At a glance
Re-test
Inside the fixed scope
Offensive testing
Penetration testing for Australian organisations.
Manual penetration testing of web applications, APIs, networks and cloud environments, scoped and quoted in writing before work starts.
Fixed scope
External penetration test
Fixed scope, priced before the work starts.
External test, report and re-test.
At a glance
Manual
Every finding reproduced by a tester
At a glance
SMB1001:2026 Gold, opens in a new tab
CyberCert public registry
Overview
A test runs in six stages, from scoping to the re-test, each recorded in the report with what was done and when. The re-test sits inside the fixed scope and confirms closure on the deployed system.
Where testing runs
Black Shard is an Australian software engineering and cybersecurity firm. Testing runs against systems wherever they are operated. It requires a defined scope, provisioned access and an agreed testing window. Penetration testing in Brisbane covers the on-site scoping, internal network testing and debriefs that run in person for organisations in that city.
Scoping and rules of engagement
Every test starts with a written scope and quote, set against the assets in question: applications, APIs, cloud environments, network segments, or a combination. Rules of engagement are agreed in writing before testing begins.
Keeping the window and the price fixed
Scoping a penetration test well keeps the window and the price fixed: named assets, named environments and the access model agreed before testing starts.
Rules of engagement
- The scope boundary and exclusions
- The testing window and any blackout periods
- Techniques excluded by default, such as denial-of-service testing
- Written authorisation naming who can vary or halt scope
- A stop-work procedure with a named contact on both sides
- Access that is least-privilege and time-boxed to the testing window
What we test
Web applications and APIs are tested against OWASP guidance, networks against ASD guidance. Multi-tenant systems have the tenant boundary tested specifically.
Applications, networks and cloud
Web application and API testing covers authentication and session handling, access control, injection, and application logic. External network testing establishes what is reachable from the internet, and internal testing starts from an assumed foothold and establishes how far it extends. Cloud environments are reviewed for identity, network exposure and configuration alongside the application work.
Systems we build and operate
Black Shard builds and operates many systems in regulated industries. Among them are a Queensland law firm's operations and compliance portal, where every state change is written to an append-only audit ledger, clinical software hosted in Australia that keeps each practice's data apart in the database itself, and a funds management firm's staff portal with a sealed compliance audit log structured around its AFSL perimeter. Multi-tenant, audit-logged and regulated systems are tested with those designs as the reference.
Types of penetration testing
Each type is scoped on its own or combined into one engagement with one report. An external test is the usual starting point.
- External network penetration testing: the internet-facing perimeter, from the IP ranges, domains and services you own
- Internal network penetration testing: from an assumed foothold inside the network, over agreed remote access or on-site
- Web application penetration testing: authentication, session handling, access control, injection and business logic, tested against OWASP guidance
- API penetration testing: authorisation on every endpoint, object-level access control, and the data each response returns
- Cloud penetration testing: identity, network exposure and configuration in the cloud environment behind the application
API and AI testing
API penetration testing and web application testing follow where a product, portal or integration holds data that matters, and AI penetration testing covers models, agents and the tools they can call. Between tests, attack surface management watches the external footprint for new hosts and exposed services.
How a penetration test runs
Six stages, each recorded in the report with what was done and when.
- Scoping: a free 30-minute call, then a written scope, quote and rules of engagement naming every target in bounds
- Reconnaissance: the external footprint is mapped from public sources and DNS
- Discovery: each target is enumerated for exposed services, entry points, roles and trust boundaries, with automated tooling used for coverage
- Exploitation: weaknesses tested by hand, chained where they combine, only as far as the rules of engagement allow
- Reporting: each reproduced finding written up, then a debrief with the tester, by video or in Brisbane
- Re-test: once fixes are deployed, each reported finding is tested again and its status recorded
Findings and reporting
Every finding is reproduced by a tester before it is written up; automated output is reported only after a person confirms it. The findings report opens with an executive summary of overall exposure, findings ranked by severity.
- Title and severity, rated for what an attacker could do with the weakness in this environment
- Affected assets: the host, URL, API endpoint or cloud resource, and the environment and build tested
- Description and business impact: what the weakness allows, and what data or function it exposes
- Reproduction steps with evidence: the requests, responses and screenshots captured at the time of testing
- Remediation: the fix, written for the engineers who will apply it, with OWASP or ASD references where they apply
- Re-test status: open, closed or partially closed, recorded once the re-test runs
What each finding contains
Each finding follows one structure, so engineers can work from it, and boards, insurers and customers can read it. It is written with severity, business impact, reproduction steps and the technical detail required to remediate it, for the engineers applying the fix and for the executive signing off on it.
Re-testing
A re-test confirms that each reported finding has been closed on the deployed system. Its scope is limited to the findings raised in the original report. If the environment has changed materially between the test and the re-test, that change is flagged and re-scoping is discussed before the re-test proceeds.
Confidentiality
Findings are the client's information. They are held in confidence, and any disclosure to a third-party vendor is made only with the client's consent.
Test material and data handling
Black Shard is an Australian company, subject to the Privacy Act 1988 and the Notifiable Data Breaches scheme, and the platforms that hold client data run in Australian regions on Microsoft Azure.
Encryption, access and certification
A penetration test generates sensitive material: credentials, configuration detail, and evidence of how systems fail. Engagement data is encrypted in transit and at rest, and access is least-privilege and time-boxed to the testing window.
Black Shard holds SMB1001:2026 Gold, issued by CyberCert. OWASP and ASD guidance are methodologies we test against.
How much does penetration testing cost?
An external penetration test runs to a fixed scope, priced in writing before the work starts, with a written report and a re-test of the reported findings. Four things drive the quote.
- The size of the attack surface
- The number of environments in scope
- Tenancy count for multi-tenant products
- Whether on-site work is included
Market price bands
The re-test sits inside the fixed scope. Penetration testing cost in Australia sits in broad market bands by engagement type, and a quote well under the band for its type is usually a vulnerability scan.
A free 30-minute scoping call settles the scope and the quote. A brief to info@blackshard.com.au starts scoping from the detail you have.
From the newsroom
Vulnerabilities, in the newsroom.
High severity
High severity
Questions, answered.
How do I get a penetration testing quote?
Send a brief naming the applications, APIs, cloud environments or network segments in question. Every test starts with a written scope and quote, and the quote names its drivers: the size of the attack surface, the number of environments in scope, tenancy count for multi-tenant products, and whether any of the work needs to run on-site.
Do you work across Australia?
Yes. Testing runs remotely against your applications and networks over the same paths they are exposed on, so location is a scoping detail. On-site internal testing is available where the scope calls for it.
What methodologies do you test against?
OWASP guidance for applications and APIs, and ASD guidance, including the Essential Eight mitigation strategies, for the surrounding environment. These are methodologies we work against. The firm holds SMB1001:2026 Gold, issued by CyberCert.
Is a re-test included?
Yes. A re-test of the findings in the original report sits inside the fixed scope. It confirms closure on the deployed system.
Do you just run a scanner?
Automated tooling is used for coverage. Nothing is reported as a finding until a tester has reproduced it, and every finding carries the reproduction steps.
Can I share the report with my board or insurer?
Yes. Each finding is written with severity, business impact, reproduction steps and remediation detail, so it can be read by an executive and worked from by an engineer.
How long does a penetration test take?
The timeframe is fixed at scoping and depends on the attack surface, the environments in scope and tenancy count. A single external perimeter is a shorter engagement than a multi-tenant application with an API and a cloud environment behind it. The window is in writing before testing begins.
What access do you need?
Only what the scope requires. Access is least-privilege and time-boxed to the testing window, and the access model is agreed at scoping with the targets and the timeframe.
What types of penetration testing do you run?
External and internal network testing, web application testing, API testing and cloud testing, scoped on their own or combined into one engagement with one report. AI penetration testing covers models, agents and the tools they can call.
What does a finding in the report contain?
A title and severity, the affected assets, a description of the business impact, reproduction steps with evidence, the remediation, and its status after the re-test. The report opens with an executive summary.
