Christchurch · Dunedin · Nationwide
Penetration Testing for New Zealand Businesses
Exodesk’s in-house testers carry out authorised penetration testing of your networks, web applications, Microsoft 365 and cloud services. We agree the scope first, report what we find, help fix it and arrange any retest you need.
Supporting New Zealand businesses since 1989
The short answer
What is penetration testing?
A penetration test is an authorised assessment of agreed systems or applications. Testers use tools and manual techniques to identify weaknesses and, where permitted and safe, demonstrate their impact.
The report explains what was tested, what was found and what needs attention. Penetration testing is a point-in-time assessment, not a guarantee that every vulnerability has been found or that the business cannot be breached. Findings are limited by the scope, access, methods, time and environment tested.
What we test
What can a penetration test cover?
Four areas of penetration testing, which can be combined in one engagement. Your scope names the systems, the access provided and anything excluded.
Network
External and internal network testing
External testing looks at what can be reached from the internet, such as exposed services, remote access and firewalls. Internal testing starts from an agreed position inside the network and looks at servers, permissions and how far access could spread.
Applications
Web application testing
Websites, customer portals and business applications, including logged-in user roles where agreed. Testers look for issues such as broken access control, injection flaws and session weaknesses, guided by the OWASP testing guide.
Cloud
Microsoft 365 and cloud services
Microsoft 365 and cloud security testing can include a configuration review of settings such as sign-in controls, sharing, administrative access and connected apps, and authorised testing of access paths. Your scope separates the configuration checks from any penetration testing, names the tenant or resources involved and states the permitted methods. All work follows the provider’s testing rules, such as the Microsoft security testing rules of engagement, and your permission does not override them. For ongoing protection of cloud services, see cloud security.
People
Phishing and social engineering
Scoped phishing or social engineering exercises, agreed in advance with the people who need to know. This is a different exercise from routine security awareness training, although results can inform it.
Black-box, grey-box and white-box describe how much information and access the tester is given, not separate types of test. Lateral movement, phishing and social engineering are only part of an engagement when the scope says so and, for cloud services, when the provider’s rules allow it.
Choosing the right check
Penetration testing, scanning and vulnerability management
These answer different questions and work best together.
Vulnerability scanning
Automated checks that find potential weaknesses at scale. Some scans validate particular issues.
Penetration testing
Targeted human investigation of selected systems and attack paths, including issues that automated checks can miss, within an agreed scope.
Vulnerability management
The ongoing work of prioritising and fixing weaknesses, then checking the result.
A penetration test can feed vulnerability management; it does not replace it, and neither finds everything. For a broader review of controls, see our guides to a security audit and a cyber security assessment.
Before testing starts
What goes into the scope?
No penetration testing starts until the scope is agreed and authorised in writing. The scope is also what lets you compare proposals.
- Named systems. The addresses, applications and services in scope, and anything excluded.
- Access and user roles. Whether testing is unauthenticated, or uses accounts for particular roles.
- Excluded activity. Anything the tester must not do, such as denial of service.
- Third-party permissions. Approval for systems hosted or run by someone else, under their testing rules.
- Testing windows. When testing can happen, including any out-of-hours work.
- Stop conditions and contacts. When testing pauses, and who is called if something looks wrong.
- Urgent findings. Who is told straight away about a serious issue, rather than waiting for the report.
- Sensitive data. How any personal or confidential information encountered is handled.
How it works
How does a penetration testing engagement run?
Six stages, from agreeing what is tested to confirming that fixes worked.
Scope and authorise
We agree the systems, access, exclusions, windows and contacts with you. Sign-off: is the scope authorised in writing by someone with the authority to approve it?
Prepare
Accounts and access are set up, third-party approvals confirmed, and your team told what to expect. Backups for affected systems are confirmed.
Test
Our testers work through the agreed scope using tools and manual techniques. Urgent findings go to your nominated contacts straight away.
Report and review
You receive the report, and we walk through the findings with the people who need to act on them.
Fix
Each finding gets an owner and a target date. We can carry out the remediation work on your systems, or support your team or other provider to do it. The scope and charges for remediation are agreed in the quote.
Retest
Where a retest is commissioned, we arrange it for the fixed findings, with its scope and charges agreed in the quote. A successful retest supports closure of that finding in the tested conditions; it does not certify the whole environment.
Results
What should you do with penetration testing results?
Start with the tested scope and any limitations. Review each finding’s business impact, exposure and available workarounds, then assign an owner and target date.
Escalate urgent findings immediately rather than waiting for the final report. Track remediation and agree what will be retested. Your initial report covers:
- Scope and exclusions. What was tested, how and what was left out.
- Business summary. What was found and what it means, in plain language.
- Technical findings. Each issue with supporting detail and a severity rating.
- Recommended fixes. What to change for each finding.
During the walkthrough, we agree who will act on each finding and the target dates. Where a retest is commissioned, its outcomes are recorded separately or added to the report, identifying what was retested and what remains unresolved.
Penetration testing can inform your security decisions and the reasonable safeguards the Privacy Act expects, but a report does not by itself establish compliance or meet every insurer or customer requirement. Those vary, so check what each one asks for.
Ownership
Who does what in a penetration test?
Your scope and quote set out responsibilities before testing starts.
Exodesk
Testing and follow-through
Scoping with you, testing by our in-house testers, urgent-finding escalation, the report and walkthrough, remediation work where agreed, and arranging the retest.
You
Authority and decisions
Authorising the scope, providing access and contacts, deciding how each finding is treated and accepting any remaining risk.
Third parties
Their systems, their rules
Hosting, software and cloud providers set their own testing rules, and some need notice or approval before their systems are tested.
Some customers, insurers or contracts require testing by a party independent of whoever manages your systems. Check this before scoping, because it affects who should carry out the test.
Cost
What affects penetration testing cost?
Cost depends on what needs testing and how deeply. A small set of public-facing services is a different engagement from an application with several user roles, APIs and complex workflows.
We agree the scope first, then give you a fixed quote for that scope. These are the things that move the cost of penetration testing:
- How much is in scope. The number of systems, addresses and applications.
- Depth. Unauthenticated testing, or testing as several user roles.
- Test types. Network, application, cloud and people-based testing combined or on their own.
- Reporting and review. The report, walkthrough and findings review.
- Remediation and retest. Your quote states whether a retest is included or priced separately, and how any remediation work is quoted.
When comparing proposals, compare the same scope, testing effort, reporting, findings review and retest arrangements.
Timing
When should you arrange a penetration test?
Choose a cadence based on risk, significant changes and any specific requirements that apply. An annual test may suit some organisations, but changes can justify testing sooner.
- A new customer-facing application or portal. Test before launch where practicable, and recheck after material changes. If testing has to happen after launch, agree interim controls and who accepts the remaining risk.
- Major changes. To the network, cloud environment or core systems.
- Mergers and acquisitions. When systems are joined, as covered in our guide to IT integration after an acquisition.
- After a security incident. Once the incident is contained, targeted testing can help validate remediation and check related weaknesses. Agree the timing and scope with your incident response team so testing does not disrupt investigation or recovery. A penetration test is not a substitute for incident response.
- A new requirement. From a customer, contract or insurer.
Agree whether the test is assessing your current position or validating recent fixes, and complete the preparation that suits that objective. Ongoing vulnerability management continues between tests.
Why Exodesk
Why work with Exodesk?
Testing and fixing in one place
Our in-house testers carry out the testing, and we can fix what they find and arrange the retest, so findings do not stall between providers.
Scope and price agreed first
You authorise the scope and receive a fixed quote for it before any testing starts.
Supporting businesses since 1989
Our teams in Christchurch and Dunedin work with businesses across New Zealand, alongside our wider cyber security services.
Questions
Penetration testing questions
What is penetration testing?
A penetration test is an authorised assessment of agreed systems or applications. Testers use tools and manual techniques to identify weaknesses and, where permitted and safe, demonstrate their impact. It is a point-in-time assessment, not a guarantee that every vulnerability has been found.
How is penetration testing different from a vulnerability scan?
Vulnerability scanning uses automated checks to find potential weaknesses at scale. Penetration testing investigates selected systems and attack paths in more depth, including issues that automated checks can miss. Neither finds everything, and ongoing vulnerability management is what prioritises and fixes weaknesses over time.
Who carries out the penetration testing?
Exodesk in-house testers carry out the testing. We agree the scope with you, contact your nominated people about urgent findings, can fix the issues found, and arrange the retest. If a customer or insurer requires a tester independent of your IT provider, check that before scoping.
What can Exodesk test?
We test external and internal networks, web applications including logged-in user roles, and Microsoft 365 and cloud services through configuration review and authorised access testing. We also run scoped phishing and social engineering exercises. Your scope names exactly what is included and excluded.
Will penetration testing disrupt our operations?
A well-scoped engagement is designed to avoid disruption. Testing windows, excluded activity, stop conditions and emergency contacts are agreed before testing starts. Some risk remains, which is why the scope and communication matter.
How much does penetration testing cost?
Cost depends on what needs testing and how deeply, from a small set of public-facing services to an application with several user roles and complex workflows. We agree the scope first, then give you a fixed quote for it. The quote states whether a retest is included or priced separately.
How long does a penetration test take?
Penetration testing timing depends on the systems, access and depth agreed. Your proposal sets out the preparation, testing, reporting and any retest separately, including what your team needs to provide. Confirm the schedule before committing to a customer or launch deadline.
Does every small business need a penetration test?
The case depends on exposure, sensitive information, critical applications and customer or contractual requirements. Agree whether the test is assessing your current position or validating recent fixes, and prepare to suit that objective. A focused test can be valuable, but it is not automatically the first security investment for every business.
How often should we arrange testing?
Choose a cadence based on risk, significant changes and any specific requirements that apply. An annual test may suit some organisations, but new applications or material changes can justify earlier testing. Ongoing vulnerability management continues between tests.
What do we get at the end of a penetration test?
You receive a report covering the scope and exclusions, a business summary, technical findings with supporting detail, and recommended fixes. During the walkthrough we agree who will act on each finding and the target dates. Where a retest is commissioned, its outcomes are recorded separately or added to the report, and closure applies to that finding in the tested conditions, not the whole environment.
What is the difference between penetration testing and red teaming?
A penetration test looks for weaknesses across an agreed scope. A red team exercise works towards set objectives and tests how well the business detects and responds to an attack. Who knows about the exercise depends on the rules agreed in advance.
Next step
Plan your penetration test
Tell us what you want tested and why. We agree the scope with you, then give you a fixed quote before any testing starts.
Get in touch
Discuss penetration testing
Tell us a little about the systems you want tested and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941