Penetration Testing Delivered Worldwide as SaaS

PentestOps is delivered as SaaS, so it serves organisations globally from a single platform. Dedicated location pages cover Australia, New Zealand, Asia Pacific, Middle East, North Africa, United States and Europe, each with the local facts on offices, data residency and compliance context stated plainly rather than buried in a schedule.

PentestOps is built and operated by Extranet Systems Pty Ltd, an Australian company, with its Asia-Pacific headquarters at 77 Market Street, Wollongong NSW 2500, a Sydney office at Level 39, Suite 4, 264 George Street, Sydney NSW 2000, a Middle East office in the Seef Area of Bahrain and a North Africa office in Cairo, Egypt. Extranet Systems operates across three continents, and the platform itself is delivered as SaaS to customers worldwide.

No, and we will not pretend otherwise. Our only offices are Wollongong (headquarters), Sydney, Bahrain and Cairo. Customers in Melbourne, Brisbane, New Zealand, the United States and Europe are served remotely: the platform is SaaS, the on-premise agent installs itself inside your own network, and support is led from Australia with our Bahrain and Cairo teams extending coverage. Nobody needs to fly to your site to test it.

The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia, regardless of which region a customer is in, so cross-border data flows should be covered in your own privacy assessment wherever you are. Specific data-residency arrangements are available to Enterprise customers on request, and the Trust Centre sets out encryption, retention and access control in full.

No. Internal testing runs from an on-premise agent that you install yourself, usually in about 5 minutes. It connects outbound-only over TLS 443, needs zero inbound firewall rules, and runs scans natively on your LAN instead of tunnelling every packet in from outside. One host can cover multiple subnets, and the same agent re-sweeps your authorised ranges daily and listens for new devices in between.

Support is led from Australia, with our Bahrain and Cairo teams covering hours outside the Australian working day. Enterprise customers have 24/7 support; other plans are supported Monday to Friday, 9am to 6pm AEST, which overlaps most New Zealand business hours. Scans run on your schedule rather than ours, so change windows and after-hours testing are straightforward to arrange.

Yes. The platform serves customers across Australia, New Zealand, Asia Pacific, the Middle East, North Africa, the United States and Europe, and your assets do not have to sit in the same region as your organisation. External, web application, API and cloud testing reach whatever you are authorised to test, and cloud accounts in any region are audited the same way. What matters is authorisation: every scan runs under signed Rules of Engagement, and scope enforcement stops activity outside your authorised assets. For a complex multi-country footprint, talk to us before you scope.

They change the framing more than the technique. Australian buyers typically reference the Essential Eight, the ISM and the Privacy Act; New Zealand buyers work to the Privacy Act 2020 and often follow CERT NZ guidance; European buyers weigh GDPR; US buyers weigh state privacy law and, in healthcare, HIPAA; regulated financial entities anywhere add PCI DSS v4.0, and APRA CPS 234 for Australian institutions. Findings map to the same 8 compliance reporting frameworks in reports regardless of region, and that mapping is evidence for your assessors rather than a certification of your organisation.

It decides where your findings are stored and who operates the infrastructure holding them. Scan results, captured evidence and reports describe your most sensitive systems, and on PentestOps they stay on Australian-hosted infrastructure run by an ISO/IEC 27001:2022 certified company. For public sector, health and financial services buyers that is often the deciding factor. See penetration testing in Australia for the full picture.