How PentestOps works in Europe
Start with the part most vendor pages bury. PentestOps has no office anywhere in Europe and no European-based staff. The platform is built and operated by Extranet Systems Pty Ltd, an Australian company headquartered in Wollongong NSW, with further offices in Sydney, Bahrain and Cairo. European customers are served remotely as software. Nobody flies over, and nobody needs to.
That works because testing happens over the network rather than in a meeting room. External testing runs with no agent at all. Internal testing uses an on-premise agent your own team installs as a Docker container, RPM or DEB package in about 5 minutes, connecting outbound-only over TLS 443 with 0 inbound firewall rules and no VPN. One host can cover multiple subnets, which suits organisations with sites across several European countries.
What you lose by not having a local vendor is someone who can sit in your building on short notice. What you gain is a platform you can start using the same day, without a procurement cycle, continuous coverage between assessments, and support hours extended by teams in Bahrain and Cairo that sit far closer to your working day than Australia does. Decide which of those matters more to your programme before you shortlist.
Data residency and the GDPR conversation, stated plainly
The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia for every customer, in every region, including customers in Europe. Support staff can access customer data from offshore locations too, including Bahrain and Cairo, and that is disclosed in full in our Trust Centre.
GDPR governs how organisations transfer personal data belonging to people in the EU and EEA outside that area, and UK GDPR does the same for the UK. We will not tell you that using an Australian platform is automatically fine under GDPR, because that is not our call to make. It is an assessment for your own Data Protection Officer and your own legal counsel, using the facts on this page and in our Trust Centre, not a box a vendor can tick on your behalf.
The facts to build that assessment on: you are the data controller and Extranet Systems is the data processor, under a signable DPA available on request. Transfer safeguards for your specific arrangement, and how they sit alongside the DPA, are worked through with you directly via contact. Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances, with a copy available on request. The platform is built to SOC 2-aligned controls, and a SOC 2 attestation is on our roadmap. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, traffic is protected with TLS in transit, and audit logs are retained for 365 days. Enterprise customers can request specific data-residency arrangements, or the on-premise deployment option that keeps scan data inside their own boundary.
What gets tested
Every engagement runs the same seven-phase methodology, grounded in PTES, the OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Signed Rules of Engagement authorise each scan and each exploitation attempt, and scope enforcement stops anything that reaches outside the assets you listed.
- Perimeter. 24+ external recon modules map the internet-facing surface, including services stood up years ago and never retired. See external network testing.
- Internal network. With the on-premise agent in place, 18+ internal modules execute on the LAN itself rather than tunnelling every packet to the other side of the world. See internal network testing.
- Applications and APIs. REST and GraphQL coverage against OWASP Top 10 and API Top 10 risks, with findings streaming live during the scan.
- Cloud. 800+ automated checks across AWS, Azure, GCP and M365 against CIS Benchmarks, plus an agentless Kubernetes audit run from a read-only kubeconfig.
- Identity. Active Directory enumeration, credential testing and password-policy auditing establish what one ordinary account can reach once somebody else is using it.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV flags, which matters most when the security team is small and every hour counts.
European buyers and where testing usually starts
European buyers rarely test for its own sake. The trigger is usually a customer questionnaire, a regulator, a group parent company or an incident. Testing does not make an organisation compliant with anything, and we will never say it does. What it supplies is technical evidence.
| European context | Where testing usually starts |
|---|---|
| Organisations processing personal data governed by the GDPR | Which reachable paths lead to systems holding personal data, and how far an attacker gets before detection |
| European subsidiaries or customers of a group already using the platform | One platform covering the whole group, with consistent methodology and comparable reporting |
| Merchants and payment platforms in scope for PCI DSS v4.0 | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Vendors answering enterprise security questionnaires from European customers | Full-scope assessment with reports mapped to the frameworks the questionnaire asks about |
| Organisations weighing a non-European processor against their own data-residency requirements | The documented facts to assess: data stored in Australia, an ISO/IEC 27001:2022 certified processor, encryption at rest, TLS in transit, a signable DPA and 365-day audit logs |
Time zone: live support coverage without a European office
Australian Eastern Standard Time is UTC+10, which puts it seven to ten hours ahead of Europe depending on the time of year, so the Australian working day and the European working day barely overlap. That would be a real gap if Australia were the only place PentestOps had people.
It is not. Bahrain sits at UTC+3 and Cairo at UTC+2 (UTC+3 in summer), both far closer to Central European time (UTC+1 to UTC+2 across the year) and to the UK (UTC+0 to UTC+1) than Australia is. A message raised at the start of a European working day reaches teams already at their desks in Bahrain or Cairo, hours before Australia's morning starts. Support runs Mon-Fri 9am-6pm AEST, with 24/7 support for Enterprise customers, and the Bahrain and Cairo teams extend live coverage well beyond the Australian working day.
Getting started from Europe
There is no onshore onboarding process to wait for. You can authorise scope, add assets and run a real scan the same day you sign up, then expand scope from there. See continuous penetration testing for how the ongoing cadence works once the first assessment is done.
- Authorise the scope. Sign the Rules of Engagement covering assets you own or are authorised to test. Scope enforcement stops activity outside them automatically.
- Add assets. A public IP, hostname, web application, internal subnet target, cloud account or Kubernetes cluster each count as one asset. Bulk CSV or XLSX import is available for larger estates.
- Run the perimeter first. External testing needs no agent, so you see the internet-facing surface before touching the internal network.
- Deploy the agent for internal scope. Docker, RPM or DEB, about 5 minutes, outbound-only over TLS 443. See the agent.
- Set a cadence. Scheduled scans and scheduled perimeter re-checks on the Professional and Enterprise plans, plus drift detection, keep coverage current between assessments.
Being honest about the trade-off
If your organisation has a firm requirement that personal data stay within the EU or the UK, our standard offering does not meet it, and we would rather tell you now than three meetings in. Enterprise customers can discuss specific data-residency arrangements or the on-premise deployment option with us; anything else is a conversation, not a checkbox.
If an Australian-hosted platform works for your risk position and your DPO's assessment, the trade generally favours you: an ISO/IEC 27001:2022 certified vendor, asset-wise pricing with scans unlimited within fair use, exploit-validated findings rather than a severity list, AI analysis that is self-hosted by default so scan data is not sent to third-party model providers, and reports mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes.
Company and contact details
For the procurement file: PentestOps is a product of Extranet Systems Pty Ltd, an Australian company with ABN 29 632 743 189. Our Asia-Pacific headquarters is at 77 Market Street, Wollongong NSW 2500, with further offices in Sydney, Bahrain and Cairo. There is no European office and no European-based staff, so the contact number is the Australian one, +61 1300 290 196, or reach us through contact.