How PentestOps works from our Cairo hub
PentestOps is delivered to North Africa through a real local office: our Cairo, Egypt hub at 120 One Kattameya Compound, Al Ain El Sokhna Axis, Cairo, Egypt. It is described internally as the North Africa Hub, and it is the only Extranet Systems office anywhere in the region. There is no separate office in Morocco, Tunisia, Algeria, Libya or anywhere else in North Africa, and we will not imply otherwise.
From that hub, plus the platform itself, PentestOps serves organisations across the wider region: Egypt, Morocco, Tunisia, Algeria, Libya and neighbouring markets. Testing happens over the network rather than in a meeting room, so a company in Casablanca or Tunis gets the same platform and the same methodology as one in Cairo, with the Cairo team available for local scoping conversations and support.
External testing runs with no agent at all. Internal testing uses an on-premise agent your own team installs as a Docker container, RPM or DEB package in about 5 minutes, connecting outbound-only over TLS 443 with 0 inbound firewall rules and no VPN. One host can cover multiple subnets, which suits organisations with sites spread across several countries in the region.
Where your data goes, stated plainly
Here is the fact we lead with rather than bury: the Cairo hub is real, but it does not change where your data is stored. The platform is hosted in Australia on infrastructure operated by Extranet Systems, and customer data is stored in Australia for every North Africa customer, whether you are in Egypt, Morocco, Tunisia, Algeria or anywhere else we serve from the Cairo hub.
Support and delivery are not confined to Australian hours either. Our Cairo team, alongside colleagues in Bahrain, extends live support coverage beyond the Australian working day, and staff in those offices access customer data as part of delivering that support. That access is disclosed in our Trust Centre. What does not change is where the data itself is stored: Australia, not Egypt and not anywhere else in the region.
Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances, and operates across three continents (Oceania, Asia and Africa). The platform runs to SOC 2-aligned controls, and a SOC 2 attestation is on our roadmap. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, traffic is protected with TLS in transit, and audit logs are retained for 365 days. You are the data controller and Extranet Systems is the data processor; a signable DPA is available on request. Enterprise customers can request specific data-residency arrangements, or the on-premise deployment option that keeps scan data inside your own boundary.
What gets tested
Every engagement runs the same seven phases, grounded in PTES, the OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Signed Rules of Engagement authorise each scan and each exploitation attempt, and scope enforcement automatically stops anything that reaches outside the assets you listed.
- Perimeter. 24+ external recon modules map the internet-facing surface, including services stood up years ago and never retired. See external network testing.
- Internal network. With the on-premise agent installed, 18+ internal modules run natively on the LAN rather than tunnelling every packet out to a remote scanner. See internal network testing.
- Applications and APIs. REST and GraphQL coverage against OWASP Top 10 and API Top 10 risks, with findings streaming live during the scan.
- Cloud. 800+ automated checks across AWS, Azure, GCP and M365 against CIS Benchmarks, plus an agentless Kubernetes audit run from a read-only kubeconfig.
- Identity. Active Directory enumeration, credential testing and password-policy auditing establish what one ordinary account can reach once somebody else is using it.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV flags, so a small security function works the findings that matter most first.
What drives testing across North Africa
Organisations across Egypt, Morocco, Tunisia and Algeria are expanding cloud footprints and digital services faster than most in-house security teams can keep pace with, often while running lean and reporting into a group security function based elsewhere. The trigger for testing is usually external: a bank, an insurer, an international customer's questionnaire, or a regulator asking harder questions.
Testing does not make an organisation compliant with anything, and we will never say it does. What it supplies is technical evidence: what is reachable, what is exploitable, how far an attacker gets, and what to fix first.
| North Africa context | Where testing usually starts |
|---|---|
| Organisations operating across Egypt, Morocco, Tunisia and Algeria | One platform covering every country in scope, with consistent methodology and comparable reporting |
| Banks, insurers and payment providers in scope for PCI DSS v4.0 | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Government bodies and their delivery partners | Perimeter discovery and identity testing, with customer data stored in Australia |
| North Africa subsidiaries of international or Gulf-based groups | One platform covering the whole group, with consistent methodology and comparable reporting for head office |
| Vendors answering enterprise security questionnaires | Full-scope assessment with reports mapped to the frameworks the questionnaire asks about |
Local compliance landscape
Data protection law across North Africa is not one regime. Egypt has its own Personal Data Protection Law, and Morocco, Tunisia and Algeria each have their own frameworks, at different stages of maturity and enforcement. None of them is a certification, and none is satisfied by running a scan.
The material fact for a buyer anywhere in the region belongs at the front, not in a schedule: customer data is stored in Australia, not in Egypt and not anywhere else in North Africa, even though our Cairo hub is a genuine local presence. None of the national data protection laws in the region are among the 8 frameworks PentestOps maps findings to in reports. We supply technical evidence; the compliance judgement, and whether an Australian-hosted platform meets your own country's requirements, stays with you and your own legal advisers.
| Consideration | Who it reaches | What testing can evidence |
|---|---|---|
| Egypt's Personal Data Protection Law | Organisations handling personal data of people in Egypt | Which reachable paths lead to systems holding personal data, and how far an attacker gets before detection |
| National data protection frameworks elsewhere in the region | Organisations operating in Morocco, Tunisia, Algeria and neighbouring countries | The same technical evidence base, produced once, for your team to carry into whichever national review applies |
| PCI DSS v4.0 | Merchants and payment platforms across the region | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Cross-border hosting review | Legal, privacy and procurement teams assessing an Australian-hosted platform delivered through a Cairo hub | The documented facts to assess: data stored in Australia, an ISO/IEC 27001:2022 certified processor, encryption at rest, TLS in transit, 365-day audit logs and a signable DPA |
Getting started from North Africa
There is no lengthy onboarding process to wait for, and no need to route the first conversation through a distant regional office. You can authorise scope, add assets and run a real scan the same day you sign up, then expand scope from there. See continuous penetration testing for how the ongoing cadence works once the first assessment is done.
- Authorise the scope. Sign the Rules of Engagement covering assets you own or are authorised to test. Scope enforcement stops activity outside them automatically.
- Add assets. A public IP, hostname, web application, internal subnet target, cloud account or Kubernetes cluster each count as one asset. Bulk CSV or XLSX import is available for larger estates.
- Run the perimeter first. External testing needs no agent, so you see the internet-facing surface before touching the internal network.
- Deploy the agent for internal scope. Docker, RPM or DEB, about 5 minutes, outbound-only over TLS 443. See the agent.
- Set a cadence. Scheduled scans and scheduled perimeter re-checks on the Professional and Enterprise plans, plus drift detection, keep coverage current between assessments.
Being honest about the trade-off
If your organisation has a firm requirement that security data stay onshore inside Egypt or elsewhere in North Africa, our standard offering does not meet it, and we would rather tell you now than three meetings in. A local hub is not the same thing as local data residency, and we will not blur that line. Enterprise customers can discuss specific data-residency arrangements or the on-premise deployment option with us; anything else is a conversation, not a checkbox.
If Australian hosting works for your risk position, the trade generally favours you: an ISO/IEC 27001:2022 certified vendor with a genuine regional presence, asset-wise pricing with scans unlimited within fair use, exploit-validated findings rather than a severity list, AI analysis that is self-hosted by default so scan data is not sent to third-party model providers, and reports mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes.
Support runs Mon-Fri 9am-6pm AEST, with 24/7 support for Enterprise customers. The Cairo and Bahrain teams extend live coverage further into the North Africa working day than an Australia-only team could. Scans, alerts and reporting run regardless of support hours.
Company and contact details
For the procurement file: PentestOps is a product of Extranet Systems Pty Ltd, an Australian company with ABN 29 632 743 189, with its Asia-Pacific headquarters at Ground Floor, 77 Market Street, Wollongong NSW 2500, Australia. Our North Africa Hub is at 120 One Kattameya Compound, Al Ain El Sokhna Axis, Cairo, Egypt. Reach either team through contact, or call the Australian office on +61 1300 290 196.