Full Business Security Assessment

The assessment includes four components: Website Application Security Testing (OWASP Top 10 penetration testing), Email Infrastructure Security Audit (SPF/DKIM/DMARC + spoofing simulation), Network Perimeter Penetration Testing (full port scanning + firewall assessment), and Security Policy Review (passwords, access, incident response, backups). You also receive a unified remediation roadmap, executive summary, compliance mapping, and free re-testing of critical and high findings.

The Full Business Security Assessment is $1,200 AUD - covering all four components, unified reporting, and re-testing. Purchasing the same assessments individually would cost over $2,000 ($500 website + $300 email + $400 network + policy review). The full assessment also provides cross-domain analysis that individual audits cannot offer, making it both more comprehensive and more cost-effective.

The full assessment typically takes 7-10 business days from scoping to final report delivery. This includes 1-2 days for scoping and discovery, 5-7 days for testing across all four domains, and 2-3 days for reporting and analysis. The findings walkthrough call is scheduled at your convenience after report delivery. For organisations with urgent compliance deadlines, we offer expedited timelines.

The Full Business Assessment is designed for organisations of all sizes. Small businesses (5-50 employees) benefit most because they typically lack internal security resources and are increasingly targeted by attackers who know this. The assessment gives you a complete security baseline and a prioritised fix list - you address the highest-risk items first, spreading the remediation cost over time. Many of our clients are SMBs with no internal IT security team.

Three advantages: cost savings ($800+ compared to individual purchases), cross-domain correlation (finding attack chains that span website, email, and network boundaries), and unified reporting (one prioritised fix list instead of three separate reports). A coordinated assessment also eliminates scheduling overhead and ensures consistent methodology across all testing domains.

For the website component, we may request test user credentials to assess authenticated functionality. For the email audit, we need your primary email domain name. For the network scan, we need your external IP addresses or domain names. For the policy review, we ask for copies of your current security policies (if they exist - many SMBs do not have formal policies, and that itself is a finding). We never require admin access or source code.

We use a risk-based prioritisation that considers exploitability (how easy is it to exploit), impact (what data or systems are at risk), attack chain potential (can findings be combined for greater impact), and business context (is this a customer-facing system or internal tool). A medium-severity network exposure that gives an attacker the foothold to exploit a web application vulnerability gets higher priority than an isolated finding of the same technical severity.

Findings are mapped to whichever frameworks are relevant to your organisation - APRA CPS 234 (financial services), ASD Essential Eight (government suppliers), PCI DSS (payment processing), ISO 27001 (information security), SOC 2 (service providers), and the Australian Privacy Act / Australian Privacy Principles. If you are unsure which frameworks apply, we help identify the relevant ones during scoping.

Yes. The assessment includes a Certificate of Security Assessment that you can share with clients, partners, insurers, or regulators as evidence of proactive security testing. The report format is designed to satisfy common due diligence requests - many of our clients use it for vendor risk assessments, cyber insurance applications, and regulatory compliance evidence.

Re-testing of all critical and high-severity findings is included in the $1,200 price. After your team applies fixes, we re-test each remediated finding and issue an updated report confirming successful resolution. For ongoing protection, our quarterly monitoring package ($200/quarter) provides automated scanning between annual assessments, with a full re-assessment recommended annually.

All data collected during the assessment - including vulnerability details, evidence screenshots, and any sensitive information encountered - is encrypted in transit and at rest, stored in Australian data centres, and permanently deleted 90 days after project completion. We operate under a mutual non-disclosure agreement and never share client information with third parties. Our team holds current police checks and professional indemnity insurance.

The entire assessment is conducted remotely. Website, email, and network testing are performed from our secure testing infrastructure over the internet. The policy review is conducted via document sharing and a video call. There is no need for an on-site visit, which keeps costs down and allows us to serve clients across Australia regardless of location. Scoping, findings walkthrough, and all communication are handled via video conference.