What makes government environments different
Few sectors carry as much technical history. A single agency can run a modern cloud-hosted citizen portal, a decade-old line-of-business application that nobody dares patch during business hours, an on-premise directory that predates the current operating model, and a network shared with entities that have since been split off or merged in.
That estate is also unusually exposed. Citizen-facing services are published deliberately, discoverable by design, and cannot be taken offline for convenience. Machinery-of-government changes move systems, staff and trust relationships between entities faster than documentation is updated. Delivery is frequently outsourced, so the real attack surface extends into suppliers and shared-services providers.
The result is a gap between what the asset register says and what is actually reachable. Testing closes that gap by attacking the estate the way an adversary would, then proving which paths work and which are theoretical.
The policy drivers behind government testing
Public sector security programmes are shaped by policy rather than by a single regulator. The Essential Eight mitigation strategies, the Information Security Manual and the Protective Security Policy Framework set direction at Commonwealth level, while states, territories and local councils layer their own obligations on top. The Privacy Act 1988 and the Notifiable Data Breaches scheme apply where personal information is involved.
Penetration testing does not satisfy any of these on its own. What it does is supply the technical evidence that policy work is usually missing: whether the controls described on paper hold up when someone actually tries them.
| Policy driver | What exploit-validated testing evidences |
|---|---|
| Essential Eight mitigation strategies | Patch currency on internet-facing and internal systems, and whether administrative privilege restrictions hold when a standard account is compromised |
| Information Security Manual and PSPF direction | Technical control effectiveness across the perimeter, internal network, applications and cloud configuration |
| Privacy Act 1988 and the NDB scheme | Which paths lead to systems holding personal information, and how far an attacker gets before detection |
| Assurance and audit programmes | Repeatable, dated findings with evidence, a 365-day audit log and retention of up to 7 years on Enterprise plans |
| Supplier and procurement questionnaires | Current findings and remediation status you can attach to a response instead of reissuing last year's report |
An honest note on the Essential Eight
PentestOps reports map findings to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes. The Essential Eight is not one of those mappings, and testing is not a maturity assessment.
Testing produces evidence relevant to several of the strategies, particularly patching and the practical limits of administrative privilege. It says nothing about backup regimes or application control policy, which need separate review. Treat the two as complementary and you will get more value from both.
Regulatory landscape
Public sector obligations arrive from policy and legislation rather than from a single regulator, and they ask for different things. The ACSC Essential Eight sets a control baseline with maturity levels, the Information Security Manual supplies the control catalogue, IRAP is how an independent assessment against that catalogue is performed, the Security of Critical Infrastructure Act places duties on responsible entities for critical infrastructure assets, and the Protective Security Policy Framework frames protective security across the entity.
Two boundaries before the table. PentestOps does not make an agency compliant with any of these, and it cannot assess Essential Eight maturity. PentestOps is also not IRAP assessed and holds no government accreditation; where a hosting or assessment requirement applies to us as a vendor, raise it early and we will tell you plainly whether we meet it.
| Obligation | What it expects of you | Evidence a security test provides |
|---|---|---|
| ACSC Essential Eight and its maturity levels | Mitigation strategies implemented to a target maturity level, with the level verified rather than assumed | Technical evidence for part of the picture: patch currency on internet-facing and internal systems, and whether restrictions on administrative privileges hold when a standard account is compromised. It is not a maturity assessment |
| Information Security Manual (ISM) | Controls selected from the catalogue, implemented, and their effectiveness assessed rather than asserted | Effectiveness evidence for the technical subset: perimeter exposure, internal segmentation, identity and privilege, and application and cloud configuration, dated per scan |
| IRAP assessment | An independent IRAP assessor evaluates the system against the ISM and records the residual risk for the authorising officer | Validated findings, evidence and remediation status the assessor can review as technical input. The assessment itself is the assessor's work, and PentestOps is not IRAP assessed |
| Security of Critical Infrastructure (SOCI) Act | A risk management programme that identifies and mitigates cyber and information security hazards to a critical infrastructure asset, and is kept current | Evidence on the cyber hazard side: which exposures are genuinely reachable across the asset in scope, re-tested as the environment changes, with drift detection in between |
| Protective Security Policy Framework (PSPF) | Security risk managed across the entity, with maturity reported annually against the core requirements | The dated technical findings behind the technology statements: what was exploitable, what has since been closed, and scan comparison between reporting cycles |
Sovereignty, hosting and the questions procurement will ask
Where the data lives is usually the first question and the one that stops most evaluations. The platform is hosted in Australia on infrastructure operated by Extranet Systems, and customer data is stored in Australia. Specific data-residency arrangements are available to Enterprise customers on request, along with an on-premise deployment option where an agency needs the platform inside its own boundary.
Every customer runs in an isolated Kubernetes namespace with its own dedicated database, so there is no shared tenant data store. Data is encrypted at rest, traffic is protected with TLS in transit, and credentials and signing keys are held in a dedicated secrets vault and injected at runtime. Role-based access control and multi-factor authentication are available on every account and required for administrators. Full detail sits in our Trust Centre.
On the vendor side, Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances, and the platform is built to SOC 2-aligned controls with a SOC 2 attestation on our roadmap. We do not claim assessments we do not hold. If your agency requires a specific hosting arrangement or third-party assessment, raise it early and we will tell you plainly whether we meet it.
How PentestOps tests a government estate
Assessments follow a seven-phase methodology aligned to PTES, OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Every scan and every exploitation attempt is tied to signed Rules of Engagement, with scope enforcement that automatically stops activity outside authorised assets.
- Perimeter. 24+ external recon modules map what the public internet can see, including services published years ago and never decommissioned. See external network testing.
- Internal network. The on-premise agent runs 18+ internal modules natively on the LAN instead of tunnelling each packet out to a remote scanner. See internal network testing.
- Identity. Active Directory testing covers enumeration, credential testing and password-policy auditing, then validates the chain from one weak credential to a full pivot.
- Citizen-facing applications. Web and API testing across OWASP Top 10 and API Top 10 risks, covering REST and GraphQL, with a live finding stream while the scan runs.
- Cloud and containers. 800+ automated checks across AWS, Azure, GCP and M365 with CIS Benchmark coverage, plus agentless Kubernetes auditing through a read-only kubeconfig.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV prioritisation, so a small team works the findings that actually matter first.
Typical use cases
Government engagements tend to fall into a handful of recognisable shapes. The common thread is that someone needs defensible evidence quickly, without a procurement cycle for every question.
- A council with a two-person IT team that owns dozens of internet-facing services and cannot fund a manual test for each one.
- Pre-go-live assurance for a new citizen-facing service, run against staging and then re-run after fixes to confirm closure.
- Coverage between annual assessments, where an independent test happens once a year but the environment changes weekly. This is the case for continuous testing.
- Post-change validation after machinery-of-government transfers, when systems, trusts and administrative accounts move between entities.
- Shared-services providers testing many entities from one platform, with isolation between each tenant.
- Supplier assurance, where a delivery partner's environment is in scope and properly authorised under the Rules of Engagement.
Why agencies choose PentestOps
- Australian-built and operated, with customer data stored in Australia and Enterprise data-residency options.
- Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances.
- Evidence-first: safe automated exploitation proves impact rather than handing over a list of theoretical severities.
- No inbound firewall rules, no VPN and no jump host to test internal networks. The agent deploys in about 5 minutes.
- Asset-wise pricing: you pay for the assets in scope, and scans against them are unlimited within fair use.
- Self-hosted AI by default, so scan data is analysed on infrastructure Extranet Systems operates rather than being sent to third-party model providers. External providers are opt-in per tenant.