For Australian organizations that need applications, APIs, cloud and networks tested against the ISM, the Essential Eight, APRA CPS 234 or the SOCI Act. Our testers work from Coimbatore and Chennai, India, over secure remote access. We are not CREST-accredited or IRAP assessors, so check whether your buyer or regulator requires either before engaging us.
In Australia a penetration test is rarely just a security exercise. It is evidence for a prudential standard, a critical infrastructure program, an ISM control or a customer contract, and each of those shapes what a useful test looks like.
Our testers work from Coimbatore and Chennai, India, using the methods described on our VAPT and penetration testing page. We have no Australian office and do not test on site. External, web, API and cloud testing suit remote delivery; internal network testing needs a VPN or jump host that you provide and control.
Each regime asks a different question of a test. We agree up front which ones apply, so the report answers them.
ASD's eight strategies are patching applications and operating systems, MFA, restricting admin privileges, application control, restricting Office macros, user application hardening and regular backups, rated against a maturity model last updated in November 2023. In October 2026 ASD published ASD Essentials as its successor; earlier maturity ratings do not translate automatically, and current regulatory obligations stand until regulators change them.
The ISM is ASD's advice, binding only where legislation or a direction compels it. The September 2026 edition's ISM-2118 asks for testing before deployment and at least every six months, by personnel independent of the system being assessed, whether internal or third party.
The Infosec Registered Assessors Program registers individuals to assess systems against the ISM, and only a registered assessor can perform an IRAP assessment. The ISM calls for one at least every 24 months for outsourced cloud and managed service providers. We are not IRAP assessors.
Since 1 July 2019, APRA-regulated entities must test information security controls through a systematic program, run by appropriately skilled and functionally independent specialists and reviewed at least annually. Material incidents go to APRA within 72 hours; unremediated material control weaknesses within 10 business days.
Since February 2018, a suspected breach must be assessed within 30 days, and one likely to cause serious harm notified to the OAIC and individuals as soon as practicable. The Act covers businesses above A$3 million turnover and every private health service provider. The OAIC received 667 notifications in January to June 2026, with malicious or criminal attacks the leading cause.
Critical infrastructure risk programs must follow a cyber framework such as Essential Eight Maturity Level One or ISO/IEC 27001, and rules made in 2026 raise this to Maturity Level Two for nine asset classes. Incidents with significant impact go to ASD within 12 hours, others within 72.
| Aspect | Penetration test | IRAP assessment |
|---|---|---|
| Purpose | Find and prove exploitable weaknesses in agreed targets | Assess a system's security controls against the ISM |
| Performed by | Skilled testers, internal or third party, independent of the system | An assessor registered under ASD's IRAP |
| Output | Findings with evidence, severity, fixes and retest results | An assessment report against ISM requirements |
| ISM frequency | Before deployment, before significant changes and at least six-monthly (ISM-2118) | At least every 24 months for outsourced cloud and managed service providers (ISM-1570, ISM-1793) |
| From Xcodefix | Yes, delivered remotely | No; we are not IRAP assessors |
A penetration test can give an IRAP assessor useful evidence. It never substitutes for the assessment, and a report that blurs the two helps nobody. SaaS vendors selling into the US usually need SOC 2 readiness as a separate track.
Authentication, authorization, session handling, injection and business logic, tested manually beyond what scanners report.
Object-level authorization, token handling, data exposure and rate limits, measured against the OWASP API Security Top 10.
Identity and access configuration, exposed storage and services, and paths from a low-privilege identity to sensitive data.
Internet-facing hosts, VPN gateways and remote access services, checked for exposure, outdated software and weak authentication.
Attack scenarios aimed at the controls the Essential Eight relies on: MFA bypass, escalation to admin, unpatched software. This is evidence for your program, not a formal assessment under ASD's process guide.
Manual review of security-critical code with SAST and SCA support, for flaws a black-box test cannot see.
Every engagement ends with a retest of fixed findings, so the evidence you hand APRA, a customer or your board shows closure, not just discovery. Code review follows the method of our OWASP secure code review service.
From 4 October 2026 to 4 April 2027, Sydney, Melbourne, Hobart and Canberra run on AEDT (UTC+11), five and a half hours ahead of India's UTC+5:30. Adelaide on ACDT is five hours ahead. Brisbane keeps AEST (UTC+10) all year, four and a half hours ahead, and Perth on AWST (UTC+8) is two and a half hours ahead.
A video call to agree targets, test accounts, permitted techniques, testing windows and emergency contacts, confirmed in a signed authorization before any traffic is sent.
Testing runs in the Indian working day: 10:00 a.m. in India is 3:30 p.m. in Sydney during daylight saving, 2:30 p.m. in Brisbane and 12:30 p.m. in Perth. Out-of-hours windows are possible if you approve them.
If we find something exploitable that puts data at risk, we contact your nominated person during the test instead of waiting for the report. Signs of an earlier compromise go to our incident response team.
Findings with evidence, severity, business impact and fixes, each mapped to the ISM controls, Essential Eight strategies or CPS 234 obligations you named at scoping.
A walkthrough with your engineers in the Australian afternoon, then a retest of fixed items with updated results.
Shared office hours: Taking 9:00 a.m. to 5:30 p.m. in Australia and 9:30 a.m. to 6:30 p.m. in India, Sydney shares about 2.5 hours a day under daylight saving (3:00 to 5:30 p.m. AEDT), Brisbane about 3.5 hours (2:00 to 5:30 p.m. AEST), and Perth about 5.5 hours (noon to 5:30 p.m. AWST).
Banks, insurers and super funds needing independent testing evidence for their CPS 234 program.
Clinics and health businesses covered by the Privacy Act whatever their turnover.
Teams meeting ISM testing expectations before release, with IRAP handled by a registered assessor.
Responsible entities whose SOCI risk program names Essential Eight, NIST or ISO 27001.
Firms above A$3 million turnover facing Privacy Act duties and ransomware payment reporting within 72 hours.
New applications and major releases tested before go-live rather than after an incident.
We hold no CREST accreditation and are not IRAP assessors, and we say so before scoping, so you never discover it at procurement.
Scanners find the obvious. Our testers chain weaknesses, abuse business logic and validate every finding by hand.
Testers backed by more than 60 in-house engineers explain fixes in your stack's terms, not generic advice.
Findings tied to ISM controls, Essential Eight strategies or CPS 234, so the report serves the purpose you bought it for.
Fixed findings are retested and the report updated, giving you closure evidence.
Xcodefix has delivered over 250 projects in more than 10 countries since its founding in 2008.
Tell us what needs testing, which regime the results are for and whether your buyer requires CREST or IRAP. A tester will reply within one business day with a proposed scope, testing windows in your time zone, or a clear note that we are not the right fit.
Prefer email? info@xcodefixglobal.com
Talk to the specialist who would scope the work — not a call-centre script.
Ask us directlyCost follows scope: the number of applications, APIs, user roles, cloud accounts and network ranges, plus whether code review and retesting are included. We could not verify any dependable public benchmark for Australian prices, and we do not publish ours. We quote a fixed scope after a short call, and the quote lists exactly what will and will not be tested.
CREST accredits companies that evidence its standards and certifies individual testers. Some Australian buyers and contracts require CREST-accredited providers or certified testers; others ask only for skilled, independent testers, as APRA's CPS 234 does. Check your tender, contract or regulator before you buy. Xcodefix is not CREST-accredited, so we are not an option where CREST is mandatory.
For most private businesses it is not a general legal requirement. It enters through specific regimes: SOCI Act risk management rules accept Essential Eight Maturity Level One as one of several frameworks, alongside ISO 27001 and NIST, with Level Two named for nine asset classes under 2026 rules. ASD's newer Essentials framework is in transition, so check what your regulator currently expects.
The ISM's control ISM-2118 asks for testing before a system is deployed, before significant changes and at least every six months. APRA's CPS 234 sets no fixed interval but requires testing matched to threat change, asset criticality and exposure, with the program reviewed at least annually. Many organizations also test after major releases or incidents.
No. A penetration test looks for exploitable weaknesses in specific targets. An IRAP assessment is a security control assessment against the ISM, carried out by an assessor registered under ASD's Infosec Registered Assessors Program. A test can provide evidence for an IRAP assessment but cannot replace it, and we are not IRAP assessors.
A focused test of one application and its APIs typically takes one to two weeks of testing, followed by reporting. Tests covering several applications, cloud accounts or networks take longer. We set the timeline during scoping based on targets and access, and the retest happens once your team has fixed the findings.
Yes. External, web application, API and cloud testing are remote by nature, and internal testing works through a VPN or jump host you control. Testing runs in the Indian working day, which overlaps the Australian afternoon. We have no Australian office, so if your scope needs physical or on-site testing, use a local provider.
It supports them. Since the 2024 amendments, APP 11 says the reasonable steps to protect personal information include technical and organizational measures, and regular testing with documented fixes is a clear example. Testing also lowers the chance of an eligible data breach that would need to be assessed within 30 days and notified.
