How PentestOps works in the United States
Start with the part most vendor pages bury. PentestOps has no office anywhere in the Americas and no staff based there. The platform is built and operated by Extranet Systems Pty Ltd, an Australian company with additional operations in Bahrain and Cairo, and United States customers are served remotely as software. Nobody flies over, and nobody needs to.
That works because testing happens over the network rather than in a meeting room. External testing runs with no agent at all. Internal testing uses an on-premise agent your own team installs as a Docker container, RPM or DEB package in about 5 minutes, connecting outbound-only over TLS 443 with 0 inbound firewall rules and no VPN. One host can cover multiple subnets, which suits organisations with sites across several states and time zones.
What you lose by not having a local vendor is someone who can sit in your building, or a sales call that happens comfortably inside your own working day. What you gain is a platform you can start using the same day, without a procurement cycle, and a testing cadence that keeps running between assessments rather than arriving once a year. Decide which of those matters more to your programme before you shortlist.
Where your data goes, stated plainly
The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia for every customer, in every region, regardless of whether that region has a local Extranet Systems office. For a United States organisation that means scan results, asset inventory, findings, evidence and reports relating to your estate are held outside the United States.
We flag this rather than leaving it in a schedule at the back of a contract, because it is a decision your privacy, procurement and legal teams should make deliberately. United States privacy law in this area is a patchwork of state statutes, such as the California Consumer Privacy Act and the California Privacy Rights Act, rather than one federal standard, and how each of them treats personal information held by a service provider outside the United States is a question for your own counsel. We cannot give you legal advice about your own obligations under them, and we will not tell you the arrangement is automatically fine. Take your own advice, using the facts on this page and in our Trust Centre.
The supporting detail: Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified, independently audited by Atom Assurances. The platform is built to SOC 2 aligned controls, and a SOC 2 attestation is on our roadmap. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, traffic is protected with TLS in transit, and audit logs are retained for 365 days. You are the data controller and Extranet Systems is the data processor; a signable DPA is available to customers on request. Enterprise customers can request specific data-residency arrangements, or the on-premise deployment option that keeps scan data inside your own boundary.
What gets tested
Every engagement runs the same seven phases, grounded in PTES, the OWASP Web Security Testing Guide v4.2 and NIST SP 800-115, and aligned to CREST testing methodology guidance. Signed Rules of Engagement authorise each scan and each exploitation attempt, and scope enforcement stops anything that reaches outside the assets you listed.
- Perimeter. 24+ external recon modules map the internet-facing surface, including services stood up years ago and never retired. See external network testing.
- Internal network. With the on-premise agent in place, 18+ internal modules execute on the LAN itself rather than tunnelling every packet across the Pacific and back. See internal network testing.
- Applications and APIs. REST and GraphQL coverage against OWASP Top 10 and API Top 10 risks, with findings streaming live during the scan.
- Cloud. 800+ automated checks across AWS, Azure, GCP and M365 against CIS Benchmarks, plus an agentless Kubernetes audit run from a read-only kubeconfig.
- Identity. Active Directory enumeration, credential testing and password-policy auditing establish what one ordinary account can reach once somebody else is using it.
- Prioritisation. CVE correlation, CVSS v3.1 scoring, exploit-availability indicators and CISA KEV flags, so a small team works the findings that actually matter first.
What drives testing for United States organisations
United States buyers rarely test for its own sake. The trigger is usually a regulator, an insurer, a customer security questionnaire, an auditor preparing for a PCI DSS assessment, or a board that has started asking harder questions after a headline breach at another company. Testing does not make an organisation compliant with anything, and we will never say it does. What it supplies is technical evidence: what is reachable, what is exploitable, how far an attacker gets, and what to fix first.
| United States context | Where testing usually starts |
|---|---|
| Healthcare organisations and business associates handling protected health information under HIPAA | Which paths reach systems holding protected health information, and how far an attacker gets before detection |
| Merchants and payment platforms in scope for PCI DSS v4.0 | Web application and API testing across OWASP Top 10 and API Top 10 risks, re-run after each release |
| Organisations subject to state privacy laws such as the California Consumer Privacy Act and the California Privacy Rights Act | Technical evidence of safeguards over personal information, not a compliance certification under those laws |
| Federal contractors and agencies referencing NIST SP 800-53 controls | Perimeter, internal network and identity testing mapped against the relevant control families |
| Vendors answering enterprise security questionnaires | Full-scope assessment with reports mapped to the frameworks the questionnaire asks about |
Local compliance landscape
The United States landscape is dense, and it is worth naming precisely which parts of it PentestOps reports actually map to. HIPAA governs healthcare organisations and their business associates. PCI DSS v4.0 governs anyone who stores, processes or transmits cardholder data. NIST SP 800-53 sets control baselines that federal agencies and their contractors reference. All three are among the 8 frameworks our reports map findings to.
What is not on that list matters just as much. There is no single federal privacy statute; instead a growing list of state laws, including the California Consumer Privacy Act and the California Privacy Rights Act, govern how personal information is collected, used and disclosed. None of those state laws are among the 8 frameworks PentestOps maps findings to in reports. We supply technical evidence of the safeguards in place; whether that evidence satisfies a specific state law is a judgement for your own legal counsel, not for this page.
| United States instrument | Who it reaches | What testing can evidence |
|---|---|---|
| HIPAA Security Rule | Covered entities and business associates handling protected health information | Exposed services, weak configuration and access-control gaps on systems holding protected health information, with evidence attached |
| PCI DSS v4.0 | Merchants, processors and service providers handling cardholder data | Web application, API and network testing mapped to the standard's technical requirements, re-run after each release |
| NIST SP 800-53 | Federal agencies and the contractors that build, host or operate their systems | Control-family evidence for systems referencing the framework, with findings attached |
| State privacy laws (California Consumer Privacy Act, California Privacy Rights Act and similar) | Organisations handling personal information of residents of those states | Technical evidence of safeguards in place. Not one of the 8 frameworks PentestOps maps findings to, and not a substitute for your own legal assessment |
| Cross-border hosting review | Privacy, procurement and legal teams assessing an Australian platform | The documented facts to assess: data stored in Australia, an ISO/IEC 27001:2022 certified processor, encryption at rest, TLS in transit, 365-day audit logs and a signable DPA |
Getting started from the United States
There is no onshore onboarding process to wait for. You can authorise scope, add assets and run a real scan the same day you sign up, then expand scope from there. See continuous penetration testing for how the ongoing cadence works once the first assessment is done.
- Authorise the scope. Sign the Rules of Engagement covering assets you own or are authorised to test. Scope enforcement stops activity outside them automatically.
- Add assets. A public IP, hostname, web application, internal subnet target, cloud account or Kubernetes cluster each count as one asset. Bulk CSV or XLSX import is available for larger estates.
- Run the perimeter first. External testing needs no agent, so you see the internet-facing surface before touching the internal network.
- Deploy the agent for internal scope. Docker, RPM or DEB, about 5 minutes, outbound-only over TLS 443. See the agent.
- Set a cadence. Scheduled scans and scheduled perimeter re-checks on the Professional and Enterprise plans, plus drift detection, keep coverage current between assessments.
Being honest about the trade-off
If your organisation has a firm requirement that security data stay onshore in the United States, our standard offering does not meet it, and we would rather tell you now than three meetings in. Enterprise customers can discuss specific data-residency arrangements or the on-premise deployment option with us; anything else is a conversation, not a checkbox.
If hosting on the other side of the Pacific works for your risk position, the trade generally favours you: an ISO/IEC 27001:2022 certified vendor, asset-wise pricing with scans unlimited within fair use, exploit-validated findings rather than a severity list, AI analysis that is self-hosted by default so scan data is not sent to third-party model providers, and reports mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes, with HIPAA and PCI DSS v4.0 covering the two frameworks most United States buyers ask about first.
Support runs Mon-Fri 9am-6pm AEST, with 24/7 support for Enterprise customers. United States time zones sit at close to the opposite end of the clock from AEST, so standard business-hours support and your own working day barely overlap at all. Our Bahrain and Cairo teams extend live coverage well beyond the Australian working day, which narrows the gap for early United States mornings and late evenings, but it does not create round-the-clock overlap outside Enterprise support. Scans, alerts and reporting run regardless of support hours.
Company and contact details
For the procurement file: PentestOps is a product of Extranet Systems Pty Ltd, an Australian company with ABN 29 632 743 189, headquartered at Ground Floor, 77 Market Street, Wollongong NSW 2500, with a Sydney office for sales and operations. Extranet Systems also operates in Bahrain and Cairo, but there is no office and no staff anywhere in the Americas, so the contact number is the Australian one, +61 1300 290 196, or reach us through contact.