Penetration testing for Australian businesses
Australian firms: answer the client security questionnaire with evidence, not a guess
A big client or your insurer wants proof your systems were tested. With your written authorisation and an agreed scope, we test them remotely, confirm what's weak, and hand you a plain report and a retest.
Served remotely from Kalamazoo, Michigan. Nothing runs until you sign the scope. We reply within one business day.
The questionnaire asks for proof you don't have yet
Big clients rely on your firm. Maybe you do their books, draft their contracts, or send engineering reports to a mine site. Then a supplier questionnaire lands. It asks your Essential Eight maturity level, and when your systems were last tested, and by whom. Your cyber insurer asked much the same at renewal.
So someone fills it in after hours, half from memory. One wrong answer could cost a panel spot or a contract that took years to win. You care about security. You just have nobody whose job is to prove it.
That's not fair on a small firm. You should be able to show what was checked and fixed, without hiring a full-time security officer.
A test you can explain to the client who asked
We've read a lot of these questionnaires. Firms that struggle with them aren't careless. They're busy with billable work. What helps is a clear scope, an honest test, and a report you can hand to the person asking.
Network Kings is a firm based in Kalamazoo, Michigan, USA, and our security work is CISSP-led. CISSP stands for Certified Information Systems Security Professional, a credential that takes years of hands-on work and a hard exam. We also hold CISM, CISA, GCIH, eCPPT, and CompTIA PenTest+, and our lead engineer has 15 years in regulated financial services. Every engagement is controlled, scoped in writing, and logged, so you can show what we did and when.
Where we fit for Australian SMEs
You won't need all four. We'll tell you straight if a test or AI is the right fix, or if something simpler would do.
Three steps from questionnaire to answer
-
Tell us who's asking and why. Send the questionnaire, the insurer form, or the client's email. We reply within one business day with a suggested scope.
-
Sign the scope, then we test. You approve in writing what we test, the dates, and what's off limits. We work remotely, and every step is logged.
-
Get a plain report and a retest. Confirmed problems come ranked by what to fix first. Once they're fixed, we test again and tell you what worked.
An economy of small firms serving big clients
Australia runs on a few huge sectors and a long tail of small firms. Around each mine sits a ring of services: engineering consultancies, labs, contractors, and the accountants and lawyers who keep them going. Health care is large and growing. Many of these firms have no security staff at all.
That matters. A big client passes its risk down the supply chain, often as a questionnaire, and small suppliers can be the easier way in. Health, finance, and professional services sit near the top of the official breach figures.
- At 30 June 2026, Australia had about 2.8 million actively trading businesses. Only about 1 million of them had employees. Source: Australian Bureau of Statistics, Counts of Australian Businesses (opens in a new tab)
- In 2024-25, mining added A$260.6 billion in value and employed 241,000 people. Professional, scientific and technical services added A$205.4 billion and employed 1.34 million. Source: Australian Bureau of Statistics, Australian Industry 2024-25 (opens in a new tab)
- The OAIC received a record 1,205 data breach notifications in 2025, most from malicious or criminal attacks. Health service providers made the most, and legal, accounting and management services were in the top five. Source: Office of the Australian Information Commissioner (opens in a new tab)
- The Privacy Act generally covers businesses with annual turnover above A$3 million, but health service providers are covered whatever their size. Source: OAIC, Small business (opens in a new tab)
The Privacy Act, the Essential Eight, and how we fit
Australia's main privacy law is the Privacy Act 1988. Its 13 Australian Privacy Principles (APPs) cover how organisations collect, use, store, and share personal information, and the Office of the Australian Information Commissioner (OAIC) enforces it. Under the Notifiable Data Breaches scheme, a breach likely to cause serious harm must be reported to the OAIC and the people affected, and you get at most 30 days to assess a suspected one. From 10 December 2026, 2024 amendments also require privacy policies to explain when software makes or supports decisions that significantly affect people.
The Essential Eight is different. It's eight security controls from the Australian Signals Directorate (ASD), such as patching, multi-factor authentication, limits on admin rights, and backups, graded in maturity levels. It's a recommended baseline, not a law. A penetration test doesn't make you Essential Eight compliant. It shows where your controls fall short, so you know what to fix first.
Before any work starts, we put in writing what data we'll touch, where it's stored and processed, and who can access it. Your lawyer or privacy officer can then judge the plan, including any data leaving Australia. Sensitive data can stay on hosting you control. We don't certify compliance; your advisers decide that.
Working across a 14 to 16 hour gap
We're on US Eastern Time. Sydney is 14 to 16 hours ahead of us, depending on daylight saving at each end. So our late afternoon is your early morning: 4 pm in Kalamazoo is 6 to 8 am the next day in Sydney. We don't work Australian business hours. We agree a meeting time when we scope the work, and the rest runs by email and shared reports.
We work in English (and Spanish), and delivery is remote first. Tests run over the internet, only with your written authorisation and inside the agreed scope. If a project calls for in-person staff training or meetings, we can travel to you. Travel and accommodation aren't in any posted price; they're quoted as a separate line.
Prices are in US dollars. Projects start from US$4,999, professional services are US$250 an hour, and managed plans are quoted to fit. You get a written quote before anything starts.
Questions from businesses in Australia
Will a penetration test make us Essential Eight compliant?
No. The Essential Eight is a set of controls you put in place and keep up. A test checks how they hold up against a real attempt to get in, and shows gaps, like unpatched software, ranked by risk. Use the report to decide what to fix and to answer your client honestly.
Our client asked for our Essential Eight maturity level. Can you give us one?
We can test how your controls hold up and show where they look weak. We don't issue a formal maturity rating. Send us your client's exact wording and we'll tell you honestly whether our work covers it.
Can you test our systems from the United States?
Yes. Testing runs over the internet, only after you sign a written authorisation and scope listing the systems, dates, and what's off limits. If something unexpected turns up, we stop and contact you.
Does sending you data mean it leaves Australia?
It can, which is why we map it first: what data we'd touch, where it would be stored, and who could see it. A penetration test usually needs very little personal information. Your lawyer or privacy officer can then judge any overseas disclosure under the Australian Privacy Principles.
How do meetings work with the time difference?
We set a regular slot that works for both sides, usually your early morning and our late afternoon. Between calls, the work runs by email and shared reports. We don't promise to work in your business hours.
What does a penetration test cost, and in what currency?
Projects start at US$4,999, and extra professional services are US$250 an hour. The price depends on how many systems are in scope, and you get a written quote first.
Send us the question you're stuck on
Forward the questionnaire, the insurer form, or the client's email. We'll reply within one business day with a suggested scope, or tell you if a test isn't what you need yet.
No cost to ask. Nothing runs until you sign a written scope.