Know exactly what you're paying before you sign anything.
Every service we offer, priced up front. Scope is defined in writing before we start: no scope creep, no surprise invoices.
All prices in AUD + GST. International clients are GST-free.
Automated Security Assessment
Same toolchain the pentest team uses, analyst-reviewed, delivered fast. Good starting point if you're not ready for a full engagement.
Basic
1 target · 24hr SLA
$80 AUD
- Single domain web assessment
- Checks for open vulnerabilities attackers could exploit
Standard
1 domain · 24hr SLA
$200 AUD
- Tests the 10 most common ways websites get hacked
- Checks for login flaws, data exposure, and input vulnerabilities
Professional
5 targets · 48hr SLA
$500 AUD
- Up to 5 targets including web apps and APIs
- Deep assessment across login flows, data handling, and access controls
Premium
10+ targets · 72hr SLA
$2000 AUD
- 10+ targets including APIs and internal-facing systems
- Tests whether multiple vulnerabilities can be combined to cause a serious breach
Penetration Testing
Three fixed-fee engagement sizes. All tiers include a written scope document, severity-ranked report, and proof-of-concept evidence on every critical finding.
Starting at
$5K AUD
Basic
+ GST · International clients GST-free
- External network penetration test
- Up to 25 IP addresses
- Optimal for small web apps
- Detailed report & risk rating
- Remediation recommendations
- Delivered in 5–10 business days
Starting at
$12K AUD
Standard
+ GST · International clients GST-free
- External & internal network penetration test
- Up to 50 IPs and 2–3 web applications
- Comprehensive report & executive summary
- Remediation guidance
- Debrief session included
- Delivered in 5–10 business days
Starting at
$20K AUD
Advanced
+ GST · International clients GST-free
- Full-scale penetration test
- External & internal network
- Web applications & APIs
- Social engineering assessments
- Delivered in 5–10 business days
Essential Eight Assessment
One clear offer. No surprise scope.
$4,950
+ GST
Fixed-fee for environments up to 50 seats. Larger environments quoted on scope.
Includes
- ML1 or ML2 target maturity, your choice
- Full technical testing across all 8 controls
- Maturity score + evidence documentation
- Prioritised remediation roadmap
- Board-ready executive summary
- 60-minute live debrief included
- Report delivered within 10 business days
vCISO Retainer
Ongoing advisory, risk tracking, and reporting. Pricing scales with call frequency and technical check depth.
Essentials
Best for: small businesses buying their first vCISO service
$2,500/month
- 1 x 45-min advisory call/month
- Monthly risk register update
- Simple written summary
- Advisory only: no technical checks
Growth
Best for: mid-market businesses with active compliance obligations
$4,250/month
- 1 x 60-min advisory call/month + email support
- Monthly risk register, reviewed live on call
- 1 light technical check/quarter (config or vuln scan)
- Formatted, exec-readable report
Executive
Best for: board-level oversight, insurance or tender pressure
$6,500/month
- 2 x advisory calls/month + on-call for urgent issues
- Monthly risk register, tracked against framework KPIs
- 1 light technical check/quarter + ad-hoc reviews as needed
- Board-ready pack, presented live on call
MSP White-Label
Wholesale penetration testing and compliance capacity for MSPs to resell under their own brand.
Block and per-engagement pricing available
Pricing depends on volume and engagement mix. Talk to us for a partner rate card.
Internal Penetration Test & Remediation Validation
Azure-hosted Windows server infrastructure · Financial services sector · Black-box engagement
Assessment type
Internal Black-Box Pentest + Remediation Validation
Method
Living off the Land: built-in Windows tooling only
Turnaround
Initial report delivered · Validation completed in 4 days
What we found
10 findings identified across two hosts, including factory-default credentials on a live security monitoring platform, an unrestricted legacy remote access protocol transmitting credentials in cleartext, and no account lockout policy enabling unlimited brute-force attempts.
Remediation outcome
Four days after delivery, a structured validation session confirmed the environment moved from a largely unhardened state to a substantially secured posture, with documented evidence for 8 of 10 findings and a clear action plan for the remaining 2.
Resolved
Verified closed
Partially resolved
Pending client-side platform changes
Accepted risk
Documented per client instruction
The engagement demonstrated the value of pairing a penetration test with a structured remediation validation: not just identifying what's wrong, but verifying that fixes work as intended and flagging where partial remediations leave residual risk.
Aussie Pentest · Internal engagement summary · All client details anonymised
Need something specific?
Answer a few quick questions and we'll come back with a tailored quote.
Not sure which service is right?
Book a 15-minute call: we'll work out what fits your environment and give you a fixed-fee quote.
No obligation · No sales pressure