What Penetration Testing Actually Involves
A pen test is a structured process, not an ad hoc probe. The tester follows defined phases and works within an agreed scope.
Reconnaissance: Gathering information about the target, including publicly available data, network infrastructure, employee information, and technology stack. This mirrors what a real attacker does before attempting access.
Scanning: Identifying live systems, open ports, running services, and potential vulnerabilities. This phase uses both automated tools and manual analysis to build a picture of the attack surface.
Exploitation: Attempting to exploit identified vulnerabilities to gain access. This is where a pen test differs from a vulnerability scan. A scanner tells you a vulnerability exists. A pen tester demonstrates what an attacker can actually do with it.
Reporting: Documenting findings, demonstrating proof-of-concept evidence for critical vulnerabilities, and providing a risk-rated remediation roadmap. The report should tell you what was found, how serious it is, and what to do about it.
The output is not just a list of CVEs. A quality pen test report shows what an attacker could realistically achieve if they exploited the same vulnerabilities, framed in terms of business impact rather than technical severity.
What It’s Not: Common Misconceptions
Penetration testing is often confused with other security activities.
It’s not the same as a vulnerability scan. A vulnerability scan uses automated tools to identify known weaknesses. It’s faster and cheaper, but it doesn’t tell you whether those weaknesses can be exploited or what the real impact would be. A pen tester uses human judgement and attacker techniques to go further.
It’s not a one-time fix. A pen test is a point-in-time assessment. Your systems change, new vulnerabilities are discovered, and attackers develop new techniques. A clean pen test result from 18 months ago doesn’t mean you’re secure today.
It’s not a guarantee of security. A pen test that finds no critical vulnerabilities means your defences held against that specific scope, at that point in time. It doesn’t mean you’re unbreachable. New vulnerabilities emerge after every test.
Why Australian Businesses Are Being Asked to Do It
Penetration testing has shifted from a best-practice recommendation to a practical requirement in several areas.
Cyber insurance: Underwriters are increasingly requiring annual penetration testing as a condition of coverage or renewal. In some cases, the premium is lower for organisations with recent, documented testing results. Check your policy renewal terms.
ASD Essential Eight compliance: At ML2 and above, the Essential Eight requires controls like application control and patching to be genuinely effective, not just nominally in place. Penetration testing provides evidence that these controls work against real attack techniques. Some assessors explicitly require pen test results as part of the maturity assessment process.
Government and enterprise procurement: Federal and state government contracts increasingly require evidence of regular security testing. Enterprise buyers are including pen test requirements in their supplier due diligence questionnaires. If you’re supplying into those markets, expect to be asked.
PCI DSS: Organisations that store, process, or transmit payment card data must conduct annual penetration testing as part of PCI DSS compliance. This is a mandatory requirement, not a recommendation.
How Often Should You Test?
There’s no universal rule, but a practical framework covers most situations.
Annually at minimum for most organisations. This is the baseline that satisfies the majority of insurance and compliance requirements.
After significant changes: new applications deployed, major infrastructure changes, acquisitions, significant changes to network architecture. Any change that meaningfully alters your attack surface warrants a targeted test.
Before going live with a new web application or API. Pre-launch testing is significantly cheaper than post-breach remediation.
After a security incident, to validate that the access vector has been closed and no secondary footholds remain.
Regulated industries may have specific minimum frequencies. PCI DSS mandates annual testing. APRA-regulated entities should check their obligations against current guidance.
What a Pen Test Report Should Include
A useful pen test report tells you what was found, how serious it is, and exactly what to do about it. A useful one is not just a list of vulnerability IDs.
Quality reports include an executive summary that translates technical findings into business risk language, suitable for board presentation. A risk-rated finding list that prioritises by severity and exploitability, not just CVSS score. Proof-of-concept evidence for critical findings, showing the actual attack path. A remediation roadmap with specific, actionable steps.
The post-remediation retest phase is often where the most value sits. Once you’ve fixed the critical findings, having the tester verify the fixes close the vulnerability gives you documented evidence that the issues were resolved, which is what insurers and regulators want to see.
Conclusion
If you haven’t tested your defences against real attack techniques, you don’t know whether they’d hold. Gridware’s CREST-accredited penetration testing team can scope and run a test that gives you that answer.
Frequently asked questions
What is penetration testing?
Penetration testing is a controlled, authorised attempt to breach your systems using the same techniques an attacker would use. A qualified tester is given a defined scope and attempts to find and exploit vulnerabilities. The output is a report showing what was found, what an attacker could realistically do with those vulnerabilities, and a prioritised remediation roadmap.
What is the difference between penetration testing and a vulnerability assessment?
A vulnerability assessment uses automated tools to identify known weaknesses. It’s faster and cheaper, but tells you what vulnerabilities exist, not whether they can be exploited or what the real impact would be. A penetration test goes further: a skilled tester uses human judgement and attacker techniques to attempt actual exploitation, demonstrating real-world impact rather than a list of CVEs.
How much does penetration testing cost in Australia?
Pricing depends on scope, complexity, and test type. An external network pen test for a mid-market business typically ranges from $5,000 to $15,000. A web application test for a complex application is commonly $8,000 to $20,000+. Comprehensive assessments covering multiple test types cost more. The most accurate figure comes from a scoped quote based on your specific environment.
How often should a business do penetration testing?
Annually at minimum for most organisations. Also after significant changes: new applications deployed, major infrastructure changes, or acquisitions. Before going live with a new web application. After a security incident, to confirm the access vector has been closed. Regulated industries may have specific minimum frequency requirements.
Do I need penetration testing for cyber insurance in Australia?
Many underwriters now require annual penetration testing as a condition of coverage or renewal. Some factor the existence of recent testing results into their pricing. Check your policy terms, specifically the security controls questionnaire at renewal. If testing is required and you can’t provide recent results, expect questions.
Is penetration testing required for Essential Eight compliance?
Not explicitly mandated in the Essential Eight framework itself, but pen testing is frequently used as evidence that controls at ML2 and above are genuinely effective. Some assessors include testing as part of their evaluation process. It’s also required for PCI DSS compliance for organisations that handle payment card data, and increasingly expected in government procurement.
What does a penetration test report include?
A quality report includes an executive summary in non-technical language suitable for board presentation, a risk-rated finding list, proof-of-concept evidence for critical vulnerabilities, specific remediation steps for each finding, and a retest commitment to verify fixes. If the report is just a list of CVEs with CVSS scores and no remediation guidance, push back.
