Australian-built enterprise penetration testing and continuous penetration testing on one platform. Find what is exposed, prove what is genuinely exploitable with safe automated exploitation, and remediate with AI assistance. Proof, not guesswork, year-round rather than once a year, with your data stored in Australia.
Follow engagement EXT-2291 through the PentestOps console: authorised before anything runs, every finding ranked, the ones that matter proven with evidence, fixes re-tested, and a report your auditors can use.
Pre-Engagement
Rules of Engagement are signed per tenant before a single test starts. Scope, the testing window and out-of-scope blocking are locked in.
Authorised, bounded and auditable before the first test runs.
Reconnaissance & OSINT ยท Scanning & Enumeration
Agent syd-01 connects outbound on 443 with no inbound rules. External recon, cloud sync and a LAN sweep fill the inventory, and new hosts wait for your approval.
A current inventory, including hosts IT did not know about.
Vulnerability Analysis
Network, web, cloud and Kubernetes posture are assessed, and findings are correlated with CVE, CVSS v3.1 and the CISA KEV catalogue.
47 findings, already ranked by real-world exploitability.
Exploitation & Validation
Confirmed findings get a safe proof of exploit, using the best technique for each finding, and every step leaves evidence. Discovered credentials are redacted before findings ship.
47 detected, 4 proven. Proof, not guesswork.
Reporting & Remediation
AI fix steps for each finding, with a playbook pushed through the agent to SSH-managed hosts. The re-test re-runs the exploit that proved the finding, through the same RoE gate.
Closed with evidence, not just a ticket.
Reporting & Remediation
The report maps findings to OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001 and SMB1001, plus CIS Benchmarks. The next run is scheduled and monitoring stays on.
Board-ready evidence today, and testing that keeps going.
The accreditations and vendor partnerships behind our managed services stand behind PentestOps.
Trust Centre See our accreditations & awards
PentestOps is an enterprise penetration testing and continuous security platform. It automates the work of an offensive security team: discovering your attack surface, testing external, internal, web, API, cloud, Kubernetes and identity systems, safely exploiting confirmed findings to prove real impact, and mapping the result to compliance reporting frameworks.
It is built for in-house security and IT teams, and for the managed service providers who test on their behalf, wherever an annual point-in-time report no longer keeps pace with how quickly the environment changes.
Every result is correlated, prioritised and mapped to the frameworks your auditors ask for.
Reports mapped to 8 compliance reporting frameworks plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes, all with detailed evidence. Mapping shows where findings land; it is not a certification.
800+ automated checks across AWS, Azure, GCP and M365 (IAM, storage, network, configuration) with CIS Benchmark coverage. Kubernetes is agentless: API posture over a read-only kubeconfig you supply, and node CIS checks as a short-lived, auto-removed job across GKE, EKS, AKS, OpenShift, k3s and on-prem. No permanent agent or DaemonSet; on managed clusters the provider-run control plane shows as not applicable.
Cloud penetration testing Kubernetes security testingPort scanning, service enumeration, vulnerability detection and safe exploitation of your internet-facing hosts, following the PTES methodology. Advanced exploitation is on Enterprise.
External network penetration testingActive Directory enumeration, privilege escalation, lateral movement detection and credential analysis from inside your network.
Internal network penetration testingOWASP Top 10 coverage including SQL injection, XSS, authentication bypass, API security and business logic vulnerabilities.
Web application penetration testingCVE correlation with CVSS scoring, exploit availability from exploit intelligence refreshed daily, and prioritised remediation recommendations.
All featuresSee these checks run against your own environment. Book a demo with our team, or run a demo scan of your perimeter: no agent, no install and no contract.
Every finding is analysed in context, ranked by real business impact and shipped with validated fix steps and an executive-ready report. By default the AI runs on infrastructure we control. External providers are enabled per tenant only if you opt in, and then the data needed for that analysis goes to that provider. How we protect your data.
See what an AI-written finding, its evidence and its fix steps look like before you commit to a plan.
AI fix steps
PDF CSV JSON
Analyses discovered vulnerabilities in context, understanding your infrastructure to prioritise critical risks and reduce false positives.
Executive-ready reports with AI-written insights, remediation guidance and compliance mapping.
Connect domains, IP ranges, cloud accounts and clusters, or let the on-premise agent map the internal network; on Professional and Enterprise, external attack surface management re-checks your public domains on a schedule.
Nothing runs until per-tenant Rules of Engagement are signed, and testing follows the seven phases of our testing methodology.
Confirmed findings are safely exploited to show real impact, which is what attack path validation means; advanced exploitation is on Enterprise.
Every finding ships with AI-guided fix steps, the platform can push a remediation playbook over the agent, and continuous penetration testing re-verifies the fix.
Built in Australia for teams that need real offensive testing they can trust, not another noisy scanner.
By default, our AI analysis runs on infrastructure we control, so your findings, evidence and scan data are not handed to a third-party model provider. External providers can be enabled per tenant if you opt in, and then the data needed for that analysis goes to that provider.
How we protect your dataA lightweight agent inside your own network reaches internal hosts, Active Directory and segmented environments, testing from where an attacker would really stand, with no inbound access required.
About the agentConfirmed findings are exploited safely to show real impact, with evidence captured at every step and credentials redacted before they leave the agent. Advanced exploitation is on Enterprise and MSP plans.
Compare plansDesigned and operated by Extranet Systems Pty Ltd, an Australian company. Hosted in Australia, with customer data stored in Australia.
About Extranet SystemsEnterprise controls
Trust CentreMSP & Partners
Resell or white-label asset-wise pentesting under your own brand, and add continuous security testing to your offering without building it yourself.
Become a partnerPentestOps is an enterprise-grade penetration testing and continuous security platform. It delivers automated, AI-powered discovery, exploitation and remediation across the external perimeter, internal networks, web applications, APIs, cloud infrastructure and identity. Instead of a single point-in-time engagement each year, testing runs year-round so you always know what an attacker could reach today. See the full platform features, or start with the plain-English explainer on what penetration testing is.
Security and IT teams that need real offensive testing without standing up a red team of their own. That includes in-house security teams, IT managers carrying compliance obligations, engineering teams shipping fast enough that an annual pentest goes stale, and consultancies or managed service providers who resell testing under their own brand. Sector-specific detail, including the regulatory drivers we see most often, lives on the industries pages.
Testing only ever runs against assets you have authorised. Every scan and exploitation attempt is gated by per-tenant Rules of Engagement, with scope enforcement that automatically stops activity outside the approved assets. Safe automated exploitation is designed to prove impact and capture evidence, not to cause disruption, and Stealth, Balanced and Aggressive scan profiles let you match the noise level to the environment. Every action lands in a full evidence trail and audit log. Read more about the approach in attack path validation.
Sign up, add your first asset, and you can have an external assessment running in under 10 minutes. If you want to see output before creating an account, run a free demo scan against a domain you own. Internal testing adds roughly 5 minutes to deploy the on-prem agent on one host. All paid plans start with a 7-day free trial: a card is required to start your trial and is only charged after the trial ends, unless you cancel first.
Only for testing inside your network. External network, web application, API and email assessments run from the platform with no agent at all, and cloud and Kubernetes auditing are agentless too (read-only cloud credentials, or a customer-supplied read-only kubeconfig). Internal network testing, Active Directory enumeration and LAN asset discovery use the on-prem agent, which deploys in about 5 minutes, connects outbound-only over TLS 443, and needs 0 inbound firewall rules.
Findings are automatically mapped to 8 compliance reporting frameworks (OWASP Top 10, PCI DSS v4.0, NIST 800-53, SOC 2, HIPAA, GDPR, ISO 27001, SMB1001) plus CIS Benchmarks for AWS, Azure, GCP and Kubernetes. Those mappings tell you where each finding sits within a framework and what evidence supports it; they are a reporting aid, not a statement that your organisation or ours is certified against that framework. Our own corporate posture is set out in the Trust Centre.
The platform is hosted in Australia on infrastructure operated by Extranet Systems. Customer data is stored in Australia. Every customer runs in an isolated environment with its own dedicated database, data is encrypted at rest, and all traffic is protected with TLS in transit. Extranet Systems Pty Ltd is ISO/IEC 27001:2022 certified. Specific data-residency arrangements are available to Enterprise customers on request; see the Trust Centre for the detail.
Pricing is asset-wise: you pay for what you actually scan. One asset is one item the platform can scan or monitor, such as a public IP, a hostname, a web application, an internal subnet target, a cloud account or a Kubernetes cluster. Scans against those assets are unlimited within fair use, so testing more often never costs more. Current rates for Starter, Professional and Enterprise are on the pricing page; the Partner and MSP programme is sales-led via our team.
Try any tier free for 7 days. Run your first asset-wise pentest, external or internal, in under 10 minutes; the rest of your tier unlocks once the trial converts to a paid subscription.
Or run a free demo scan