Reviewed by Jaya Prakash (JP) Muthusamy, Founder and CEO of Borderless CS and Board Director, CREST ANZ | Updated October 2026
Borderless CS is an Australian penetration testing company with offices in Melbourne, Sydney, Brisbane, Canberra, Perth, Adelaide, Darwin and Hobart. Our certified consultants deliver manual pen testing of web applications, APIs, networks, cloud, mobile and AI systems for Australian organisations, with fixed quotes from $3,500, risk-rated reports and free retesting.
Organisations across Australia use our reports to pass audits, win enterprise and government contracts, satisfy insurers and reduce real cyber risk.
The key facts about working with Borderless CS
CREST ANZ and CREST International, ISO 27001:2022, SOC 2 Type II
Melbourne (head office), Sydney, Brisbane, Canberra, Perth, Adelaide, Darwin and Hobart
Web application, API, external and internal network, cloud, mobile, wireless, AI, SaaS and source code review
From $3,500 for a single web application, fixed quote after scoping
2 to 4 weeks from kick-off to final report
Manual, consultant-led by CREST and OSCP certified testers
Essential Eight, ISO 27001, PCI DSS, APRA CPS 234, SOCI Act, ISM, Privacy Act
Risk-rated report, debrief, free retesting and a Letter of Attestation
Penetration testing, also called pen testing or intrusion testing, is an authorised simulated cyber attack on your applications, networks or cloud systems. Certified testers use the same techniques as real attackers to find weaknesses, safely prove which ones can be exploited, and show you what to fix first.
Unlike an automated vulnerability scan, a penetration test is led by people. Testers chain small issues together, test business logic and confirm real impact, so you get a short list of genuine risks instead of thousands of possible ones.
In Australia, organisations use penetration testing services to meet compliance requirements, answer customer and insurer security questionnaires, prepare for audits and check new systems before they go live.
New to pen testing? Read our complete guide to penetration testing.
Who tests you matters as much as what they find. Borderless CS is independently accredited for penetration testing by CREST ANZ and CREST International, our testers hold recognised industry certifications, and our practice is directed by Jaya Prakash (JP) Muthusamy, a Board Director of CREST ANZ.
A pen test shows you where your security gaps are, how they could affect your business, and what needs to be fixed first.
The risk is real. In 2024 to 25, Australian businesses reported average cybercrime losses of $56,600 for small businesses, $97,200 for medium businesses and $202,700 for large organisations, and ASD received a cybercrime report every 6 minutes, according to the ASD Annual Cyber Threat Report 2024 to 25. A penetration test starting from $3,500 costs a small fraction of one incident.
Attackers are also getting faster. Our Q3 2026 Threat Intelligence Report notes Mandiant guidance putting mean time to exploit at minus 7 days, which means exploitation can start before a patch exists. During the quarter, ASD’s ACSC also issued alerts on active exploitation of internet-facing platforms in Australia. Testing finds these weaknesses before attackers do.
Discover security weaknesses that could provide attackers with unauthorised access to your applications, systems or sensitive information.
Understand what an attacker could achieve, which systems could be affected and where remediation should be prioritised.
Provide independent security assurance to support regulatory obligations, customer requirements and recognised security frameworks.
Use practical findings and remediation guidance to improve security controls and reduce exposure to cyber threats.
Free report | Q3 2026
What attackers targeted in Australia from July to September 2026, the Q4 forecast and a 90-day action plan.
Not sure which type of testing you need? Every organisation has a different attack surface. Here is the full range, so you can match it to your situation.
Logins, roles, sessions and business logic tested against the OWASP Top 10 and beyond.
REST and GraphQL APIs tested for broken authorisation, data exposure and abuse.
Internet-facing systems, VPNs and remote access, the first doors attackers try.
What an attacker could reach from inside, including Active Directory and lateral movement.
iOS and Android apps, local data storage and the APIs behind them.
Azure and AWS identity, storage and configuration weaknesses.
Wi-Fi security, guest isolation and rogue access points.
Manual review of code for flaws that testing alone can miss.
Prompt injection, data leakage and access control in AI-enabled products.
Ongoing monitoring and expert review between scheduled tests.
Tenant isolation and access control between customers.
Testing that supports Best Practice Software partner integration approval.
Many buyers are offered a scan when they need a pen test, or a one-off test when their systems change every week. This is how the options compare.
If you need penetration testing as a service rather than a single test, our Continuous Monitoring and Assurance service combines vulnerability monitoring, security reviews and expert analysis between scheduled penetration tests, so your assurance keeps up with your changes.
For a deeper comparison, read vulnerability scanning vs penetration testing.
Not sure where your security gaps are or which type of test you need? Talk to our team about your environment, concerns and testing requirements, and we’ll help you work out the right approach.
From defining the scope to validating the fixes, we follow a clear, documented process that stands up to audit.
We discuss your environment, testing requirements and objectives to agree on a clear scope before testing begins.
Our team gathers relevant information about the target environment to understand the attack surface and identify potential entry points.
Our consultants manually assess your systems and applications to uncover security weaknesses that automated tools may miss.
Where appropriate, identified vulnerabilities are safely tested to understand whether they can be exploited and what impact they could have.
We assess the findings, explain the risks and provide a clear report with evidence and practical recommendations for remediation.
Once fixes are applied, we retest the identified vulnerabilities to confirm they have been properly addressed.
Book a consultation with our security testing specialists today.
Penetration testing in Australia is priced on scope. A single web application test with Borderless CS starts from $3,500, and every engagement gets a fixed quote after a free scoping call, so you know the full cost before testing starts. Be cautious of very cheap quotes, which are often automated scans sold as a pentest.
Every engagement gets a fixed quote after a free scoping call. Starting prices cover a single, small scope (for example one web application with up to two user roles). Price depends on the number of applications, APIs, IP addresses, user roles and the testing approach.
Penetration testing supports most of the frameworks Australian organisations answer to. Some require it outright, and others expect evidence that your controls work.
Need the detail? Read our guides to penetration testing for compliance in Australia and APRA CPS 234 penetration testing.
We hold ourselves to the same standards we test you against.
PENETRATION TESTING ACCREDITATIONS
Our testing methodology, people and data handling are assessed by CREST, the international accreditation body for penetration testing.
Accredited testing provider
Accredited testing provider
Information security
AI management system
Health and safety
Quality management
Data protection
Security and privacy
SMB1001 Level 3
We test for government agencies and councils, healthcare and health technology, banking and finance, defence suppliers, education, SaaS and technology companies, retail and not-for-profits. Each engagement is scoped around the data you hold and the rules you answer to.
The Australian market ranges from global consultancies to IT providers that offer pen testing as a side service. Whichever penetration testing company you choose, check these seven things.
We provide penetration testing Australia-wide, and local testers mean on-site testing, face-to-face debriefs and people who understand your industry and state requirements.
Independently assessed by CREST on real-world infrastructure and web application testing.
Advanced skills in bypassing security defences and attacking hardened, well-protected networks.
Passed a 24-hour hands-on exam, compromising live systems under real attack conditions.
Broad grounding in ethical hacking tools, techniques and methodology from EC-Council.
Every engagement is led by certified penetration testers holding CREST and OSCP certifications, not junior staff running scanners. The testers who scope your engagement are the testers who run it and explain the results. Our practice is directed by Jaya Prakash (JP) Muthusamy, a Board Director of CREST ANZ.
We are also an official EC-Council partner, delivering executive cyber awareness and workforce upskilling through EC-Council’s AWARE and EC-Council Learning platforms, so the teams we test for can build the skills to stay secure.
Top 10 CREST-Accredited Penetration Testing Companies in Australia (Sep 2026) If your organisation is buying penetration testing for a tender,
Choosing Between Penetration Testing Companies in Australia? Here Is Why CREST Accreditation Should Top Your Checklist In this article What
What Is Penetration Testing? A Complete Guide for Australian Businesses If you’re searching for what is penetration testing, you’re likely
Real engagements across government, healthcare and technology. Each story covers the scope, what we found and what changed.
Government: Brimbank City Council Penetration testing of a critical web application supporting citizen portals, online payments and internal services, with a clear remediation roadmap
24/7 AI Healthcare Receptionist Grey-box web application and API testing that helped the platform meet the security requirements for Best Practice Software partner approval, alongside Cybercert Gold SMB1001 Level 3 certification.
Independent CREST-accredited penetration testing of Zalamar Tech’s applications and infrastructure, covering authentication, access control and injection risks, with prioritised remediation guidance for its technology services.
Penetration testing, also called pen testing or intrusion testing, is an authorised simulated cyber attack on your applications, networks or cloud systems. Certified testers use real attack techniques to find weaknesses, safely prove which ones can be exploited, and show you what to fix first.
Penetration testing in Australia is priced on scope. A single web application test with Borderless CS starts from $3,500, while combined application, network and cloud engagements cost more. The main cost drivers are the number of applications or IP addresses, user roles and the testing approach. Every engagement gets a fixed quote after a free scoping call.
Active testing usually takes 3 to 15 business days depending on scope. A single web application or API often takes 3 to 5 days. From kick-off to final report, most engagements take 2 to 4 weeks.
Most organisations test at least once a year, and after significant changes such as a new system, major release, cloud migration or security incident. PCI DSS requires penetration testing at least annually and after significant change.
There is no single law requiring every business to run one, but many frameworks do. PCI DSS requires it, APRA CPS 234 requires systematic testing of security controls, and government buyers, enterprise customers and insurers increasingly ask for a recent penetration test report.
A vulnerability assessment uses automated scanning to list possible weaknesses. A penetration test goes further: a certified tester manually confirms which weaknesses are real and exploitable, removes false positives and shows what an attacker could actually reach.
Penetration testing as a service, or PTaaS, provides ongoing security testing and monitoring instead of a single annual test. Borderless CS delivers this through Continuous Monitoring and Assurance, combining vulnerability monitoring, security reviews and expert analysis between scheduled penetration tests.
We offer web application, API, external network, internal network, mobile application, cloud, wireless, AI and SaaS application penetration testing, plus source code security review and testing for Best Practice Software partner approval.
An executive summary, risk-rated findings with evidence, business impact, step-by-step remediation advice and framework mapping where relevant. You also get a debrief with the testers, retesting of fixes and a Letter of Attestation.
No. Automated and AI tools are useful for finding known issues quickly, but they miss business logic flaws, broken access control and chained attacks that need human judgement. Our testers use tools to speed up the work and then confirm every finding manually.
Certified Borderless CS consultants, holding CREST and OSCP certifications, perform every test. There is no offshore testing team, and the testers who do the work also run your debrief.
External testing attacks your internet-facing systems, such as websites, VPNs and email, the way an outside attacker would. Internal testing starts from inside your network, like a compromised laptop or staff account, and shows how far an attacker could move from there.
Not when it is planned properly. Rules of engagement are agreed upfront, denial-of-service testing is excluded unless you ask for it, and riskier tests can run out of hours or against staging.
It is not mandatory, but testing helps you validate your Essential Eight controls by finding exploitable weaknesses attackers could use.
Yes. ISO 27001:2022 Annex A control 8.8 covers the management of technical vulnerabilities, and a penetration test report with retesting evidence shows auditors that vulnerabilities are being found, rated and fixed.
Yes. Many insurers ask about recent security testing when quoting or renewing a policy. A current pentest report and Letter of Attestation give clear evidence of the controls you have in place.
Check CREST accreditation, the certifications of the actual testers, how much of the testing is manual, whether retesting is included, how your data is handled and whether the price is fixed upfront. Ask for a sample report before you commit.
Yes. Borderless CS has offices in Melbourne, Sydney, Brisbane, Canberra, Perth, Adelaide, Darwin and Hobart, and tests organisations across Australia. Most application and external testing runs remotely, and on-site testing can be arranged where needed.
A penetration test tries to find as many exploitable weaknesses as possible in an agreed scope, such as an application or network. Red teaming is a longer, goal-based exercise that tests whether your people, processes and detection can stop a realistic attacker. Most organisations start with penetration testing.
Yes. Borderless CS is certified to ISO 27001:2022 and SOC 2 Type II, testing is done by our own consultants with no offshore testing team, and evidence is stored securely and only shared with your nominated contacts.
Book a free scoping call. We confirm your scope and any compliance requirements, send a fixed quote, usually within 24 hours, and can typically begin testing within a few weeks.
Penetration Testing Services Across Australia: Find Your Hidden Risks First
Borderless CS delivers manual penetration testing services to organisations across Australia, with local teams in Melbourne, Sydney, Brisbane, Canberra, Perth, Adelaide, Darwin and Hobart.
Contact Borderless CS today for a free consultation and tailored security roadmap.
100% Cybersecurity Focused Company
Free 30 Min Cybersecurity Consultation for Your Business
As a Leading Cybersecurity Company in Australia, we are offering a free 30-minute cybersecurity consultation to help evaluate potential vulnerabilities in your digital environment.