At a glance
Eagle Street
Brisbane head office, on-site testing
Offensive testing
Penetration testing in Brisbane.
Manual penetration testing from our Eagle Street head office, with internal tests run on your premises and scoping and the debrief held in person.
Fixed scope
External penetration test
Fixed scope, priced before the work starts.
External test, report and re-test.
At a glance
LB308
Queensland councils buy by quote
At a glance
Re-test
Inside the fixed scope
Overview
Our head office is at Level 35, Riparian Plaza, 71 Eagle Street. For a Brisbane organisation, the parts of a test that gain from being in the room run in person: the internal network test, the scoping meeting and the debrief.
Elsewhere in Australia
Elsewhere in Queensland and across Australia the same test runs remotely, with the same report and the same re-test. The method behind every test, stage by stage, is the one we run for penetration testing across Australia.
Internal network testing on your Brisbane premises
An internal test starts from an assumed foothold inside the network and establishes how far it extends. In Brisbane the tester can run it from a desk in your office, on the network your staff use every day.
On site or over remote access
Where the network spans more than one site, or being on site adds nothing, the same test runs over agreed remote access. Either way access is least-privilege, time-boxed to the testing window and removed when the test ends. How attackers move through a Windows network is the path an internal test follows.
Queensland councils: penetration testing under Local Buy LB308
Black Shard Pty Ltd is a prequalified supplier to Queensland councils under Local Buy arrangement LB308. A council can request a quote for a penetration test under the arrangement without running an open tender of its own.
How a council requests a quote
Name LB308 on the request and tell us the systems in scope. The reply is a fixed-scope quote under the LB308 terms.
Scoping and the debrief at Eagle Street
Scoping settles what is tested, when, and what is out of bounds, and for a Brisbane organisation it can be a meeting at Eagle Street or at your office. The debrief runs the same way: the tester who did the work takes your engineers through each finding, and the executive summary goes to the people who sign off the fixes.
Scope, findings and the re-test
Every test starts with a written scope, quote and rules of engagement, and every finding is reproduced by a tester before it goes in the findings report. The re-test sits inside the fixed scope.
A Queensland system we build and operate
Among the systems we build and operate is the operations and compliance portal of GRM LAW, a Queensland law firm, which writes every change of state to an append-only audit ledger. Tenancy and audit checks on client systems follow the ones we hold our own builds to.
What a Brisbane test covers
Each type can be scoped alone or combined into one engagement with one report, and an external test is the usual first step.
- External: what an attacker on the internet can reach across your IP ranges, domains and exposed services
- Internal: from an assumed foothold, on a desk in your own office in Brisbane or over remote access
- Web application penetration testing: sign-in, sessions, access control, injection and business logic, against OWASP guidance
- API: authorisation on every endpoint, and the data each response hands back
- Cloud: identity, network exposure and configuration in the environment behind the application
Between tests
Between tests, attack surface management watches the external footprint for new hosts and exposed services, and secure code review reads an application from its source. Both are separate engagements from the same firm.
How much does a penetration test cost in Brisbane?
An external penetration test runs to a fixed scope, priced in writing before the work starts, with a written report and a re-test of the reported findings. The quote follows the size of the attack surface, the environments in scope, the tenancy count of a multi-tenant product and any on-site internal work.
The scoping call, and market prices
The free 30-minute scoping call can be held at Eagle Street, at your office or by video, and a brief to info@blackshard.com.au starts scoping from the detail you have. Penetration testing prices in Australia sit in broad bands by engagement type.
From the newsroom
Vulnerabilities, in the newsroom.
High severity
High severity
Questions, answered.
Do you test internal and external networks in Brisbane?
Yes. The external test covers what an attacker on the internet can reach. The internal test starts from an assumed foothold and can run from a desk in your own office in Brisbane. Networks are tested against ASD guidance.
Can you test on-site in Brisbane?
Yes. Internal network testing can run from your Brisbane premises, and scoping and the debrief can be held at Eagle Street or at your office. Where on-site work adds nothing, the engagement runs remotely.
Can a Queensland council engage you under Local Buy?
Yes. Black Shard Pty Ltd is a prequalified supplier to Queensland councils under Local Buy arrangement LB308. Name LB308 on the request for quote, and the reply is a fixed-scope quote under the arrangement.
Where is your head office?
Level 35, Riparian Plaza, 71 Eagle Street, Brisbane QLD 4000. Scoping meetings and debriefs can be held there or at your office.
Is a vulnerability scan the same as a penetration test?
No. A scanner enumerates known issues. A penetration test confirms which of them are exploitable, chains them where they combine, and assesses the business impact of what is reachable.
Will a penetration test disrupt production?
Rules of engagement set the testing window, any blackout periods, and the techniques excluded by default. A stop-work procedure with a named contact on both sides is agreed before testing begins, and access is least-privilege for the duration.
How much does a penetration test cost in Brisbane?
An external penetration test runs to a fixed scope, priced in writing before the work starts, with a written findings report and a re-test of the reported findings. Larger scopes, and on-site internal work in Brisbane, are quoted in writing before work starts.
What standards do you test against?
OWASP guidance for web applications and APIs, and ASD guidance for networks. Black Shard holds SMB1001:2026 Gold, issued by CyberCert, and its own estate runs at Essential Eight Maturity Level 3, assessed September 2026.
