CREST ANZ Approved Company Member: CREST Penetration Testing in Australia
Cybersecurity testing is no longer just a technical exercise. Australian businesses need to understand whether their applications, networks, APIs and cloud environments could withstand realistic attacks — and they need clear evidence that security risks are being identified and addressed.
At Cyber Forte, we provide penetration testing across Australia and New Zealand. We are a CREST ANZ Approved Company Member, and our testing is delivered by CREST-certified and CREST-accredited penetration testers, recognised for their technical excellence and integrity in cyber security.
“As a CREST ANZ Approved Company Member, Cyber Forte has undergone independent, rigorous assessment of its technical capabilities, management discipline, internal controls, and ethical practices. This provides our clients — including Government and enterprise — with assurance that we meet the highest cybersecurity industry standards.” |
Our engagements combine experienced security professionals, manual testing, automated security tools and realistic attack simulations. Our focus is not simply to find vulnerabilities. We help organisations understand what those vulnerabilities mean, how they could be exploited and what should be done to reduce the risk.
Not sure where to start? Talk to our team about a tailored penetration testing capabilities statement.
Why CREST ANZ Matters for Penetration Testing
CREST ANZ is a recognised Australian and New Zealand cybersecurity organisation with an approved company assessment framework for cyber security providers. CREST ANZ Approved Company Member status provides an additional independent assurance signal for organisations evaluating cybersecurity providers.
When evaluating a provider, buyers should also consider:
- The scope of testing being proposed
- The methodology applied
- The experience of the testers
- The quality of reporting
- The provider’s ability to validate remediation
- Whether the individual testers on your engagement are CREST certified or accredited
- Independent assurance status, such as CREST ANZ Approved Company Member
For government and enterprise buyers, this independent assessment can be referenced as part of a broader supplier assurance process, including in proposals, tenders and capability statements.
Two layers of CREST assurance: the company and the testers
“CREST penetration testing” is often used loosely. In practice, buyers get the strongest assurance when two things are true:
- The company is CREST ANZ approved. The provider has been independently assessed on its technical capability, management discipline, internal controls and ethical practices.
- The testers are CREST certified or accredited. The people actually testing your systems have proven their hands-on skills through CREST examination and accreditation, not just the company they work for.
A CREST-approved company that assigns uncredentialed testers gives you only half of that assurance. At Cyber Forte, you get both. Our testers’ CREST credentials are supported by OSCP and CEH qualifications, and our team includes security-cleared professionals experienced in government and critical infrastructure environments.
Independent Accreditation: Verify Our CREST ANZ Status
Independent Accreditation
Cyber Forte’s CREST ANZ Approved Company Member status can be independently verified through CREST ANZ’s own directory of approved companies, rather than taking our word for it.
Verify Cyber Forte’s CREST ANZ Approved Company Member status
Learn more about Cyber Forte’s penetration testing capabilities
A Locally Governed Standard, Built for Australia and New Zealand
CREST ANZ is Australian incorporated and locally governed, with its own Board, accountability and priorities aligned to ANZ regulation, procurement practices and critical infrastructure needs. It was established in Australia in 2012 with the support of Commonwealth Government funding and is recognised in Australia’s 2016 Cyber Security Strategy.
What Makes Cyber Forte's Penetration Testing Different
Cyber Forte takes a practical, attacker-focused approach to penetration testing.
We combine automated tools with extensive manual testing to investigate vulnerabilities that automated scanners may not identify on their own. Our testers validate findings and, where appropriate, demonstrate realistic attack paths in a controlled manner.
Our penetration testing engagements can cover:
- External and internal networks
- Web applications
- Red Teaming
- APIs
- Cloud environments
- Mobile applications
- Firewalls and perimeter infrastructure
- Wireless and IoT environments
The objective is to provide an accurate picture of your attack surface and give your team practical information that can be used for remediation.
What You Receive
Every Cyber Forte penetration testing engagement is designed to provide both technical and management-level assurance. You receive:
- Executive summary: a plain-English overview of your risk posture for leadership and the board
- Detailed technical report: the scope, methodology and full technical findings
- Risk-rated findings: each vulnerability rated by severity (Critical, High, Medium, Low) so you know what to fix first
- Evidence and screenshots: proof of how each finding was identified and validated
- Business impact: what each finding could mean for your data, operations and customers
- Remediation recommendations: prioritised actions to reduce risk
- Technical remediation guidance: step-by-step fixes your IT and development teams can act on
- Findings walkthrough: a debrief with your technical team and management to review results and agree priorities
- Complimentary retesting: we verify your fixes once remediation is complete
- Updated report following remediation: evidence you can provide to auditors, customers and insurers
CREST vs Non-CREST Penetration Testing: What's Actually Different?
Not every “penetration test” is equal. Some are little more than automated scanner output with a logo on the cover. Others are performed by testers whose skills have never been independently verified. Here is how the options compare.
| What you get | Automated vulnerability scan | Non-CREST penetration test | Cyber Forte CREST ANZ penetration test |
|---|---|---|---|
| Human tester exploits and chains vulnerabilities | No | Sometimes | Yes, manual-led testing |
| Provider independently assessed | No | Rarely | Yes, CREST ANZ Approved Company Member |
| CREST-certified or accredited testers on your engagement | No | Varies | Yes, on every engagement |
| Security-cleared testers | No | Rarely | Yes |
| False positives removed and findings validated | No | Mostly | Yes, every finding validated |
| Board-ready executive summary | No | Sometimes | Yes |
| Mapped to ISO 27001, SOC 2, PCI DSS, Essential Eight and the ISM | No | Rarely | Yes |
| Re-test after remediation | No | Usually extra cost | Yes, complimentary |
| Fixed price agreed before work starts | Yes | Often not | Yes, quote within 24 hours |
Automated scanning has an important role in continuous vulnerability management, but it is not a substitute for a properly scoped penetration test.
How Much Does CREST Penetration Testing Cost in Australia?
The cost of a penetration test depends on scope: the number of hosts, applications, user roles, API endpoints and environments being tested. As a guide, Cyber Forte’s fixed-price engagements start from:
| Test type | Starting from (AUD, ex GST) | Typical testing duration |
|---|---|---|
| Web application penetration test | $3,500 | 3 to 5 days |
| API penetration test | Scoped by number of endpoints | 3 to 6 days |
| Cloud security assessment (AWS, Azure, GCP) | $4,500 | 4 to 7 days |
| External network penetration test | $5,000 | 5 to 10 days |
| Internal network penetration test | Scoped by sites and hosts | 5 to 8 days |
| Red team engagement | $25,000 | 2 to 4 weeks |
Watch for hidden costs. Some providers quote a low day rate, then charge separately for re-testing, report revisions or scope changes. Cyber Forte scopes every engagement upfront, provides a fixed-price quote within 24 hours and includes complimentary re-testing.
Get a fixed-price CREST penetration testing quote
Tell us what you need tested and a CREST-accredited consultant will scope your engagement and send a fixed-price proposal within 24 hours. No obligation.
Penetration Testing That Supports Compliance
Depending on the organisation, its scope and applicable requirements, security testing may support activities associated with frameworks and standards such as ISO 27001, SOC 2, PCI DSS, the Australian Government Information Security Manual (ISM) and the ACSC Essential Eight.
For organisations working towards ISO 27001 certification, penetration testing can provide useful evidence as part of a broader risk-based security programme.
For organisations assessing their security against the Essential Eight, testing can help validate whether implemented controls are working as intended and identify weaknesses that require further attention.
For businesses with payment-card environments, security testing can also support broader PCI DSS compliance activities where applicable.
Beyond a Once-a-Year Penetration Test
Technology environments change continuously.
New applications are deployed, APIs are modified, cloud configurations change, new integrations are introduced and user privileges evolve. A security assessment performed months earlier may not represent the environment today.
Cyber Forte has highlighted the importance of moving beyond a purely annual testing mindset. Penetration testing is most valuable when it is connected to an ongoing security lifecycle — test, remediate, retest and improve.
This does not mean every organisation needs the same testing frequency. The right approach depends on risk, technology changes, regulatory requirements and the nature of the environment.
When Should You Get a CREST Penetration Test?
As a practical guide, most Australian organisations should arrange a CREST penetration test:
- At least annually, as a baseline for your security programme
- Before a major release, such as a new application, customer portal or API
- After significant change, such as a cloud migration, new office network, merger or acquisition
- Before an audit or certification, including ISO 27001, SOC 2 or PCI DSS
- When a customer or tender requires it, particularly for government, critical infrastructure and financial services buyers
- After a security incident, to confirm the attack path has been closed
7 Questions to Ask Before You Hire a Penetration Testing Provider
Use these questions to compare providers and quotes. A credible provider will answer all seven clearly.
- Are you a CREST ANZ Approved Company Member? Verify this yourself on the CREST ANZ directory of approved companies before signing.
- Are the testers assigned to my engagement CREST certified or accredited? Ask for the names and credentials of the people who will actually do the work, not just the company logo.
- How much of the testing is manual? Vague answers usually mean you will receive scanner output.
- Is re-testing included? Some providers charge thousands of dollars separately to confirm your fixes.
- Will the report map to my compliance framework? ISO 27001, SOC 2, PCI DSS, Essential Eight and ISM assessors each look for different evidence.
- Will you walk us through the findings? A debrief with your technical team and management turns a report into an action plan.
- Is the price fixed before work starts? Day-rate engagements tend to grow once testing begins.
Cyber Forte answers yes to all of these. Ask us all seven questions.
Why Australian Organisations Choose Cyber Forte
Cyber Forte is an Australian-owned cybersecurity company founded in Melbourne and supporting organisations across Australia and New Zealand.
Our team brings more than 25 years of combined cybersecurity experience and has worked with organisations including ANZ Bank, CPA Australia, Origin Energy, Australia Post and Accenture.
Our penetration testing offering combines:
- CREST ANZ Approved Company Member with independently verifiable status
- CREST-certified and CREST-accredited testers on every engagement, supported by OSCP and CEH qualifications
- Security-cleared professionals experienced across government, defence and critical infrastructure environments
- Manual-led testing combined with automated tools to find what scanners miss
- Easy-to-understand, compliance-ready reports mapped to ISO 27001, SOC 2, PCI DSS, Essential Eight and the ISM
- Complimentary re-testing with an updated report once you have remediated
- Fixed-price quote within 24 hours with scope agreed before work begins
- Award-winning, Australian-owned team supporting organisations across Australia and New Zealand
- Trusted security partner supporting remediation and long-term security improvement, not just a one-off report
The result is a penetration testing engagement designed to be useful to both technical teams and management — not simply a long list of scanner output.
From Penetration Testing to End-to-End Cybersecurity
Penetration testing identifies technical weaknesses, but organisations often need broader support to manage those risks.
Our broader capabilities include:
- ISO 27001 certification and consulting
- SOC 2 compliance
- Essential Eight
- PCI DSS
- SOCI Act compliance
- iRAP
- Vulnerability management
- Security monitoring
- Digital forensics and incident response
- Dark web monitoring
This means organisations can engage one cybersecurity partner for both technical security testing and the governance, compliance and ongoing security capabilities needed to strengthen their overall security posture.
Explore Cyber Forte’s cybersecurity and compliance services.
Choose a Penetration Testing Partner That Goes Beyond the Report
A penetration test should answer more than “what vulnerabilities were found?”
It should help your organisation understand where it is exposed, how an attacker could potentially exploit those weaknesses and what should be prioritised for remediation.
Cyber Forte combines penetration testing expertise with broader cybersecurity and compliance capabilities to help Australian organisations identify vulnerabilities, strengthen controls and continuously improve their security posture.
Find your vulnerabilities before attackers do.
Request a consultation with Cyber Forte about your penetration testing requirements.
Frequently Asked Questions
Yes. Cyber Forte is a CREST ANZ Approved Company Member. This status reflects independent, rigorous assessment of our technical capabilities, management discipline, internal controls and ethical practices. CREST ANZ Approved Company Member status should not be interpreted as CREST ANZ endorsement of any particular commercial service.
Cyber Forte's CREST ANZ Approved Company Member status can be independently verified via CREST ANZ's directory of approved companies at crestaustralia.org/approved-companies.
Yes. Cyber Forte's penetration tests are delivered by CREST-certified and CREST-accredited testers, supported by other recognised qualifications including OSCP and CEH.
Cyber Forte's fixed-price engagements start from $3,500 for web application testing, $4,500 for cloud assessments, $5,000 for external network testing and $25,000 for red team engagements. Final pricing depends on scope, and complimentary re-testing is included.
Most organisations should test at least annually and after any significant change, such as a major release, cloud migration or merger. The right frequency depends on your risk profile, regulatory obligations and rate of change.
Cyber Forte provides external and internal network, web application, API, cloud, mobile, firewall, wireless and IoT penetration testing.
Penetration testing can support an organisation's wider information security and risk management programme, including activities associated with ISO 27001, the ACSC Essential Eight and the Australian Government Information Security Manual (ISM). The specific testing required depends on the organisation's scope, risks and applicable controls.
Yes. Cyber Forte provides complimentary retesting after remediation to help validate that identified vulnerabilities have been addressed.
Get a CREST ANZ penetration test quote in 24 hours
Don’t wait for an auditor, a tender panel or an attacker to find the gaps first. Book a free 30-minute scoping call with a CREST-accredited consultant. You’ll get a clear scope and a fixed price within 24 hours, with no obligation.
