We test applications, APIs, networks and cloud environments for vulnerabilities that can be reproduced and exploited.
Findings are manually verified before they are reported. Each report explains the affected system, the attack path, the likely impact and the remediation required. Penetration testing is suited to a defined application or environment. Red teaming is broader.
It starts with an objective and tests whether an attacker could reach it across multiple technical and human controls. Social-engineering assessments are included when staff processes form part of the attack surface.
Web application, API, network and cloud environment testing against OWASP guidance and ASD playbooks.
What you get
An objective-led assessment of whether an attacker could reach a defined target across technical and human controls.
What you get
Controlled phishing and pretext campaigns that measure susceptibility where staff processes form part of the attack surface.
What you get
How it is shaped
A fixed-scope engagement with a defined target and timeframe. Fixed-scope testing includes verification of agreed remediated findings.
A tester never assesses a system they built.
Client confidential
Authenticated application and cloud-configuration penetration test of a Queensland financial-services platform, under signed authority, retested to closure.
Black Shard engineers. The team that designs, builds and runs production software also performs the offensive work, so the person probing your API has shipped and operated systems like it, and findings come back as engineering problems with engineering fixes. An engineer confirms every finding before it reaches the report.
Least privilege, for the duration of the work and the agreed scope. Data is encrypted in transit and at rest, few third parties touch it, and the services that host it run in Australian regions. Anything sensitive the engagement surfaces falls under our own incident and Privacy Act obligations. We hold SMB1001:2026 Gold, issued by CyberCert.
A ranked findings report. Each finding carries severity, impact, reproduction steps and a fix, ranked by what it would cost you. Red team engagements add an attack narrative showing how far we got and how. Leadership and the engineers fixing the issues read the same document, and every finding was proven by a person.
Yes. Fixed-scope offensive work includes a re-test: once your team has remediated, we re-run the reproduction steps for each finding and confirm it is closed. The re-test covers the findings from the original engagement; new surface or new features are a new scope. The engagement finishes when the fixes are verified.
Yes. Offensive testing runs against your systems wherever they are hosted: applications, APIs, networks and people are all tested remotely under a controlled scope. Scoping, reporting and the re-test work identically for a client in Perth or Melbourne and one across town, and on-site work is scheduled and travelled to inside the fixed scope.
Remediation starts the day the report arrives, because each finding carries a fix. Work the list in ranked order, and we re-test when the fixes are in. Where findings point at deeper design problems, our secure development and advisory work picks up: threat modelling, line-level code review, or a standing security seat.
By scope. Offensive work runs as a fixed-scope engagement: a defined target, a defined timeframe and a re-test. Scoping names the applications, APIs, networks and people to be tested, and the price follows that. We do not publish indicative prices, because a number without a scope misleads. If the target grows mid-engagement, we re-scope openly.
Send a brief to info@blackshard.com.au or through the contact page: what the system is, roughly what it holds, and what prompted the test. It does not need to be polished; naming the target and the concern is enough. From there we scope a fixed-target, fixed-timeframe engagement with the re-test built in, and the scope is agreed before any testing starts.
