Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All services // SECURITY ASSESSMENTS AND PENETRATION TESTING

Find it before someone less friendly does

Somebody is going to test your security eventually. The only question is whether they tell you what they found.

Penetration testing, security assessments, Essential Eight uplift, access and identity audits, cloud and Microsoft 365 configuration reviews, and phishing simulation. Testing is the best known of these, not the whole of it. Findings ranked by what actually matters to your business, written so the person who has to fix them can understand them.

Scope this with us
 Free: A real penetration test report, redacted
// SOUND FAMILIAR

If two of these sound familiar, we should talk

The rest of this page covers what the work includes, what it produces and how it is priced.

01 A customer, insurer or tender has asked for evidence of testing and you have none
02 You have had a scan done and got a 200-page PDF nobody read
03 You genuinely do not know who has access to what any more
04 Your Microsoft 365 tenant has never been looked at by anyone outside the business
05 Something was built fast, went live, and has never been looked at since
// THE SCOPE, BOTH SIDES OF IT

What this is, and what it deliberately is not

What this is

  • Manual testing by a person, with automated tooling as the starting point rather than the deliverable
  • Security assessments where the question is how you stand overall, not whether one system can be broken into
  • Access and identity audits: who can reach what, and who should have stopped being able to
  • Cloud and Microsoft 365 configuration review against a known baseline rather than an opinion
  • Phishing simulation run to teach your staff something, not to catch them out
  • Findings ranked by real business impact, not by raw scanner severity
  • A plain-English report your board or insurer can read, plus the technical detail for whoever fixes it
  • Remediation advice specific enough to act on, and an included retest of the reported findings, so the fixes are verified rather than assumed
  • Essential Eight assessment and uplift, mapped to where you actually are

What this is not

  • A scanner export sold as a penetration test
  • Findings without advice on what to do about them
  • Testing without a written scope and your explicit authorisation
// THE ENGAGEMENT, START TO FINISH

What actually happens after you say yes

Typically one to two weeks

Measured from signed scope to the walk-through call. An access audit or a configuration review sits at the short end, a full internal network with multiple environments at the long end. The retest of the reported findings falls outside that time, within a window agreed in the scope.

01

Scoping

What is in, what is explicitly out, what we are allowed to do, and what happens if we find something actively being exploited. Whether the engagement is a penetration test, an access audit or a configuration review, this is signed by both sides before anything is touched. No exceptions.

02

Reconnaissance

What can be seen from outside without touching anything: exposed services, certificates, DNS, email authentication, credentials already in known breach data. Often the most uncomfortable part of the whole engagement, and it happens on an assessment just as it does on a test.

03

The work itself

On a penetration test this is the manual attacking, chaining small issues into real ones. On an access audit it is tracing permissions to their end. On an Essential Eight or configuration review it is checking each control as configured rather than as documented. We keep a running log throughout, and anything critical is reported the moment we find it rather than saved for the report.

04

Triage and ranking

Every finding gets ranked against what it would actually cost your business, not its generic severity score. A medium-severity issue on the system holding client records outranks a high on a test box nobody uses.

05

Reporting

Two audiences, one document: an executive summary a non-technical director can act on, and the technical detail with reproduction steps for whoever fixes it. Every finding carries specific remediation advice.

06

Walk-through and retest

We take you through the findings live and answer the question everyone actually has, which is what to do first. Once you have fixed things, and within the retest window agreed in the scope, we retest the findings in the original report and reissue it showing which fixes were verified. The retest is included in the price. It checks the specified fixes; new systems or changed scope are a new engagement.

// WHAT YOU WALK AWAY WITH

Things you can hold, forward and act on

The artefacts this work produces, named so you know what you are buying.

Written document

Signed scope and authorisation

Agreed before testing starts. Protects both sides

Written report

Findings report

Executive summary plus full technical detail with reproduction steps

Written document

Ranked remediation plan

What to fix first, what can wait, and what to simply accept

Live call

Findings walk-through

With the tester, not a salesperson

Written report

Retest and reissued report

Included. Verifies the fixes to the original findings, within the retest window agreed in the scope

// NOT A MOCK-UP

One finding, exactly as we wrote it

A page straight out of a real penetration test report, redacted, shown as it is. Read the page, then decide whether the whole document is worth an email address.

Penetration Test Report SECTION 05 // F-01, A FINDING WORKED IN FULL
CLIENT Redacted allied health practice, Victoria
EXECUTIVE SUMMARY

Six findings, of which two required action that month. The most serious is not a single flaw but a chain. A low-rated predictability weakness made a medium-rated access control vulnerability reliably exploitable, by allowing valid record identifiers to be enumerated rather than guessed. The predictable identifiers make the exposure easier to exploit systematically, but the missing ownership check warrants urgent attention on its own.

FINDING F-01 HIGH

Appointment records reachable by changing a record number

A signed-in user can view another patient's record by altering the numeric identifier in the request. No additional privileges are required and the change is trivial to make by hand. That missing ownership check is serious by itself. Combined with F-05, valid identifiers can be enumerated rather than guessed, so the records can be collected systematically rather than one lucky guess at a time.

WHAT THE SCANNER SAID MEDIUM

The automated scan found both components of the chain, rated them medium and low, and reported no relationship between them. It rated the missing security headers higher than this finding, and it did not detect F-02 at all. That is the difference a manual test buys, and it is the reason we publish this sample.

Redacted sample report · 21 pages Read the rest of this page
Send me the sample report
// WHAT IT COSTS

Fixed price per engagement, scoped up front

Testing is priced against a defined scope. The retest of the reported findings and the reissued report are included. If you want a smaller starting point, the Security Baseline Assessment is a fixed-price look at your Microsoft 365 and Entra environment, and the free Exposure Check shows you what is visible from the outside before you spend anything at all.

Get a written scope
WHAT MOVES THE NUMBER
How many applications, hosts or environments are in scope
Whether testing is external only, or internal and authenticated as well
Whether testing runs out of hours to keep production untouched
How much remediation support you want afterwards
// FROM THE FILE

One of these, in the field

DECLASSIFIED

Two findings nobody would have fixed, and what they did together

A scan had already found both issues and rated them low and medium. Manual testing with an ordinary test account showed that one signed-in user could read other patients' clinical records, and that the low-rated finding made real accounts easier to target.

Read the case file
// QUESTIONS, ANSWERED

Asked before signing anything

A penetration test typically takes one to two weeks, from the signed scope through to the walk-through call. After that you fix things, and within the retest window agreed in the scope we retest the findings in the original report and reissue it, showing which fixes were verified. The retest is included in the price. It covers the specified fixes to the reported findings, not new systems or a wider scope.

No. The same team does security assessments, Essential Eight uplift, access and identity audits, Microsoft 365 configuration reviews and phishing simulation. Testing answers whether a specific thing can be broken into. An assessment answers how you stand overall. If you are not sure which you want, tell us why you are asking and we will point you at one.

A scan is automated and tells you what a tool recognises. A penetration test uses a scan as its starting point, then a person tries to chain the findings into something that actually matters. The difference shows up in the report: a scan lists issues, a test tells you what someone could do with them.

Read the full explanation

The scope document names anything fragile and we agree what is off limits before we start. Genuinely destructive testing only happens against a non-production environment and only if you ask for it. We would rather leave a finding untested than take your business offline to prove a point.

Yes. We publish a redacted sample report, with the client's written permission, so you can judge the writing before you buy anything. There is a page of it further up this one.

See the sample report

You hear about it that day, not in the report at the end. If we find evidence that something is already being exploited, testing stops and it becomes an incident conversation immediately.

They answer different questions. Monitoring tells you what is happening now. Testing tells you what could happen. Most organisations that hold sensitive data end up wanting both, but testing is genuinely useful on its own and plenty of clients only ever buy it.

// OFTEN SCOPED TOGETHER

What usually comes with this

Cybersecurity Governance and Compliance Evidence is a folder, not a scramble Cybersecurity Governance and Compliance, scope and pricing
IT Projects and Microsoft 365 The project nobody wants to own IT Projects and Microsoft 365, scope and pricing

Tell us the problem, not the solution.

Get in touch
Shapes Shapes