Penetration testing in Brisbane.
Manual penetration testing of web applications, APIs, networks and cloud environments, scoped in writing, with every finding reproduced by a tester before it is reported.
External penetration test from $4,950 ex GST.
Fixed scope, written report, re-test included.
- Inside the fixed scope
- Re-test
- Every finding reproduced by a tester
- Manual
- Brisbane head office, on-site testing
- Eagle Street
Testing is manual, with tooling used for coverage. Each finding carries a severity rated for this environment, the affected assets, reproduction steps with evidence and the fix, and is tested again once that fix is deployed.
Boundaries and in-person work
We agree the target and testing boundaries before starting, and document each finding with the technical information required to remediate it. The head office is on Eagle Street in Brisbane, and scoping, internal network testing and the debrief can run in person for Brisbane organisations.
Scoping and rules of engagement
Every test starts with a written scope and quote, set against the assets in question: applications, APIs, cloud environments, network segments, or a combination. Rules of engagement are agreed in writing before testing begins.
Rules of engagement
- The scope boundary and exclusions
- The testing window and any blackout periods
- Techniques excluded by default, such as denial-of-service testing
- Written authorisation naming who can vary or halt scope
- A stop-work procedure with a named contact on both sides
- Access that is least-privilege and time-boxed to the testing window
What we test
Web applications and APIs are tested against OWASP guidance, networks against ASD guidance. Multi-tenant systems have the tenant boundary tested specifically.
Applications, networks and cloud
Web application and API testing covers authentication and session handling, access control, injection, and application logic. Black Shard built and operates Aurii, clinical software that isolates tenant data with PostgreSQL row-level security, and the tenancy checks run on client systems follow the ones applied to that data layer.
External network testing establishes what is reachable from the internet. Internal testing starts from an assumed foothold and establishes how far it extends, and can run on-site at your Brisbane premises. Cloud environments are reviewed for identity, network exposure and configuration alongside the application work.
Related engagements
Secure code review, red team assessment, social engineering testing and Azure security review are separate engagements from the same firm where a test surfaces problems outside its scope.
Types of penetration testing in Brisbane
Each type is scoped on its own or combined into one engagement with one report. An external test is the usual starting point, because it answers what an attacker on the internet can reach today.
- External network penetration testing: the internet-facing perimeter, from the IP ranges, domains and services you own
- Internal network penetration testing: from an assumed foothold, on-site at your Brisbane premises or over remote access
- Web application penetration testing: authentication, session handling, access control, injection and business logic, tested against OWASP guidance
- API penetration testing: authorisation on every endpoint, object-level access control, and the data each response returns
- Cloud penetration testing: identity, network exposure and configuration in the cloud environment behind the application
API testing
API penetration testing and web application testing follow where a product or customer portal holds data that matters.
How a penetration test runs
Six stages, each recorded in the report with what was done and when.
- Scoping: a free 30-minute call, then a written scope, quote and rules of engagement naming every target
- Reconnaissance: the external footprint is mapped from public sources and DNS, so testing starts from what an attacker can see
- Discovery: each target is enumerated for exposed services, entry points, roles and trust boundaries, with automated tooling used for coverage
- Exploitation: weaknesses tested by hand, chained where they combine, only as far as the rules of engagement allow
- Reporting: each reproduced finding written up, then a debrief with the tester, in person or by video
- Re-test: once fixes are deployed, each reported finding is tested again and its status recorded
Findings and reporting
Every finding is reproduced by a tester before it is written up; automated output is reported only after a person confirms it. The findings report opens with an executive summary of overall exposure, findings ranked by severity.
- Title and severity, rated for what an attacker could do with the weakness in this environment
- Affected assets: the host, URL, API endpoint or cloud resource, and the environment and build tested
- Description and business impact: what the weakness allows, and what data or function it exposes
- Reproduction steps with evidence: the requests, responses and screenshots captured at the time of testing
- Remediation: the fix, written for the engineers who will apply it, with OWASP or ASD references where they apply
- Re-test status: open, closed or partially closed, recorded once the re-test runs
What each finding contains
Each finding follows one structure, so an engineer can work from it and an executive can rank it. It is written with severity, business impact, reproduction steps and the technical detail required to remediate it. The findings report goes with a debrief with the tester, in person in Brisbane or by video call.
Re-testing
A re-test confirms that each reported finding has been closed on the deployed system. Its scope is limited to the findings raised in the original report. If the environment has changed materially between the test and the re-test, that change is flagged and re-scoping is discussed before the re-test proceeds.
Confidentiality
Findings are the client's information. They are held in confidence, and any disclosure to a third-party vendor is made only with the client's consent.
Delivery in Brisbane
Black Shard's head office is on Eagle Street in Brisbane, and penetration testing is delivered Australia-wide from it. For Brisbane organisations, scoping, internal network testing and the debrief can run in person at Eagle Street or at your office.
Remote delivery
Elsewhere the same engagement runs remotely, with the same report and the same re-test.
Systems we build and operate
Black Shard builds and operates production software as well as testing it. GRM LAW, a Brisbane law firm, runs on an operations and compliance portal Black Shard built and operates, in which every state change is written to an append-only audit ledger.
How much does a penetration test cost?
An external penetration test starts at $4,950 ex GST, for a fixed scope with a written report and a re-test of the reported findings. Above that price, four things drive the quote.
- The size of the attack surface
- The number of environments in scope
- Tenancy count for multi-tenant products
- Whether on-site internal testing is included
Market price bands
The re-test sits inside the fixed scope. Penetration testing prices in Australia sit in broad bands by engagement type, and scope decides where in its band a quote lands.
A free 30-minute scoping call settles the scope and the quote. A brief to info@blackshard.com.au starts scoping from the detail you have.
Recent work of this kind
Client confidential
Authenticated application and cloud-configuration penetration test of a Queensland financial-services platform, under signed authority, retested to closure.
Questions, answered
Do you test internal and external networks in Brisbane?
Yes. External testing establishes what is reachable from the internet. Internal testing starts from an assumed foothold and establishes how far it extends, and can run on-site at your Brisbane premises. Both are tested against ASD guidance.
Is a vulnerability scan the same as a penetration test?
No. A scanner enumerates known issues. A penetration test confirms which of them are exploitable, chains them where they combine, and assesses the business impact of what is reachable.
Can you test on-site in Brisbane?
Yes. Internal network testing can run from your Brisbane premises, and scoping and the debrief can be held at Eagle Street or at your office. Where on-site work adds nothing, the engagement runs remotely.
How long does a penetration test take?
The timeframe is fixed at scoping and depends on the attack surface, the environments in scope and whether on-site internal testing is included. A single external perimeter is a shorter engagement than a multi-tenant application with an API and a cloud environment behind it. The window is in writing before work starts.
Will a penetration test disrupt production?
Rules of engagement set the testing window, any blackout periods, and the techniques excluded by default. A stop-work procedure with a named contact on both sides is agreed before testing begins, and access is least-privilege for the duration.
Is a re-test included?
Yes. A re-test of the findings in the original report sits inside the fixed scope. It confirms closure on the deployed system.
How much does a penetration test cost in Brisbane?
An external penetration test starts at $4,950 ex GST, for a fixed scope with a written findings report and a re-test of the reported findings. Larger scopes are quoted in writing before work starts, against the size of the attack surface, the environments in scope and any on-site work.
What standards do you test against?
Web applications and APIs are tested against OWASP guidance, and networks against ASD guidance. Black Shard holds SMB1001:2026 Gold, verifiable on the CyberCert public registry, and runs its own environment at Essential Eight Maturity Level 3.
What does a finding in the report contain?
A title and severity, the affected assets, a description of the business impact, reproduction steps with evidence, the remediation, and its status after the re-test. The report opens with an executive summary for the people signing off on the fixes.
Scope a penetration test with Black Shard.
Brisbane head office.
Book a free 30-minute scoping callOpen a briefinfo@blackshard.com.au