Penetration testing for compliance.

No single test makes an organisation compliant. A penetration test produces the independent technical-testing evidence these frameworks expect, mapped to the controls your assessor will check: SOC 2 CC7.1, ISO 27001 A.8.8, A.8.29 and A.5.23, PCI DSS v4.0 Requirement 11.4 and the ASD Essential Eight. Compliance also depends on your policies, processes and remediation; the test evidences the technical control, it doesn't replace the rest of the programme.

For most SOC 2 and ISO 27001 programmes, assessors expect independent testing at least annually and after any significant change: a new product, a major architecture change or a cloud migration. PCI DSS v4.0 Requirement 11.4 is explicit about testing at least every twelve months and after significant change. We time the engagement so a current report is on file before your audit or surveillance window.

Yes. PCI DSS v4.0 Requirement 11.4 mandates external and internal penetration testing, performed against a defined methodology, at least annually and after significant changes, with exploited findings corrected and re-tested (Requirement 11.4.4). Where segmentation is used to reduce scope, 11.4.5 requires testing that the segmentation controls hold. Our reports reference these sub-requirements directly.

The ASD Essential Eight is a set of eight mitigation strategies with a maturity model; it isn't itself a testing mandate. A penetration test validates that those mitigations actually hold under attack, for example whether patching gaps, application-control bypasses or excessive administrative privileges are exploitable in practice. That evidence supports Essential Eight maturity self-assessments and the technical-testing expectations of broader ASD and IRAP-aligned assessments.

Yes. Every engagement includes a letter of attestation confirming that an independent penetration test was performed, by whom, over what scope and time period, and the remediation status at retest. It is written for auditors and enterprise procurement teams, and paired with the executive summary it answers most security questionnaires in a single attachment. The full technical report remains available under your sensitivity controls.

Yes. A retest is included in every engagement, not an add-on. Once you remediate, we re-test each finding and update the report and letter of attestation to show verified closure, so your assessor and your customers see remediation status, not just discovery. We schedule the retest against your audit date so the evidence on file is current.

Most engagements run five to ten business days of active testing, plus one to two days of reporting and QA, then a retest of typically one further day after you remediate. Because compliance work is deadline-driven, the scoping call establishes your audit date first and we work backwards from it so the report and retest land before your assessment window.

Every engagement is scoped per engagement. A free scoping call establishes the assets, environments, compliance driver and audit deadline in play, and we return a fixed-scope, fixed-price proposal sized to your environment. We don't publish anchor prices: scope drives price, and you approve it in writing before any testing starts.

Assessors look for independence (a party separate from the team that built the system), a written scope statement, a recognised methodology, per-finding evidence with severity ratings, and proof of remediation via retest. They also expect the report to reference the specific controls in play. Our two-document report, letter of attestation and control mapping are built to that standard.

We test staging or pre-production by default. Where production testing is required for scope accuracy, it runs in coordinated windows with agreed rules of engagement, out-of-hours options and an immediate-stop channel. Denial-of-service testing is excluded unless explicitly scoped.

Yes. All testing is performed by a CREST-certified team. CREST is the internationally recognised accreditation body that enterprise procurement teams and auditors reference. Reports are written to the audit-ready standard assessors expect, by a party independent of the team that built the system.

Not usually. Enterprise buyers increasingly ask for a recent independent penetration test report as evidence, and a single current report plus a letter of attestation answers that question directly, along with many others in the questionnaire. The scoping call sizes the engagement to the assets the buyer actually cares about, so you aren't paying to test more than the question requires.