Security Testing by Industry

The engine is the same everywhere. What changes by sector is the threat profile, which systems matter most, the regulators you answer to, and therefore what you should test first and how findings should be prioritised. The industry pages describe that context so scoping conversations start from something concrete. Read healthcare alongside manufacturing and the difference is priority and evidence, not capability.

No. Reports map findings to frameworks; they do not certify anyone. PentestOps maps findings to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes, which gives your assessors technical evidence in the language they already use. Certification or attestation is issued by an accredited auditor after their own assessment, and no testing platform can shortcut that. Extranet Systems Pty Ltd is separately ISO/IEC 27001:2022 certified, which is our certification as your vendor and says nothing about your own compliance status.

It is technical evidence. Reports include an executive summary, technical detail, captured proof for validated findings and prioritised remediation, mapped to the frameworks above, in multiple formats including PDF, CSV and JSON/API. Findings are retained for 1 year on Starter, 3 years on Professional and 7 years on Enterprise and MSP plans, with 365-day audit-log retention, so the history is there when an assessor asks how long an issue was open.

Regulatory drivers usually set cadence and evidence rather than technique. Card data environments under PCI DSS v4.0 and APRA-regulated entities working to CPS 234 tend to need regular, documented validation with a clear audit trail. Government buyers often reference the Essential Eight and the ISM and care about where data is stored. Those expectations shape your Rules of Engagement, scan schedule and retention settings, which is why all three are configured per tenant.

Yes. These pages cover the sectors we are asked about most; they are not an eligibility list. Every capability on the solutions pages is available regardless of sector, and the same asset-wise pricing applies. If you would like the sector context written up for an industry we have not covered, get in touch.

No. PentestOps tests IT: networks, applications, APIs, cloud, identity and Kubernetes. In manufacturing and similar environments we test the IT side of the IT/OT boundary, including the corporate network, remote access paths and the cloud services that touch production, and we describe OT-adjacent risk honestly instead of claiming coverage we do not have.

Every scan and exploitation attempt runs under per-tenant Rules of Engagement with scope enforcement that automatically stops activity outside authorised assets, and validated exploitation is designed to be safe and auditable: the goal is proof, not disruption. Scan profiles run from Stealth to Balanced to Aggressive so intensity matches the environment, and fragile systems can be excluded outright. The full rules of engagement are published.

The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia, which matters particularly for government and healthcare buyers. Specific data-residency arrangements are available to Enterprise customers on request, and the Trust Centre sets out encryption, access control and retention in detail.