How PentestOps works across Asia-Pacific
PentestOps is delivered from inside the region it serves. Our Asia-Pacific headquarters sits in Wollongong, on the New South Wales coast, with a Sydney office covering sales and operations. Beyond those two Australian offices we have no other office anywhere in Asia-Pacific: no Singapore desk, no Tokyo presence, no Hong Kong or Mumbai branch. Organisations across Southeast Asia, North Asia and South Asia, in markets such as Singapore, Hong Kong, Japan and India, are served remotely as software from that Australian base. Australia and New Zealand have their own dedicated pages; this page covers the wider region, see Australia and New Zealand for those markets specifically.
That works because testing happens over the network rather than in a meeting room. External testing runs with no agent at all. Internal testing uses an on-premise agent your own team installs as a Docker container, RPM or DEB package in about 5 minutes, connecting outbound-only over TLS 443 with 0 inbound firewall rules and no VPN. One host can cover multiple subnets, which suits a group with sites spread across several countries in the region.
What you lose by not having a local office in your own city is someone who can sit in your building. What you gain is one platform and one methodology across every country you operate in, rather than a different local vendor and a different report format per market. Decide which of those matters more to your programme before you shortlist us.
Where your data goes, stated plainly
The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia for every customer in this region, regardless of whether Extranet Systems has a local office where you operate. For an organisation based in Singapore, Hong Kong, Tokyo or Mumbai, that means scan results, asset inventory, findings, evidence and reports relating to your estate are held outside your home jurisdiction.
We flag this rather than leaving it in a schedule at the back of a contract, because it is a decision your privacy officer and your procurement team should make deliberately. Asia-Pacific privacy law is not one regime: Singapore's PDPA and Japan's APPI are two real, distinct examples, and other markets in the region run their own frameworks again. We cannot give you legal advice about your own obligations under any of them, and we will not tell you the arrangement is automatically fine. Take your own advice, using the facts on this page and in our Trust Centre.
The supporting detail: Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances. The platform is built to SOC 2-aligned controls, and a SOC 2 attestation is on our roadmap. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, traffic is protected with TLS in transit, and audit logs are retained for 365 days. You are the data controller and Extranet Systems is the data processor; a signable DPA is available to customers on request. Enterprise customers can request specific data-residency arrangements, or the on-premise deployment option that keeps scan data inside your own boundary.
Support access to that data is not limited to Australian staff either. Extranet Systems also operates teams in Bahrain and Cairo who can access platform data as part of delivering support, a fact disclosed in full in our Trust Centre. Data is stored in Australia; it is not accessed only from Australia.
What gets tested
Every engagement runs the same seven phases, grounded in PTES, the OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Signed Rules of Engagement authorise each scan and each exploitation attempt, and scope enforcement stops anything that reaches outside the assets you listed.
- Perimeter. 24+ external recon modules map the internet-facing surface, including services stood up years ago and never retired. See external network testing.
- Internal network. With the on-premise agent in place, 18+ internal modules execute on the LAN itself in each country, rather than tunnelling every packet back to a single regional office. See internal network testing.
- Applications and APIs. REST and GraphQL coverage against OWASP Top 10 and API Top 10 risks, with findings streaming live during the scan.
- Cloud. 800+ automated checks across AWS, Azure, GCP and M365 against CIS Benchmarks, plus an agentless Kubernetes audit run from a read-only kubeconfig.
- Identity. Active Directory enumeration, credential testing and password-policy auditing establish what one ordinary account can reach once somebody else is using it.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV flags, which matters most when a group's security function is stretched across several countries at once.
The assurance conversations driving testing across the region
Asia-Pacific buyers rarely test for its own sake. The trigger is usually a regional headquarters mandate, a customer questionnaire, an insurer, or a board that wants one comparable answer across every country the group operates in. Testing does not make an organisation compliant with anything, and we will never say it does. What it supplies is technical evidence: what is reachable, what is exploitable, how far an attacker gets, and what to fix first.
| Asia-Pacific context | Where testing usually starts |
|---|---|
| Regional headquarters running a shared risk programme across several countries | One platform and one methodology across every subsidiary, with comparable reporting regardless of which country office requested it |
| Organisations in Singapore, Hong Kong, Japan or India handling personal data under local privacy law | Which reachable paths lead to systems holding personal information, and how far an attacker gets before detection |
| SaaS and technology companies expanding into new Asia-Pacific markets | External and application testing that starts the same day, with no local office needed for a first assessment to run |
| Merchants and payment platforms in scope for PCI DSS v4.0 | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Vendors answering enterprise security questionnaires from regional customers | Full-scope assessment with reports mapped to the frameworks the questionnaire asks about |
Local compliance landscape
Asia-Pacific is not one privacy regime, and it is worth naming that plainly rather than glossing over it. Singapore's Personal Data Protection Act (PDPA) and Japan's Act on the Protection of Personal Information (APPI) are two real, distinct frameworks, and other markets across the region run their own laws again. None of them is a certification, and none is satisfied by running a scan.
The material fact for a regional buyer belongs at the front, not in a schedule: customer data is stored in Australia for every customer in this region. It is also worth knowing that Singapore's PDPA, Japan's APPI and the other privacy regimes across Asia-Pacific are not among the 8 frameworks PentestOps maps findings to in reports. We supply technical evidence; the compliance judgement stays with you and your own advisers in each market.
| Regional instrument | Who it reaches | What testing can evidence |
|---|---|---|
| Singapore Personal Data Protection Act (PDPA) | Organisations handling personal data of individuals in Singapore | Which reachable paths lead to systems holding personal data, and how far an attacker gets before detection |
| Japan Act on the Protection of Personal Information (APPI) | Organisations handling personal information of individuals in Japan | The same class of evidence, scoped to the systems handling that information |
| Other Asia-Pacific privacy regimes | Any organisation assessing a regime not named above, such as Hong Kong or India | The same technical evidence, for your own advisers to weigh against your own local regime |
| Cross-border hosting review | Privacy officers and procurement teams across the region assessing an Australian platform | The documented facts to assess: data stored in Australia, an ISO/IEC 27001:2022 certified processor, encryption at rest, TLS in transit, 365-day audit logs and a signable DPA |
Support across many time zones
Support runs Mon-Fri 9am-6pm AEST, with 24/7 support for Enterprise customers. Asia-Pacific spans a wide band of time zones either side of that clock, from Perth through to Tokyo, so how much of your working day overlaps with standard hours depends on where you sit. Extranet Systems also runs teams in Bahrain and Cairo, outside the region, whose hours extend live coverage further beyond the Australian working day. Scheduled scans, alerts and reporting run at any hour on the schedule you set, regardless of support hours.
Being honest about the trade-off
If your organisation has a firm requirement that a security vendor maintain a local office in your own country, or that scan data be hosted inside your own jurisdiction, our standard offering does not meet either, and we would rather tell you now than three meetings in. Enterprise customers can discuss specific data-residency arrangements or the on-premise deployment option with us; anything else is a conversation, not a checkbox.
If a single Australian-hosted platform works for your risk position across the countries you operate in, the trade generally favours you: an ISO/IEC 27001:2022 certified vendor, asset-wise pricing with scans unlimited within fair use, exploit-validated findings rather than a severity list, AI analysis that is self-hosted by default so scan data is not sent to third-party model providers, and reports mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes.
Company and contact details
For the procurement file: PentestOps is a product of Extranet Systems Pty Ltd, an Australian company with ABN 29 632 743 189, headquartered at 77 Market Street, Wollongong NSW 2500, our Asia-Pacific headquarters. There is no other Extranet Systems office anywhere else in Asia-Pacific, so the contact number is the Australian one, +61 1300 290 196, or reach us through contact.