Security, compliance & engineering · Australia and India
Ship secure. Pass audits. Scale your team.
Yearly penetration testing with an included retest, SOC 2 / ISO 27001 / Essential Eight / DPDP readiness, and engineers who can fix what we find, from one partner.
The problem
Your next customer wants proof you're secure.
Enterprise buyers send security questionnaires, ask for a recent pen test report, and want to know when you'll have SOC 2 or ISO 27001. In Australia, Essential Eight comes up with government and regulated buyers; in India, the DPDP Act raises the bar for personal data.
Deals stall in security review
Audits feel open-ended
Findings sit unfixed
What we do
Services
Penetration testing as a service
Compliance readiness
Security & Compliance Launch
AI talent & offshore teams
Custom software & SaaS
Methodology & sample report
Flagship package
Security & Compliance Launch
Everything a growing SaaS company needs for its first enterprise security review, in one fixed-scope engagement.
- Penetration test of your main application and API
- Retest after fixes, with an updated shareable report
- Gap assessment against SOC 2, ISO 27001 or Essential Eight
- Core security policy set tailored to your business
- Readiness roadmap and auditor introduction
Price: [TBD: fixed price] · Timeline: [TBD: weeks]
You walk away with
- • A pen test report and retest letter for customers
- • Policies and a control register mapped to your framework
- • A prioritised remediation backlog
- • A clear plan and timeline to audit
How it works
From scope to audit-ready
- 1
Scope
Agree targets, environments, rules of engagement and what your customers or auditors need.
- 2
Test
AI-assisted testing with Shannon, validated and extended by a human tester.
- 3
Fix
Prioritised findings with reproduction steps and fix guidance; our engineers can help.
- 4
Retest
We verify fixes and issue an updated report you can share.
- 5
Audit-ready
Policies, evidence and controls mapped to your framework, ready for your auditor.
Proof, not promises
See the work before you buy
We publish our testing methodology and a redacted sample report so you know exactly what you'll receive.
Sample redacted report
Executive summary, scope, risk ratings, findings with evidence and fix guidance, and retest status.
[TBD: link to redacted sample report PDF]
Client testimonials
[TBD: add approved client quotes]
Engineering & talent
Findings fixed by people who build software
We started as a software studio. When a test turns up issues, our engineers can fix them, or we can place a dedicated team to help you build.
Free external scan & readiness checklist
We run a non-intrusive scan of your public-facing domain and send a short summary, plus a SOC 2 / Essential Eight readiness checklist.
FAQ
Common questions
Is an AI-assisted pen test as good as a manual one?
We use Shannon, an autonomous testing tool, for coverage and speed, and a human tester validates every reported finding and probes business logic the tool can miss. Reports only include findings we have reproduced.
Do you issue SOC 2 or ISO 27001 certificates?
No. Certification and attestation are issued by independent auditors or certification bodies. We get you ready: scoping, gap assessment, policies, evidence and remediation, then support you through the audit.
Which compliance platform do you use?
We are platform-agnostic. We can work in the tool you already have, set up an open-source platform, or use ComplyKosh, our platform for India and Middle East programmes.
What do you need from us to start?
A short scoping call, written authorisation to test, test accounts for in-scope applications, and a technical contact. For compliance work, access to the people who own your systems and processes.
How much does it cost?
Pen tests and readiness projects are fixed-price after scoping. Launch package pricing is listed on its page once published.
Not sure where to start?
Book a 30-minute call. We'll look at what your customers are asking for and recommend the smallest useful next step.