Penetration Testing Canberra
Core Sentinel delivers senior-led penetration testing to Canberra and ACT organisations, from federal agencies to the suppliers who build and host their systems. We test remotely for most engagements and on-site when the work needs it. Every test is run by a senior tester holding OSCE and OSCP, backed by 20+ years of hands-on experience and 30+ professional certifications, and every finding is proven by hand, never copied out of a scanner. Request a fixed-price quote.
- OSCE / OSCP-certified testers
- Senior-only — no junior bench
- Free re-test & letter of attestation
What does a penetration test for a Canberra organisation involve?
A penetration test is an authorised, time-boxed attack on your systems by a tester working the way a real attacker would. For Canberra organisations the test is usually scoped to a framework: the Information Security Manual (ISM), the Essential Eight, or the Protective Security Policy Framework your agency reports against. At Core Sentinel a senior OSCE/OSCP-certified tester runs every engagement in five steps. You tell us the scope. We issue a fixed-price quote. We agree the rules of engagement and a test window. We test and report, with every finding mapped to the ISM control or Essential Eight mitigation it affects. Then we retest your fixes for free. A penetration test is not an IRAP assessment and doesn't replace one; it gives you, and your IRAP assessor, hard evidence of what an attacker can actually do. Cost depends on scope, so there is no rate card.
What can we test for your Canberra organisation?
Agencies, the companies that supply them, and Canberra's own businesses get the full range of our penetration testing services. Pen testing here means a senior tester on every job:
-
Web application penetration testing
Citizen-facing services, portals and the APIs behind them, tested by hand against OWASP, including the access-control flaws that expose one user's records to another.
-
External infrastructure penetration testing
Your internet-facing perimeter, tested from outside: exposed services, remote access and the hosts nobody remembers deploying.
-
Internal penetration testing
Assumed-breach and Active Directory testing that shows how far a foothold on your network really goes, and which ISM controls stop it.
-
Mobile application penetration testing
iOS and Android apps and their backend APIs, tested at the code, platform and traffic level.
-
Wireless penetration testing
Performed on-site at your Canberra premises: corporate and guest Wi-Fi, rogue access points, and the separation between wireless and corporate networks.
-
Cyber security professional services
Red teaming, social engineering, source-code review and security advice from the same senior specialists who run our penetration tests.
Every engagement ends with a prioritised, evidence-backed report, a free retest to prove your fixes hold, and a letter of attestation. Canberra is one part of a national practice; see penetration testing across Australia.
Do we have a Canberra office?
No. Core Sentinel works from our Sydney office at Governor Phillip Tower, 1 Farrer Place, Sydney NSW 2000. We don't have an ACT office, and we're not going to invent one to rank for “penetration testing Canberra”.
Here's why that matters less than you'd expect. Web application, external infrastructure and mobile engagements run remotely, the way real attacks arrive, under written rules of engagement with agreed testing windows and escalation contacts. Canberra and Sydney share a time zone, so testing, stand-ups and the debrief all fall in your business hours. And the senior tester who scopes your engagement is the one who does it.
Two engagement types need more than a connection:
- Wireless testing is always on-site. We travel to your premises anywhere in Canberra, from Civic to Barton, Russell and Belconnen, with the visit agreed at scoping and included in your fixed price.
- Internal testing is your choice. A pre-configured VPN implant device shipped to your office, a jump host you provide, or on-site testing where your security policy requires it.
What do the ISM and the PSPF ask of Canberra organisations?
Two documents shape most security work in Canberra. The Protective Security Policy Framework (PSPF Release 2026) prescribes what Australian Government entities must do to protect their people, information and resources, across six security domains, and applicable Commonwealth entities report each financial year on the maturity of their security capability. The Information Security Manual, produced by the Australian Signals Directorate (the current release is September 2026), is the cyber security framework organisations use to protect their IT and OT systems from cyber threats.
Neither one is satisfied by a policy document alone. A maturity rating needs evidence behind it, and the most direct evidence that a control works is a skilled attacker failing to get past it. That's what we provide: testing scoped to the systems in question, and every finding mapped to the ISM control or Essential Eight mitigation it affects.
The same pressure reaches suppliers. If you build, host or support systems for an agency, its obligations arrive in your contract and your security questionnaire. A senior-led test with control-mapped findings answers that questionnaire with evidence rather than assertions.
Is a penetration test the same as an IRAP assessment?
No, and confusing the two is expensive. The Infosec Registered Assessors Program is run by the Australian Signals Directorate, which endorses individual assessors from the private and public sectors to provide independent security assessments, including of systems handling information classified SECRET and below. ASD's own page is precise about the limits: IRAP assessors do not accredit, endorse or register systems on ASD's behalf; an assessment generally won't cover every ISM control; and completing one doesn't mean the system complies with the controls tested.
A penetration test answers a narrower and harder question: can an attacker actually get in, and how far? It sits alongside an IRAP assessment rather than replacing it. Run before the assessment, it finds what your assessor would otherwise find. Run after, it shows the controls hold up against a real attack. Either way, the evidence goes in the same pack.
We are not IRAP assessors.
Which framework is behind your request?
In Canberra there usually is one. We scope to it and map every finding to the control it affects:
-
ISM
Testing scoped to the ISM controls that apply to your system, reported in the language your assessor and your authorising officer recognise.
-
Essential Eight
We test whether each mitigation stops the technique it is meant to stop, at the maturity level you report.
-
PSPF
Evidence for the cyber security parts of your annual PSPF maturity reporting, from testing rather than self-assessment.
-
IRAP
Technical evidence for systems working toward or maintaining an IRAP-assessed environment. We are not a substitute for the assessor.
-
ISO 27001, SOC 2, the SOCI Act and ST4S
For Canberra's private sector and suppliers, findings mapped to the controls your auditor checks.
For a framework-by-framework breakdown, see our guide to penetration testing for Australian compliance.
Frequently asked questions
How much does a penetration test cost in Canberra?
Every engagement is fixed-price, quoted up front from your scope: the number of applications, IP ranges, user roles and the depth of testing required. Any on-site work in Canberra is priced into the same quote, and the free remediation retest is always included. Send us your scope and we'll return a firm number before anything starts.
Do you have an office in Canberra?
No, and we'd rather tell you than pretend otherwise. Core Sentinel is based in Sydney at Governor Phillip Tower, 1 Farrer Place. Most engagements for Canberra clients run remotely, and we travel to Canberra for on-site work such as wireless testing whenever an engagement calls for it.
Are you IRAP assessors?
No. IRAP assessors are individuals endorsed by the Australian Signals Directorate. A penetration test is different work: it shows what an attacker can actually do, and it gives you and your IRAP assessor evidence to work with.
Can you test against the ISM and the Essential Eight?
Yes. We scope testing to the ISM controls and Essential Eight mitigations that apply to your system, then map every finding to the specific control it affects, so you have evidence of control effectiveness to put in front of an assessor, an auditor or your agency's security team.
Can you do on-site penetration testing in Canberra?
Yes. Wireless testing is always performed on-site at your Canberra premises. Internal testing can run on-site too, or remotely through a VPN implant device we ship to your office or a jump host you provide. On-site visits are agreed at scoping and included in the fixed price.
Are you CREST certified?
Our founder has completed CREST certification. Every engagement is delivered under current OSCE and OSCP certifications — the hands-on offensive-security qualifications — backed by 20+ years and 30+ professional certifications. Every test is senior-led and manual: the certification belongs to the person actually attacking your systems, not to a company badge.
Book a penetration test in Canberra
Let us hack you before they do. Tell us what needs testing and a senior OSCE/OSCP-certified tester will come back with a fixed-price quote, typically for a few days to two weeks of active testing, with a free retest included.
Prefer to talk it through first? Send us your scope and we'll call you.