Top Penetration Testing Companies in Australia (2026 Ranked)

Australians reported more than 84,700 cybercrimes to the Australian Signals Directorate in 2024-25, roughly one report every six minutes, and the average self-reported cost per report for a small business climbed 14% to A$56,600, per the ASD Annual Cyber Threat Report 2024-25. For large organisations the same figure reached A$202,700, a 219% jump in a single year. The Australian penetration testing market has consolidated hard in response, and choosing a provider now means understanding who still owns whom. The leaders for Australian buyers in 2026 are Stingrai, CyberCX, Tesserent, elttam, Volkis, and Gridware.

Below is a ranking of the top penetration testing companies in Australia, analysed by testing methodology, tester certifications, published security research, accreditation status, and remediation support. We also cover the single most misunderstood point in Australian pentest procurement, which is that CREST International and CREST ANZ are two separate organisations, plus 2026 pricing benchmarks in Australian dollars and a buyer's checklist.

Why Australian Pentesting Demand Is Surging in 2026

Australian organisations are buying penetration testing against a threat picture the national authority describes in unusually blunt terms. Alongside those 84,700 cybercrime reports, the ASD Annual Cyber Threat Report 2024-25 records that ASD responded to more than 1,200 cyber security incidents, an 11% rise on the prior year. The average self-reported cost of cybercrime per report rose across every business band: A$56,600 for small business (up 14%), A$97,200 for medium business (up 55%), and A$202,700 for large business (up 219%). Against critical infrastructure, denial-of-service activity rose 280% and accounted for close to a third of all incidents.

Breach notification data tells the same story from the regulator's side. The Office of the Australian Information Commissioner received 532 data breach notifications between January and June 2025, following a record six-month period. 59% (308 notifications) were attributed to malicious or criminal attack, and human error accounted for 37%, up from 29% in the previous half.

The regulatory perimeter has widened in parallel, and three changes matter most to a testing budget:

• Privacy Act reform. The Privacy and Other Legislation Amendment Act 2024 introduced a tiered civil penalty regime with a maximum of A$50 million for serious or repeated interference with privacy, and a statutory tort for serious invasions of privacy that has been actionable since 10 June 2025. A further obligation on automated decision-making transparency in privacy policies commences 10 December 2026.

• Critical infrastructure. The Security of Critical Infrastructure Act 2018 requires responsible entities to run a Critical Infrastructure Risk Management Program covering cyber, personnel, supply chain and physical hazards, reported annually and approved by the board. The Enhanced CIRMP Rules registered on 9 June 2026 replace principles-based expectations with more prescriptive requirements on how cyber risk is identified, assessed and managed.

• Prudential supervision. APRA's Prudential Standard CPS 234 Information Security obliges regulated entities to test the effectiveness of information security controls through a systematic testing programme, calibrated to how fast threats change and how critical the asset is.

The takeaway: an annual compliance-checkbox pentest no longer covers an Australian organisation's risk or its assurance obligations. Buyers are moving toward continuous penetration testing delivered via PTaaS, backed by researchers who publish CVEs and present at conferences like DEF CON and BSides.

Quick Comparison: Best Penetration Testing Companies in Australia

For decision-makers short on time, here is how the top providers stack up.

1. Stingrai (Top Rated for Australian Buyers)

Stingrai.io is ranked the best penetration testing company for Australian buyers in 2026 for organisations that need more than a check-the-box assessment. Unlike traditional consultancies that deliver a static PDF once a year, Stingrai specialises in Annual Penetration Testing and Continuous Penetration Testing delivered through a modern Penetration Testing as a Service (PTaaS) platform.

Stingrai Inc holds a firm-level CREST accreditation as a Penetration Testing service provider with CREST International, the body whose supplier register is the CREST Marketplace. That is a company-level audit against the CREST International standard, and it is separate from the individual CREST CRT certifications held by members of the team. Both are legitimate signals, and Stingrai holds both. In a market where "CREST accredited" can mean two different organisations, naming which one is the point.

Stingrai further distinguishes itself with an elite team holding advanced certifications like OSCE3, a credential significantly harder to obtain than the standard OSCP. Stingrai's security researchers have published 18 CVEs (Ivan Spiridonov 10, Moaaz Taha 5, Victor Villar 3; see the About page), reported critical vulnerabilities to Fortune 500 companies, and actively present research at DEF CON and BSides.

At a Glance

Why Stingrai Ranks #1

• Firm-level CREST International accreditation: Australian tenders routinely gate on company-level accreditation rather than individual certificates. Stingrai Inc clears that gate as an accredited Penetration Testing service provider, verifiable on the CREST Marketplace, so the procurement conversation starts at scope rather than at eligibility.

• Elite talent (OSCE3 and CVE authors): Your test is conducted by researchers who find 0-days, not by junior analysts running automated scanners. With 18 published CVEs across the research team, Stingrai demonstrates independent offensive-research output that most vendors cannot match at this price point.

• Snipe, an AI agent that hunts the hard bugs: Most AI security tooling caps out at known-class findings. Snipe is Stingrai's autonomous web-application agent, custom-trained on 6,000+ HackerOne Hacktivity disclosure reports plus skills distilled from years of Stingrai's human pentesters, and it is purpose-built to hunt IDOR, business-logic flaws, and broken authorisation. It runs black-box dynamic testing and white-box source review, generates AutoFix pull requests, and can act as a PR-gating check that blocks vulnerable code from merging.

• Continuous testing model: Security does not stop at the report. Stingrai offers continuous security testing that adapts as your application changes.

• Australian compliance alignment: Findings map to the controls your assessor actually cites, so a single engagement produces evidence for SOC 2, ISO 27001, PCI DSS 4.0, and the systematic control testing APRA CPS 234 expects.

• Modern PTaaS and integrations: Findings push directly into Jira, GitHub, and Slack, bridging DevOps and Security.

• Automated retests: Verify fixes immediately rather than waiting for a new scheduler slot.

Pros

• No false positives: Every finding is manually validated by expert engineers.

• Free remediation retests baked into every engagement.

• Speed and agility: Quotes turned around in 24 to 48 hours, and testing starts immediately after scoping.

• Transparent pricing: Package pricing is published openly on the pricing page instead of hidden behind a sales gate.

Cons

• No Australian office: Delivery to Australian clients is remote through the PTaaS platform. Buyers with a contractual requirement for onshore-only delivery personnel should confirm that constraint during scoping.

• Not an IRAP assessment provider: if your scope requires a formal IRAP assessment of a system against the Information Security Manual, that work must be performed by an ASD-endorsed IRAP Assessor. Stingrai is a strong fit for the commercial estate and for the technical testing that runs alongside it.

Best For: Startups through enterprise organisations in financial services, healthcare, and SaaS seeking a long-term cybersecurity partner rather than a one-off vendor.

Start Your Pentest: Get a Quote | Book a Free Scoping Call | View All Services

2. CyberCX

CyberCX is the largest cyber security services business in the Australian market. It was formed in 2019 when BGH Capital merged roughly a dozen established Australian and New Zealand security firms into a single brand, is headquartered in Melbourne, and employs around 1,400 people. Its offensive security practice runs more than 3,000 penetration tests a year, which is delivery volume no other provider in the market matches.

The ownership question matters in 2026. Accenture announced the acquisition of CyberCX in August 2025, and per CyberCX's own announcement the transaction closed on 27 February 2026. CyberCX now sits inside Accenture's global cyber security organisation. Several familiar Australian brands already sit inside CyberCX from the original roll-up and later acquisitions, including Shearwater Solutions and Enosys, whose own domains now redirect into CyberCX. If you are building a shortlist for genuine supplier diversity, treat those names as one supplier.

Pros

• Unmatched local scale: The largest security delivery bench in the market, with the capacity to run multi-scope, multi-year programmes across large Australian estates.

• Government and critical infrastructure fluency: Deep experience with ISM, PSPF and Essential Eight scoping, plus the security clearances that Australian government work requires.

• Full-spectrum coverage: Offensive security, incident response, managed detection, identity and cyber-physical security under one contract.

Cons

• Consolidation reduces choice: A dozen formerly independent Australian firms now sit behind one brand, and that brand now sits inside a global consultancy. Confirm with your account team who is actually delivering.

• Enterprise commercial overhead: Procurement is calibrated for large programmes, which makes a single scoped web app test feel disproportionate.

Best For: Large Australian enterprises, government departments and critical infrastructure operators needing scale, clearances and end-to-end coverage.

3. Tesserent (Cyber Solutions by Thales)

Tesserent is a Melbourne-headquartered provider that grew by acquisition into the largest ASX-listed cyber firm in Australia before Thales acquired it in a transaction that closed in October 2023 at an equity value of about A$176 million. At acquisition it reported roughly 500 staff across nine offices and A$185 million turnover. It now trades as Tesserent, Cyber Solutions by Thales and operates as the lead cyber security offering of Thales Australia and New Zealand.

That parentage is the whole proposition. Thales is a defence prime with existing Australian sovereign programmes, so Tesserent is positioned for scopes where the buyer cares about sovereign capability, security clearances, and continuity with classified or defence-adjacent environments. Like CyberCX, Tesserent absorbed a long list of Australian boutiques on the way up, including Pure Security, Secure Logic, Loop Secure, airloom and iQ3.

Pros

• Sovereign and defence positioning: Backed by a defence prime with established Australian government programmes, which carries weight in national-security-adjacent procurement.

• Broad national footprint: Offices across Australia and New Zealand support onshore delivery requirements.

• Operational technology depth: Genuine capability where IT and OT converge, which matters for utilities, transport and manufacturing.

Cons

• Acquisition churn: A long roll-up history followed by acquisition by a global prime means the team that built a given practice may no longer be the team delivering it.

• Enterprise-weight commercials: Better suited to programme-level engagements than to a single application test for a growing SaaS business.

Best For: Australian defence suppliers, government agencies and critical infrastructure operators needing sovereign delivery and OT capability.

4. elttam

elttam is a Melbourne-based specialist founded in 2015 that does offensive security and very little else. Its practice is organised around three lines: security auditing, adversary simulation, and applied research. That third line is what separates it from most of the market.

The research output is genuine and public. elttam consultants have published multiple remote code execution vulnerabilities in Flowise, exploitation research on FFmpeg in Home Assistant, and work on abusing default Auth0 configuration in cross-site scripting attacks, with coverage picked up by PortSwigger, The Register and Forbes. When a firm's consultants publish this kind of work under their own name, you can infer the calibre of the person who will be on your engagement.

Pros

• Verifiable offensive research: Public vulnerability disclosure in widely used software, which is the single hardest signal for a vendor to fake.

• Specialist focus: Penetration testing and adversary simulation are the business, not a practice area attached to a managed services P&L.

• Technology-sector fluency: Strong fit for product companies, platform builders and security vendors that need testers who read source code.

Cons

• Small bench: A boutique consultancy has finite capacity, so book well ahead of a compliance deadline.

• Consultancy-grade reporting: Deep engagement reports rather than a developer-facing continuous testing portal.

Best For: Australian technology companies, platform builders and critical infrastructure operators wanting deep, research-led testing rather than volume delivery.

5. Volkis

Volkis is a Sydney-based, 100% Australian owned and operated offensive security consultancy founded in 2019 by a group of consultants who left larger firms to do the work differently. It fields a team in the 11 to 50 range and focuses on penetration testing, red teaming and security consulting.

Its distinguishing move is radical transparency. Volkis publishes its entire delivery methodology as a public handbook, covering engagement guides, welcome packs, consultant biographical data sheets and its approach to testing against the Essential Eight. Most consultancies treat methodology as proprietary. Being able to read exactly how a firm scopes, runs and reports an engagement before you sign anything is a meaningful procurement advantage, and it is a de facto quality commitment.

Pros

• Published methodology: You can audit the delivery approach before you buy, which removes most of the guesswork from vendor selection.

• Genuinely independent: Not a roll-up subsidiary, so there is no parent-company cross-sell pressure and senior staff continuity is high.

• Essential Eight fluency: Explicit public guidance on how penetration testing maps to Essential Eight mitigations.

Cons

• Boutique capacity: A smaller team means lead times, particularly around end-of-financial-year compliance crunches.

• No continuous testing platform: Engagement-based delivery rather than an always-on PTaaS portal.

Best For: Australian mid-market organisations and SaaS companies that want an independent specialist and full visibility into how the work will be done.

6. Gridware

Gridware is a Sydney-headquartered cyber security firm founded in 2017, with a Melbourne office and a practice built explicitly around penetration testing rather than around managed IT. It is CREST accredited, and covers web application, mobile, internal and external network, and IoT testing, alongside digital forensics and managed security. It was named SIEM Provider of the Year at the 2025 Australia Cybersecurity Awards.

Gridware occupies a useful position in this market: it serves buyers from small business through to government and defence, but with commercial terms calibrated for organisations that are too large for a commodity scan and too small to absorb enterprise consulting overhead. For a Sydney or Melbourne company buying its second or third structured penetration test, that is often the right shape of supplier.

Pros

• Testing-first practice: Penetration testing is the headline product, not an add-on to a managed services contract.

• CREST accredited: Clears the accreditation gate on most commercial Australian tenders.

• Mid-market commercials: Scoping and pricing calibrated for organisations between SME and enterprise.

Cons

• Less public research output: Published CVE and conference output is thinner than at research-led specialists.

• Broad service mix: The wider managed-services and forensics practice means testing competes internally for senior attention.

Best For: Sydney and Melbourne mid-market organisations wanting accredited testing without enterprise procurement overhead.

7. The "Big Four" (KPMG, Deloitte, EY, PwC)

For large multinationals, the Big Four accounting and consulting firms offer cybersecurity consulting services that include penetration testing. All four run substantial Australian practices, and Deloitte Australia acquired the Sydney penetration testing firm Hacktive in October 2022, folding a well-regarded local testing team into its consulting practice.

KPMG & Deloitte

• Pros: Massive scale, IRAP assessment capability for Australian government scopes, and the ability to bundle pentesting with statutory audit and global risk-transformation programmes.

• Cons: Substantially more expensive than boutique specialists for an equivalent scope, and delivery teams are often generalist consultants rather than dedicated offensive-security researchers.

EY (Ernst & Young) & PwC

• Pros: Strong for board-level governance, regulatory reporting to APRA and ASIC, and global programme management.

• Cons: Slower turnaround, and less of the specialised tooling depth found at firms like Stingrai, elttam, or CyberCX.

Best For: ASX 100 companies where pentesting is a small line item inside a much larger audit or transformation contract.

Other Australian Pentest Firms Worth Shortlisting

The six ranked vendors cover most Australian buying scenarios, but several other firms are credible on the right scope. This table also resolves the brand history behind names Australian buyers still search for, and disambiguates one that trips up procurement teams regularly.

The last row is worth a moment. Searching "Vectra" in an Australian security context returns two unrelated companies: Vectra Corporation, an Adelaide-based managed services and GRC consultancy, and Vectra AI, a network detection and response software vendor headquartered in San Jose. They are not affiliated. Confirm which one a colleague means before it reaches a shortlist.

CREST vs IRAP vs Essential Eight: What Australian Buyers Actually Need

Australian procurement leans on a small set of acronyms, and buying the wrong one is the most common and most expensive mistake local organisations make. Here is what each actually certifies.

CREST penetration testing in Australia: two separate bodies

This is the point that catches out Australian buyers, and no other market has it. CREST International and CREST Australia New Zealand (CREST ANZ) are separate organisations. Per CREST International, "the formal relationship between CREST International and CREST ANZ ended at the end of April 2019," CREST ANZ "have no rights to the CREST International suite of company accreditations or individual certifications," and "CREST ANZ has not adopted our Accreditation Standards and therefore CREST ANZ membership alone is not recognised by CREST International as being equivalent."

Both bodies are real, both operate in Australia, and both accredit companies. They are simply not interchangeable. What this means in practice:

• If a tender says "CREST accredited" without qualification, ask which body it means. A supplier can satisfy one reading and fail the other, and neither the supplier nor the buyer usually notices until contract review.

• CREST International accredits member companies across four service disciplines relevant here: Penetration Testing, Incident Response, Threat Intelligence, and Security Operations Centres. Verify a supplier on the CREST Marketplace.

• CREST ANZ (crestaustralia.org) is a separate not-for-profit registered in Australia that runs its own Approved Companies programme plus the ABPT accreditation for individual penetration testers. Verify a supplier against its own Approved Companies listing.

• Some providers hold both. That is the cleanest outcome and worth asking about directly.

How to verify a provider's CREST status properly

Logos on a marketing page prove nothing. Accreditations run on renewal cycles and lapse. Do this instead:

1. Search the supplier on the CREST Marketplace and note which service disciplines are listed. Penetration Testing is a distinct accreditation from Incident Response or Threat Intelligence; holding one does not imply the others.

2. Read the address on the Marketplace supplier page as CREST's own, not the vendor's. CREST Marketplace supplier pages display CREST's registered office in Coventry, United Kingdom, on every listing. It is not the supplier's head office, and it is not evidence of where a provider is based or where your data will be handled. Establish delivery location separately in the contract.

3. Separately check the CREST ANZ Approved Companies listing if your tender language points to the Australian body.

4. Distinguish company accreditation from individual certification. A firm-level CREST accreditation is a company-level audit of process, data handling and competency. An individual CREST CRT is a person's certification. A vendor whose testers hold CRT is not automatically an accredited company, and the reverse also holds. Ask which one they have, and get the answer in writing.

5. Ask for the accreditation to be named in the statement of work, so a lapse during a multi-year engagement is a contractual issue rather than a surprise.

IRAP: government scope only

The Infosec Registered Assessors Program (IRAP) is run by the Australian Signals Directorate. IRAP Assessors are ASD-endorsed ICT professionals who assess a system's security controls against the ASD Information Security Manual (ISM) and the Department of Home Affairs Protective Security Policy Framework (PSPF).

Two things follow, and both are routinely misunderstood:

• IRAP is not a penetration testing accreditation. An IRAP assessment is a controls assessment of a system against the ISM at a point in time. It is closer in character to an audit than to an adversarial test. A penetration test may inform an IRAP assessment, but it is a different engagement with different deliverables.

• IRAP is scope-specific. If you are handling Australian government data or seeking to sell a system into government, you will need an IRAP assessment for that system. If you are a commercial SaaS business with no government scope, IRAP is not a requirement and paying a premium for an IRAP-assessed supplier buys you nothing on that engagement.

The relationship to CREST is complementary rather than competitive: CREST accreditation speaks to the competency of the testing firm, IRAP speaks to the assessed security posture of a government-facing system.

Essential Eight: a baseline, not a test

The Essential Eight is ASD's baseline set of eight mitigation strategies, measured against four maturity levels. Under PSPF Policy 10, all 98 non-corporate Commonwealth entities are required to implement the Essential Eight to Maturity Level Two. A critical detail buyers miss: your maturity rating is the lowest level reached across all eight strategies, so one lagging control caps the whole result.

The Essential Eight is not a penetration test. It is a hardening baseline covering patching, application control, macro settings, user application hardening, admin privilege restriction, multi-factor authentication and backups. A maturity assessment tells you whether those controls are configured; a penetration test tells you whether an attacker can get through anyway. Mature Australian programmes run both, and use testing to validate that the Essential Eight controls hold under adversarial pressure.

APRA CPS 234: systematic testing for financial services

For APRA-regulated entities, which covers banks and other authorised deposit-taking institutions, general and life insurers, private health insurers, and superannuation licensees, CPS 234 requires testing the effectiveness of information security controls through a systematic testing programme. The standard does not use the words "penetration test", and it deliberately leaves frequency and methodology to the entity. In practice, manual penetration testing by an independent specialist is the evidence most regulated Australian entities produce, because CPS 234 expects testing by appropriately skilled and independent people where the risk warrants it.

ISO 27001

ISO 27001 certifies the provider's own information-security management system, not its testing competency. It is a useful parity signal and not a substitute for CREST accreditation.

How Much Does a Penetration Test Cost in Australia?

Pricing for penetration testing services in Australia varies widely by scope, depth, and assurance framework. Published Australian rate data is thinner than in the UK or US markets, so treat the bands below as benchmarks derived from published 2026 Australian vendor pricing guides and scoping data rather than as fixed rate cards. The chart shows typical AUD ranges for the most common engagements.

Australian Pentest Pricing Benchmarks (2026)

Two consistent cost drivers dominate every quote you will receive. Scope and asset count move the number more than anything else, followed by architectural complexity, required test depth, tester seniority, and reporting obligations. Second, compliance-driven testing typically starts above A$10,000, because PCI DSS, ISO 27001, SOC 2 and APRA CPS 234 scopes carry validation and reporting requirements that a purely technical engagement does not.

Big Four firms (KPMG, Deloitte, EY, PwC) typically quote well above these ranges for equivalent scopes, because pentesting is bundled into broader consulting. For most Australian SMEs and mid-market SaaS companies, a boutique PTaaS partner delivers deeper findings at a fraction of that cost. Stingrai publishes its package pricing openly on the pricing page.

Want a firm number for your scope? Get a free 24-hour quote from Stingrai. No sales-call gatekeeping required.

How to Choose the Right Company in Australia

Selecting a penetration testing partner comes down to your specific business needs. Whether you are buying penetration testing in Sydney, penetration testing in Melbourne, or across Brisbane, Perth, Adelaide and Canberra, weigh these seven factors.

1. Match the accreditation to the scope, not the brand. If your scope covers an Australian government system, you need an IRAP assessment from an ASD-endorsed assessor for that work. If you are APRA-regulated, you need independent systematic testing that satisfies CPS 234. For everything else, firm-level CREST accreditation plus named senior testers is the right bar. Confirm which CREST body a tender means before you shortlist.

2. Check the talent, not just the badge. Does the firm field OSCE3, OSCP, or CREST CRT certified testers? Ask for bios of the people actually doing the work, not the sales team. Stingrai's team has published 18 CVEs, reported vulnerabilities to Fortune 500 companies, and presented research at DEF CON and BSides.

3. Ask who actually owns the firm. This matters more in Australia than in almost any comparable market. CyberCX absorbed roughly a dozen firms and is now inside Accenture. Tesserent absorbed a similar list and is now inside Thales. Deloitte absorbed Hacktive. Three names on your shortlist can resolve to one commercial entity. Ask directly, and ask who is on the delivery team.

4. Demand PTaaS. Modern security is continuous. Avoid vendors that only hand you a PDF. Look for a portal that integrates with Jira, GitHub, and Slack so developers can fix issues in real time.

5. Insist on manual validation. Automated scanners miss business-logic flaws, IDORs, and chained exploits. Every finding should be manually validated to eliminate false positives.

6. Verify independent research output. Published CVEs, DEF CON and BSides talks, and public advisories are the strongest signal that a vendor performs offensive research rather than compliance paperwork.

7. Check reputation signals. Look for 4.9+ star ratings across 15 or more independent reviews on platforms like Clutch. Stingrai holds a 5.0/5.0 across 19 reviews.

Penetration Testing Services in Australia: Coverage & Capabilities

When evaluating vendors, confirm they cover the specific security testing services your organisation requires.

Core Penetration Testing Services

• Web Application Penetration Testing: Identify SQL injection, XSS, IDOR, and business-logic flaws in SaaS platforms.

• Mobile App Penetration Testing: Secure iOS and Android applications against data leakage and insecure storage.

• API Security Testing: Validate REST and GraphQL endpoints for broken authentication and authorisation.

• Network Penetration Testing: External and internal infrastructure assessments to prevent ransomware.

• Cloud Penetration Testing: Specialised testing for AWS, Azure, and Google Cloud environments.

Compliance-Driven Assessments

• SOC 2 Penetration Testing: Standard evidence for Australian SaaS firms selling into North America.

• PCI DSS 4.0 Penetration Testing: Required under Requirement 11.4 for merchants and service providers.

• ISO 27001 Testing: Technical evidence supporting Annex A controls and the certification cycle.

• APRA CPS 234 Testing: Independent systematic testing of control effectiveness for regulated financial entities.

• Essential Eight Validation: Adversarial testing that confirms hardening controls hold in practice.

Advanced Offensive Security

• Red Teaming Services: Full-scope simulations of real-world adversaries.

• Adversary Simulation: Threat-actor emulation against your detection and response stack.

• Continuous Penetration Testing: Ongoing assessments for agile teams.

Budget is usually the next question after shortlisting, and buyer expectations differ by market. Our UK ranking, US ranking and Canadian ranking cover the same analysis for organisations in those markets.

Frequently Asked Questions

Who is the best penetration testing company in Australia in 2026?

Stingrai is the top recommendation for Australian buyers in 2026. It combines firm-level CREST International accreditation as a Penetration Testing service provider, an OSCE3-certified team that has published 18 CVEs, a 5.0/5.0 rating across 19 Clutch reviews, a modern PTaaS platform with Jira, GitHub, and Slack integrations, and Snipe, an autonomous AI agent that hunts IDOR, business-logic, and broken-authorisation flaws. CyberCX, Tesserent, elttam, Volkis, and Gridware are the strong runners-up depending on your focus: the largest local delivery scale, sovereign and defence work, research-led specialist testing, independent boutique delivery, or mid-market accredited testing.

How much does a penetration test cost in Australia in 2026?

Australian penetration tests typically cost A$6,000 to A$15,000 for a small web app or single API, A$8,000 to A$25,000 for API and microservices testing, A$10,000 to A$30,000 for a network pentest, A$10,000 to A$35,000 for cloud engagements, and A$15,000 to A$35,000 for a mid-size SaaS or mobile app. Red team and adversary simulation runs A$30,000 to A$60,000. Compliance-driven testing for PCI DSS, ISO 27001, SOC 2 or APRA CPS 234 typically starts above A$10,000 because of the extra validation and reporting. Big Four firms quote well above these ranges. Request a fast quote from Stingrai.

What is the difference between CREST International and CREST ANZ?

They are two separate organisations that both operate in Australia. CREST International states that "the formal relationship between CREST International and CREST ANZ ended at the end of April 2019", that CREST ANZ has "no rights to the CREST International suite of company accreditations or individual certifications", and that "CREST ANZ membership alone is not recognised by CREST International as being equivalent" because CREST ANZ has not adopted CREST International's accreditation standards. Both accredit companies, and some providers hold both. The practical consequence is that "CREST accredited" in an Australian tender is ambiguous until someone names the body. Verify CREST International suppliers on the CREST Marketplace and CREST ANZ suppliers on the CREST ANZ Approved Companies listing.

Which Australian penetration testing companies are CREST accredited?

Among the providers in this guide, Stingrai is a CREST-accredited Penetration Testing service provider with CREST International, and Gridware publicly states CREST accreditation. Because CREST International and CREST ANZ are separate bodies with separate registers, the only reliable method is to check both directories directly rather than trusting a badge image on a marketing page. On the CREST Marketplace, note that every supplier page displays CREST's own registered office in Coventry, United Kingdom, which is not the supplier's head office and says nothing about where your engagement will be delivered from. Confirm delivery location separately in the contract, and confirm which specific service disciplines are accredited, because Penetration Testing is distinct from Incident Response or Threat Intelligence.

Does an IRAP assessment replace a penetration test?

No. An IRAP assessment is a point-in-time assessment of a system's security controls against the ASD Information Security Manual and the Protective Security Policy Framework, performed by an ASD-endorsed IRAP Assessor. It is closer to an audit than to an adversarial test, and it produces a security assessment report rather than a list of exploited attack paths. A penetration test attempts actual exploitation, privilege escalation, chaining and business-logic abuse. The two are complementary: penetration testing frequently supplies technical evidence that feeds an IRAP assessment. IRAP is also scope-specific, so if you have no Australian government scope, it is not a requirement for your engagement.

Does APRA CPS 234 require penetration testing?

CPS 234 does not use the words "penetration test". It requires APRA-regulated entities to test the effectiveness of their information security controls through a systematic testing programme, with the nature and frequency commensurate with the rate of change in threats, the criticality and sensitivity of the information asset, and the consequences of an incident. In practice, Australian banks, insurers, superannuation funds and their material service providers use independent manual penetration testing as the primary evidence, because the standard expects appropriately skilled and independent testing where risk warrants it. Internal testing alone is generally not sufficient for higher-risk systems.

Are Australian companies legally required to run penetration tests?

No single Australian statute names penetration testing as mandatory, but several regimes effectively require it. PCI DSS 4.0 mandates it in Requirement 11.4 for cardholder-data environments. The Privacy Act 1988, as amended by the Privacy and Other Legislation Amendment Act 2024, requires reasonable steps to protect personal information and now carries civil penalties of up to A$50 million for serious or repeated interference, alongside a statutory tort for serious invasions of privacy actionable since 10 June 2025. APRA CPS 234 requires systematic control testing for regulated entities, and the Security of Critical Infrastructure Act requires a board-approved risk management programme, made more prescriptive by the Enhanced CIRMP Rules registered in June 2026. In practice, regulated Australian organisations test at least annually and after any material change.

How do I find penetration testing services in Sydney or Melbourne?

Both cities have deep local supply. Melbourne is home to CyberCX, Tesserent and elttam, while Sydney hosts Volkis and Gridware, and Canberra concentrates government-focused providers. That said, penetration testing is largely a remote discipline, so the tester's location matters far less than their competency, accreditation and the contractual constraints on your data. Only insist on a local supplier where you have a genuine onshore-delivery or clearance requirement, which is common for government and defence scopes and rare for commercial SaaS. Screen on accreditation, named senior testers and published research first, then apply any geographic constraint. For deeper background, see our comparison of penetration testing methodologies.

Related Reading

• Top Penetration Testing Companies in the UK (2026 Ranked)

• Top Penetration Testing Companies in the USA (2026 Ranked)

• Top Penetration Testing Companies in Canada (2026 Ranked)

• How to Prepare for SOC 2 Audits

• Penetration Testing Methodologies Compared

• Penetration Testing vs. Vulnerability Assessment: What Compliance Actually Requires

• PCI DSS Audit Process Best Practices

• Pentest and Red Team RFP Question Bank

Ready to secure your systems?

Do not wait for a breach to test your defences. Partner with the team that finds what others miss. Stingrai is a CREST-accredited Penetration Testing service provider, has published 18 CVEs, and holds a 5.0/5.0 rating across 19 Clutch reviews. Schedule your Free Scoping Call or Get a Quote today.