Conformance is an Australian security practice specialising in penetration testing. We test your networks, applications and people the way a real attacker would, and report every finding with the evidence, the business impact and the fix. Engagements are quoted at a fixed price against a written scope, and remediated findings are retested until the risk is closed.
These are the engagements we are asked for most. If your requirements sit outside them, we will scope an engagement to fit.
What an attacker who is already inside your network, on a phished laptop or a rogue device, can reach, escalate and take over.
Your internet-facing perimeter: exposed services, VPNs, mail and remote access, tested the way the internet sees it.
Authentication, access control, injection and business-logic flaws in the applications you build and buy.
iOS and Android apps and the services behind them: insecure storage, weak transport security and platform hardening.
REST, GraphQL and service-to-service APIs: broken authorisation, excessive data exposure and abuse of business flows.
Corporate and guest Wi-Fi: rogue access points, weak authentication, and whether wireless is segregated from your core network.
A goal-driven simulated attack over weeks, not days. It tests whether your controls detect and respond, not just whether they exist.
Measured, safely run phishing against your staff, reported as metrics and training outcomes, never blame.
Targets, exclusions and rules of engagement agreed in writing before anything is touched. Testing stays safe, legal and aimed at what matters.
Certified consultants test the agreed scope in depth, combining recognised methodologies and tooling with hands-on manual investigation, and validating every finding.
Every finding comes with evidence, business impact and a specific fix, ranked by the risk it poses to you.
Once you have remediated, we verify each fix and update the report, so you can show the risk is genuinely closed.
Alongside penetration testing, Conformance runs evidence-based ASD Essential Eight maturity assessments through our own purpose-built platform. Evidence, reviews and maturity roll-ups live in one place, with dated, exportable reports. Explore Essential Eight assessments →
Configuration exports, policies, screenshots and logs are uploaded against the specific test they support.
Each item is accepted, returned or waived by an assessor, with the evidence kept alongside the decision.
Progress over time, roll-ups by strategy and reports you can hand to an executive, a board or an auditor.
We combine recognised methodologies and tooling with hands-on manual testing, so coverage is comprehensive and every finding is validated by a tester.
Business impact, a defensible severity and the concrete fix for every issue, readable by your engineers and your board alike.
A finding is not closed on assertion. We retest remediated issues and reissue the report with the result.
From a single web application to a multi-week red team, every engagement is scoped, priced and reported for your environment. No off-the-shelf packages.
Contact us to discuss your requirements. Every engagement is scoped in writing and quoted at a fixed price.
Request a quote
