AiA

Authorized Penetration Testing

Professional offensive security — performed only with written authorization and a defined scope.

Authority first. In Australia, unauthorised access, modification or impairment of computer systems can trigger Criminal Code Act 1995 (Cth) Part 10.7 offences. Every engagement requires a signed Rules of Engagement (RoE) and written authority from the asset owner or legally empowered authorising party before testing begins. Out-of-scope activity is never performed.

Services

Web
Web Application Testing
OWASP WSTG and Top 10 baseline testing, authentication flaws, and business-logic review on in-scope domains. Baselines guide coverage; they are not proof of security.
🖧
Network & Infrastructure
Authorized internal/external assessment, segmentation review.
📱
Mobile App Review
Static + dynamic analysis of client-owned applications.
Cloud
Cloud Configuration Audit
IAM, storage, and network posture reviewed against CIS Benchmarks as consensus security recommendations, not legal compliance certifications.
People
Phishing Simulation
Consent-based awareness campaigns approved by leadership, HR/legal and relevant IT teams, with credential capture, tracking, reporting and personal-information handling defined in advance.

Methodology & Standards

PTESOWASP WSTGNIST SP 800-115 MITRE ATT&CKOSSTMMCIS Benchmarks

Each engagement follows NIST SP 800-115 discipline: planning and management approval first, then discovery, controlled execution, verification, reporting with risk-ranked findings, and agreed remediation retest. PTES, OWASP WSTG, MITRE ATT&CK, OSSTMM and CIS Benchmarks inform coverage; none are represented as complete proof of security.

Rules of Engagement Generator

Fill this in to produce a printable RoE / authorisation document. A sound RoE identifies the legal authorising party, exact targets, excluded assets, permitted techniques, test window, stop-work contact, evidence handling, reporting process and retest terms. No testing happens without a countersigned RoE.