Penetration testing — pen testing — is a controlled, authorised attempt to break into your own systems: a security professional acts as an attacker, probes your networks, applications and staff for exploitable weaknesses, and reports what they found and how to close it. The difference between a pen test and being hacked is paperwork: a pen test is agreed in advance, bounded in scope, and produces a report instead of a breach. This guide covers what a pen test actually involves, what it costs, how often a small business needs one, and how it differs from the automated scanning most businesses should start with.
TL;DR
- A penetration test is an authorised, controlled attack on your own systems to find exploitable weaknesses before real attackers do.
- It goes beyond automated scanning: a human tester chains small weaknesses into a real intrusion path.
- Small business should not start with a pen test — start with patching, MFA and vulnerability scanning, then pen test annually or after major change.
- Cost ranges widely: a scoped web-app or external pen test typically runs thousands of dollars, not tens of thousands.
- Pen tests also earn compliance credit — Essential 8 maturity, ISO 27001 and cyber insurers increasingly ask for one.
What penetration testing means in plain terms
A vulnerability scanner tells you which doors are unlocked. A penetration tester walks up to them, tries each one, and finds out how far in they go — and whether they chain together into a path that reaches your customer data. The tester works from the same starting point as a real attacker: a target, public information, and whatever access they were granted in the scope.
The output is a report: each finding ranked by severity, the exact steps that reproduced it, the business impact, and the specific fix. Unlike an automated scan, the report answers the question that matters — 'does this weakness actually matter for us?' — because the tester proved the answer rather than inferred it.
What a pen test covers
| Test type | What is tested | Typical scope |
|---|---|---|
| External network | Internet-facing systems — VPN, firewalls, public servers | Attack from outside, no credentials |
| Internal network | The environment a laptop user sees | Simulated insider or compromised laptop |
| Web application | Your website, customer portal or admin panel | Login, business logic, injection, access control |
| Social engineering | Phishing against staff | Simulated email, SMS or voice campaigns |
| Physical | Offices, shared devices, badge systems | On-site attempts, often combined with social engineering |
Most small businesses commission the first three: external network, internal network and web application. Social-engineering testing overlaps heavily with the phishing simulations a security awareness training platform runs monthly — if that is already in place, a full social-engineering pen test adds limited new signal.
What a pen test actually costs
| Engagement | Typical 2026 range | Notes |
|---|---|---|
| External network pen test | $4,000-$12,000 AUD | Depends on IP range size and complexity |
| Web application pen test | $5,000-$15,000 AUD | Depth of the app drives the range |
| Internal network pen test | $8,000-$20,000 AUD | Requires on-site or remote access setup |
| Retest after fixes | Often $1,000-$3,000 AUD | Validates the fixes landed |
These ranges reflect typical Australian market pricing for scoped engagements — quotes vary by provider, scope and depth, so treat them as planning figures rather than quotes. The retest line is worth flagging: a pen test whose findings are never retested is only half done, because the finding is not closed until the retest proves it.
How often should a business pen test?
| Trigger | Frequency | Notes |
|---|---|---|
| Baseline for regulated or insurer-driven businesses | Annually | ISO 27001 and most cyber insurers expect it |
| After a major change | Before go-live | New app, migration, network redesign |
| High-risk environments (fintech, health, government contractors) | Every 6-12 months | Regulatory or contractual driver |
| Small business starting out | Not first — scan first | Fix the basics before paying for depth |
Annual is the standard rhythm for businesses with compliance or insurance drivers. For a small business with no external driver, the honest sequencing is: patching, MFA, backups and monthly vulnerability scanning first — because a pen test on unpatched, unmonitored systems produces a report full of things a free scan would have found for nothing.
How a pen test runs, end to end
- Scope and rules of engagement. What systems, what is off-limits, what hours, who to call if something breaks. Written down before anything starts.
- Reconnaissance. The tester maps what is publicly visible — domains, exposed services, staff names, leaked credentials.
- Exploitation. Controlled attempts to gain access through the weaknesses found, chaining small gaps into a larger path.
- Post-exploitation. How far in: what data is reachable, what systems are traversable, what an attacker could actually do.
- Reporting. Findings ranked by severity, with reproduction steps, business impact and specific fixes.
- Remediation and retest. Fixes applied, then a retest confirms the criticals are closed.
What pen testing proves that scanning cannot
A scanner reports that version X of software Y has a published vulnerability. A pen tester proves what happens next: that the vulnerability is reachable, that it yields credentials, that those credentials open the file server, and that the file server holds the payroll export. That chain is what boards, insurers and auditors respond to — it converts an abstract risk into a demonstrated path.
Pen tests also produce evidence. Essential Eight maturity levels, ISO 27001 and cyber insurance renewals increasingly ask for recent pen test reports, and a cyber security gap assessment tells you which of those frameworks expects what, and where your controls stand before the question is asked.
The human layer a pen test surfaces
Many pen tests end not in a technical exploit but in a person: the credential handed to a phishing page, the MFA approval granted to an unexpected prompt, the help-desk password reset granted to a confident voice on the phone. These findings are common because technical controls have improved while the human layer has not.
That is why penetration testing and awareness training are complementary, not competing. The pen test measures whether staff hold up under a live, targeted attack; training builds the reflex that makes them hold up every other day of the year. Cyber Aware's security awareness training runs monthly with simulated phishing and same-day remediation, while human risk reporting tracks whether the reporting reflex is landing, person by person and month by month.
FAQ
What is a penetration test in simple terms? An authorised, controlled attempt to break into your own systems by a security professional, producing a ranked report of exploitable weaknesses and their fixes.
How much does a pen test cost in Australia? Typically $4,000-$20,000 AUD depending on scope — external network tests at the lower end, internal network and web application tests higher. Retests are cheaper than the original test.
How often should a small business pen test? Annually if there is a compliance or insurance driver. Without one, fix the basics and scan monthly first — pen testing unpatched systems mostly finds what a free scan already knows.
What is the difference between a pen test and vulnerability scanning? A scan lists known weaknesses automatically; a pen test proves which of them actually lead to a breach by exploiting them. Scans are monthly; pen tests are annual or event-driven.
Will a pen test disrupt our systems? Competent testers avoid disruption, but the risk is not zero — that is what the rules-of-engagement document and the emergency contact are for. Schedule intrusive testing in maintenance windows.
Does a pen test include phishing staff? Often, as a social-engineering add-on. If a training platform already runs monthly phishing simulations, a separate social-engineering pen test adds limited new signal.
One last thing
Before commissioning a pen test, run one free vulnerability scan and fix what it finds. If a free scan produces a page of criticals on internet-facing systems, spend the pen-test budget on patching instead — a pen test on a well-patched environment is worth ten times what it is on an unpatched one, and the report reads completely differently.