access, the finding will be documented in detail in the report alongside remediation guidance and a severity rating. Either way, nothing critical gets buried.

Absolutely. We're used to operating within environments where there's already an internal team or a managed service provider in place. We can coordinate directly with your IT team or MSP throughout the engagement — sharing scope details, aligning on testing windows, and handing off findings to whoever is responsible for remediation. If anything, having someone technical on your side speeds the process up.

The report is the start of the process, not the end of it. Once you've reviewed the findings and worked through remediation with your team, let us know when patches have been deployed. We'll schedule a retest, validate each fix, and issue a formal remediation report documenting what's been resolved and what still requires attention. If anything comes up during that process — questions about a specific finding, uncertainty about a fix — we're reachable. You're not on your own once the PDF lands in your inbox.

Not much. By the time we've completed scoping, we'll have established what we're targeting, agreed on testing windows, and documented any constraints. There are occasional requests depending on the engagement type — test credentials for an authenticated web application assessment, for example — but we'll flag those during scoping, not the morning the test begins. If we've done our job in the scoping phase, the only thing you need to do on day one is nothing.

2–3 business days of testing plus 1 day for reporting. Our average from signed scope to final PDF is 47 hours. We don't hold reports for arbitrary SLAs.

No. If you know your website address, IP range, or app name, that's enough. We'll ask the technical questions on your behalf during scoping.

Not by design. We discuss disruption risk in scope and accommodate production constraints. Most findings can be identified without impacting availability.

Yes. Reports are structured to satisfy cyber insurance renewals, Essential Eight assessments, ISO 27001 evidence, and government procurement questionnaires.

Basic starts at $5,000 AUD (up to 25 IPs, external network). Standard is $12,000 (external + internal, web apps). Advanced is $20,000+ (full scope including social engineering). Fixed price, no hourly surprises.