About Aurian Security | Aurian Security

Aurian Security was founded in 2020 by Australian cybersecurity professionals who had spent enough time inside large consultancies to know what they did not want to build: bloated engagement models, templated reports, and testing quietly delivered from offshore.

The firm has done offensive security only, from the start: penetration testing, adversary simulation and the assurance work that follows from knowing how systems are actually broken into. Every engagement is performed by a senior Aurian consultant, onshore in Australia. Nothing is outsourced, offshored or crowdsourced, and the consultant who does the testing writes the report.

Since 2020 the client base has grown across all levels of government, private industry and education, from state agencies, regional councils, independent schools and universities to national SaaS platforms and critical infrastructure operators. The firm remains Australian-owned and independent, with no vendor partnerships that shape what it recommends, no upsells, and no product to sell you at the end of the report.

Aurian Security Pty Ltd, ACN 639 930 528, is registered in Sydney and works with organisations across Australia. We hold professional indemnity insurance of $4 million per claim, public liability insurance of $20 million and cyber liability insurance. Certificates of currency are available on request. Aurian is a prequalified supplier under the NSW Government ICT Services Scheme (SCM0020), Local Government Procurement's IT&C Products, Services and Consulting panel (LGP115-2) and Local Buy's ICT Solutions, Products, Services and New Technologies arrangement (LB308), which serves councils in Queensland, the Northern Territory and Tasmania.

Approach

How we work

The same principles run through every service, and they are the reason clients come back for the next annual test.

Senior consultants only

No junior testers learning on your systems, no outsourced or offshore delivery. Every engagement is performed onshore in Australia by a senior consultant.
Manual testing, tooling for coverage

Scanners find the known. A consultant finds the chained, the logical and the contextual, which is where the risk lives.
Standards-aligned, plainly reported

PTES, NIST SP 800-115, the OWASP guides, CIS Benchmarks and the ASD Essential Eight, written up so your own engineers can act.
Australian and independent

Australian-owned, with consultants across the country. No vendor bias, no upsells, no product at the end of the report.
Serious findings, same day

A serious exposure is raised when it is confirmed, not held for the report.
Closed means retested

Once you have remediated, a retest confirms what is closed and the report is updated, so the record shows what was fixed.

Certifications

Certified, and examined by doing

Aurian's consultants hold offensive-security certifications that are examined by compromising live systems under time pressure.

OSCE

OffSec Certified Expert

Practical exam

Advanced exploitation, including custom exploit development against hardened targets.
OSCP

OffSec Certified Professional

Practical exam

Hands-on penetration testing, examined by compromising live machines under time pressure.
OSWP

OffSec Wireless Professional

Practical exam

Practical wireless attack and defence across the 802.11 standards.

Standards

What we test against

OWASP

The Web Security Testing Guide, the Application Security Verification Standard, the Mobile Application Security standards and the API Security Top 10.
PTES and NIST SP 800-115

The Penetration Testing Execution Standard and NIST’s technical guide to security testing, for network and infrastructure engagements.
CIS Benchmarks

Consensus hardening baselines for operating systems, network devices, cloud platforms and Microsoft 365, used in configuration reviews and cloud assessments.
ASD Essential Eight

The Australian Signals Directorate’s Essential Eight Maturity Model and the Information Security Manual, for assurance work in and around government.

Clients

What clients say

Aurian Security has supported us with penetration testing for the last couple of years, and the team has been excellent to work with throughout. They're personable, highly knowledgeable, and flexible in fitting the work around our timelines. They also bring a genuinely pragmatic approach to understanding our environment and shaping their recommendations and fixes, which makes the outcomes easy for our team to act on.

Sunil Saale, Chief Information Security Officer
Their penetration testing work we found to be methodical and thorough on both the network and application penetration testing fronts. Aurian securely provided a comprehensive technical report of issues found. The quality of the technical report was of a high quality, it detailed steps to reproduce issues, discussion around any vulnerabilities, and recommended remediation steps. We plan to use the penetration testing services of Aurian again.

Chief Technology Officer, Australian health software vendor and service provider
The Advitech Group engaged Aurian Security to undertake an independent assessment of our IT infrastructure. The assessments were conducted professionally and in a timely manner. We were very impressed with the professional quality of both the executive and technical reports, including the detailed recommendations to address required system improvements.

Steven Smith, Managing Director
We found Aurian to be professional, engaging, and supportive throughout our testing. From tailoring their proposal to meet our requirements to exceeding our expectations in terms of frequency and quality of communication, Aurian were able to complete testing with minimal disruption. Their experience was invaluable, and their knowledge shone through while their ability to ease us through the process was a breath of fresh air. The approach adopted by Aurian allowed us to complete testing quickly and efficiently and to take a holistic view of our estate.

John Higgs, Technical Services Manager
Working with Aurian gives us the confidence when we're implementing solutions for our clients, that we have covered all of the best practice preventative measures around data, privacy and security in an ever-evolving landscape of requirements and potential threats. Aurian's grounded approach to educating and informing clients on long term strategy to make security mindset a part of the culture is something that we really value and align with.

Chris D'Aloisio, Head of Development
During our engagement with Aurian Security, the company's team was professional and demonstrated subject matter expertise on the intricacies of technical findings. Team members provided regular status updates throughout the project. We would definitely engage Aurian again.

Charbel Aghnatios, Managing Director
Allcom Networks utilizes the expertise of the Aurian Security team to deliver expert Cyber Security services to our customers throughout NSW Government and Local Councils throughout Australia. It is Allcom's opinion that the services provided by Aurian are superior to that delivered by their competitors.

Michael Smith, Head of Government
Aurian Security have provided Mambourin with thorough penetration testing and great attention to detail over the past two years. Their clear communication and detailed reporting throughout the engagement helped us better understand our security posture. The consultation process was well organised, and their advice on remediation was well formatted and extremely helpful.

Warren Yates, General Manager – ICT