Penetration testing for every sector

Non-corporate Commonwealth entities must reach Essential Eight Maturity Level Two under the Protective Security Policy Framework and report against it, with the Information Security Manual behind every control. Statutory bodies and corporate entities are held to the same bar by their boards and auditors. The rating has to be earned on evidence, and testing is where the evidence comes from.

Engagements usually start with an Essential Eight assessment that tests each strategy against Maturity Level Two with evidence from the systems themselves, or with an external network penetration test of the public-facing services and remote access. Web application testing of the portals follows, internal network tests examine the paths from a compromised workstation to the records, cloud security assessments cover the Microsoft 365 tenancy and the Azure or AWS workloads, and configuration reviews close the gaps the tests found. Aurian does not hold IRAP-endorsed assessors; where an IRAP assessment is required, our testing supplies the evidence it draws on.

Councils run public-facing services and payment portals on one side and a long tail of legacy systems on the other, often with suppliers holding remote access to parts of the estate. State audit offices publish what they expect, and the Essential Eight is the yardstick.

A typical programme pairs an external network penetration test of the public services with an internal test that includes supplier access paths and the legacy systems nobody wants to touch. Essential Eight assessments give the audit committee a maturity rating per strategy and a roadmap. Cloud security assessments cover the Microsoft 365 tenancy and any Azure or AWS workloads, and configuration reviews of firewalls and the standard operating environment follow where the internal test found the gaps.

Councils in New South Wales can engage Aurian through Local Government Procurement’s IT&C Products, Services and Consulting panel (LGP115-2), councils in Queensland, the Northern Territory and Tasmania through Local Buy’s ICT arrangement (LB308), and NSW Government agencies through the ICT Services Scheme (SCM0020), so an engagement can be raised against a panel rather than an open tender.

Universities run some of the most open networks in the country: tens of thousands of students and staff, research that crosses borders, federated identity, and decades of systems side by side. Registered universities are critical infrastructure under the Security of Critical Infrastructure Act, TEQSA expects information systems to be kept secure, and the foreign interference guidelines put cyber security on the council's agenda. TAFEs and other public providers answer to state cyber security policies as well.

Engagements usually start at the edge: an external network penetration test of the perimeter and the remote access that thousands of people use every day, and web application and API testing of the student-facing platforms, the learning management system and the research portals. Internal network tests follow the federated identity through to the research, HR and finance systems, cloud security assessments cover the Microsoft 365 or Google tenancy and the research workloads in AWS or Azure, and a phishing simulation gives the security team a baseline across a population that turns over every year.

Lenders and financial firms hold identity and credit data, run customer portals and APIs that partners and brokers depend on, and face questions from regulators, auditors, banks and insurers about how that data is protected. The evidence has to stand up to someone reading it closely.

Most engagements start with the customer-facing surface: an external network penetration test and a web application or API test of the portal, the broker channel and the integrations behind it. Cloud security assessments cover the platform those applications run on. Configuration reviews and formal retesting produce the evidence that auditors and partners ask for, with an updated report that shows each finding was closed.

Accounting, engineering, actuarial and advisory firms hold client material that would be damaging in the wrong hands, and email is both the way work arrives and the way attacks arrive. The Microsoft 365 tenancy is usually the whole estate.

An external network penetration test and a Microsoft 365 and identity review cover the perimeter that matters: remote access, mail, Conditional Access and the administrator accounts. Phishing simulations show how staff respond to the invoice and document-share lures that target firms like yours, and an Essential Eight assessment gives partners a rating to report to clients and the insurer.

Operators of critical infrastructure carry obligations under the Security of Critical Infrastructure Act and answer to regulators as well as customers. The boundary between corporate IT and operational technology is where an attacker would look first, and it is where testing has to be planned most carefully.

Engagements are scoped around the boundary. External network penetration tests cover the corporate perimeter and remote access, cloud security assessments cover landing zones and the identity that spans them, and segmentation reviews examine the controls between corporate and operational networks without touching the operational side unless that is explicitly agreed. Configuration reviews of the firewalls that enforce those boundaries follow, and SIEM monitoring keeps eyes on the crossing points.

For a SaaS or advertising technology company the web application and its API are the business, and every enterprise customer's procurement process asks for evidence that they have been tested. Releases ship weekly or daily, so a test from twelve months ago says less than it used to.

The core engagement is an authenticated web application and API penetration test, repeated annually and after major releases, with a cloud security assessment of the AWS, Azure or Google Cloud environment the platform runs on. Continuous application scanning sits between manual tests and flags drift between releases. Retesting produces the updated report and attestation letter that customers’ security teams ask for, the letter on request at no charge.

Larger organisations have internal security teams and still need an independent view: a fresh set of senior eyes on the estate, a programme that covers the whole attack surface over a year, and reporting that holds up in front of the board and the auditors.

Enterprise programmes combine several services over a year: external and internal network tests, application and API tests as systems change, cloud security assessments of each platform, configuration reviews of the controls that matter most, and vulnerability management in between. One consultant coordinates the programme so the findings from each engagement inform the next, and the annual report to the board shows the trend rather than a list.