Penetration Testing
Most pen tests end the day the report lands. Ours start there.
A pen test finds problems. Fixing them is what actually improves your security. CyberCaddy tests manually like an adversary would — then stays engaged through remediation, re-test, and sign-off. The badge tells you who’s testing. The follow-through tells you whether anything changes.
✓ Certified testers✓ Manual testing, not just automated scans✓ Remediation support included
The difference between our tests
The average firm
CyberCaddy
The test
An automated scanner
Manual, attacker-led
The handover
A PDF and an invoice
A triage walkthrough
After the report
No follow-up
Remediation support + re-test
“They found four critical vulnerabilities our previous pen tester had missed for two consecutive years. The depth of testing was immediately obvious.”
DW
David W., CFO
QLD Based Law Firm
Engagement Types
Five types of test. All manual. All attacker-led.
Every engagement is scoped to your environment and objectives. We don’t run one-size-fits-all tests.
Web Application Testing
OWASP Top 10, business logic flaws, authentication and authorisation vulnerabilities, API security. Manual testing with BURP Suite.
Request a quote →Network & Infrastructure
Internal and external network testing — privilege escalation paths, lateral movement, Active Directory attacks. Full attack chain from perimeter to domain admin.
Request a quote →Cloud Security Review
AWS, Azure, and GCP configuration review. IAM misconfiguration, publicly exposed storage, overprivileged service accounts — an attacker’s view of your cloud.
Request a quote →Social Engineering & Phishing
Targeted phishing simulations, vishing, and pretexting campaigns. Findings include training recommendations by role.
Request a quote →Red Team Operations
Full adversary simulation — objective-based, multi-vector, extended engagement. Tests your detection and response capability, not just your defences. With blue team debrief.
Request a quote →Request a scoped quote
Tell us the essentials and we'll send back a fixed-fee scope tailored to the test you need, usually within one business day.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
How It Works
A straightforward process — no ambiguity.
01
Scope
Define objectives, assets in scope, rules of engagement, and success criteria. No surprises.
02
Reconnaissance
Passive and active information gathering using the same methods your adversaries use.
03
Exploit
Controlled exploitation of identified vulnerabilities. We go as deep as agreed scope allows. Criticals escalated immediately.
04
Report
Plain-language findings with risk-rated issues, proof of exploitation, and prioritised remediation steps. Remediation support and validation that criticals are resolved.
Our testers hold certifications including
.png)
.png)
.png)
.png)
.png)
.png)
Why CyberCaddy
A pen test that ends when the report lands hasn't done its job.
Most pen tests hand you a PDF and an invoice. CyberCaddy tests manually like an adversary would — then stays engaged through remediation, re-test, and sign-off, so the vulnerabilities we find actually get closed.
Manual, attacker-led testing — not just an automated scan dressed up as a pen test
Certified testers who've done this hundreds of times — not junior staff learning on your environment
Remediation support included — we help you fix what we find, then validate it's resolved
Plain-language reporting for the board, technical detail for the team — no translation needed
What Clients Say
Straight from the people who use us.
They found four critical vulnerabilities our previous pen tester had missed for two consecutive years. The depth of testing was immediately obvious compared to what we’d had before.
DW
David W., CISO
ASX-listed technology company
Pen Testing
The two-track report was exactly what we needed. The board got a plain-language summary. The dev team got technical detail they could act on. We didn’t have to translate anything.
KL
Kate L., Head of Engineering
SaaS company — NSW
Web App Testing
They stayed engaged through our remediation phase and validated every fix. That follow-through is what separates a real pen test partner from a report vendor.
BN
Ben N., IT Director
Financial services — QLD
Network Testing
Common Questions
Straight answers.
We had a pen test last year. Why would we need another one?
Your environment changed. New features shipped, new infrastructure stood up, new people joined. A 12-month-old pen test reflects a 12-month-old attack surface. Annual testing isn’t a compliance checkbox — it’s the minimum cadence that makes any sense for a changing environment.
What’s the difference between a vulnerability scan and a pen test?
A vulnerability scan identifies known issues using automated tools. A penetration test has a human attempting to actually exploit those vulnerabilities — and finding the ones automated tools miss. A scan tells you what might be wrong. A pen test shows you what an attacker can actually do with it.
How do we know you won’t just break our production environment?
Rules of engagement are agreed in writing before we touch anything. We maintain detailed logs of every action. Critical findings are escalated immediately. Our testers operate with the discipline of practitioners who’ve done this hundreds of times — not junior staff learning on your environment.
How often should I get a pen test done?
Annually as a baseline, plus after any major change — a new application, a cloud migration, a significant infrastructure change. If you're in a regulated industry or handling sensitive data, some frameworks (PCI DSS, for instance) mandate specific intervals regardless of what changed.
What type of pen test do we actually need — network, web app, or something else?
Depends on where your risk sits. If you're a SaaS business, your application is the target. If you've got significant on-prem infrastructure, network testing matters more. Most clients need a mix — we'll scope it based on what you're actually exposed to, not sell you a generic package.
Will this disrupt our staff or operations while it's running?
Testing windows are agreed in advance, and we can schedule around business hours if disruption is a concern. Most engagements run without anyone outside IT noticing — that's the point. Denial-of-service testing, if in scope, is always explicitly called out and scheduled separately.
What do we get at the end — just a list of vulnerabilities?
A written report ranking findings by actual exploitability and business impact, not just a raw scanner output. Each finding includes what we did, what it means for you, and what to fix first. We're also available afterward to walk the technical team through it.
Do you test for social engineering, or just technical systems?
Only if it's in scope — phishing simulations, physical access attempts, and voice-based social engineering are options we can add. Some clients want the human side tested, others just want infrastructure and applications covered. We'll ask before assuming either way.
Not sure what kind of test you need?
Tell us what you’re trying to prove — compliance, genuine assurance, or a specific concern — and we’ll scope the right engagement. No upselling.
