Penetration Testing
Canberra
Intrix is a CREST certified penetration testing provider serving federal government departments, defence industry suppliers, and critical infrastructure operators across the ACT. Engagements are scoped and delivered by Australian based certified testers with no offshoring, and reports map directly to ISM controls, Essential Eight maturity levels, and PSPF requirements.
Join the leading organisations that trust us with their security
Canberra's Threat Profile Sits at the Centre of Federal Risk
Canberra is unlike any other Australian capital because the city is the operational base for the Commonwealth. Federal departments, defence agencies, and the Australian Signals Directorate sit within a few kilometres of each other across Russell, Barton, Campbell, and Brindabella Park. That density makes the city a continuous target for state aligned threat actors who treat federal networks and the supplier ecosystem around them as a priority.
The defence supplier base in Canberra carries security obligations that retail or commercial environments do not. Membership of the Defence Industry Security Programme, ISM aligned controls, and Essential Eight maturity reporting are not optional. A single failed audit can pull a contractor off a panel. Federal departments running OFFICIAL, OFFICIAL Sensitive, and PROTECTED workloads need testing methodologies that map cleanly to PSPF requirements and to IRAP assessor expectations.
Critical infrastructure operators in the ACT carry obligations under the Security of Critical Infrastructure Act, including risk management programme reporting and mandatory cyber incident reporting timeframes. Universities such as ANU and the University of Canberra hold sensitive research grants attractive to foreign collection. Technology vendors selling into Commonwealth procurement now face security questionnaires that ask about IRAP status, hosting certification, and DISP membership before a single demo is scheduled.
Canberra is not a smaller version of Sydney. The risk concentration is federal, the compliance frameworks are different, and the testers who work here need to understand how the Commonwealth assesses cyber risk rather than how a private sector security team thinks about it.
Why Canberra Organisations Choose Intrix for Penetration Testing
The scoping call is free and comes first. We agree on target systems, testing windows, rules of engagement, and reporting format, and confirm everything in writing before any work begins. For engagements involving classified or sensitive Commonwealth systems we discuss clearance requirements and any segregation rules with your security officer during scoping. Nothing starts until that is documented.
Active testing follows. Our testers work manually well beyond automated tooling, identifying chained vulnerabilities, business logic flaws, and trust boundary issues that scanners cannot find. For engagements needing physical presence in Canberra we deploy testers on site to Russell, Barton, Deakin, Civic, or your specified location.
The report is delivered within five business days of testing closing. It includes an executive summary suitable for an audit committee or board, full technical findings for your security team, a CVSS based risk rating on every vulnerability, proof of concept evidence, and remediation steps mapped where relevant to ISM controls and Essential Eight maturity levels. We remain available throughout remediation and conduct a verification retest once fixes are applied.
What a Canberra Penetration Testing Engagement Looks Like
Every engagement starts with a written scope that confirms target systems, testing windows, rules of engagement, and any clearance requirements specific to your environment. Testing is conducted manually by certified professionals on site or remotely depending on your requirements. For classified or air gapped environments we coordinate directly with your security officer before any work begins. Once active testing closes the report is delivered within five business days. It includes an executive summary for your board or audit committee, full technical findings mapped to ISM controls and Essential Eight maturity levels, CVSS rated vulnerabilities with proof of concept evidence, and remediation guidance. We remain available during remediation and conduct a verification retest once fixes are confirmed.
Who We Work With in Canberra
Federal Government departments come to Intrix because ISM aligned testing and PSPF obligations require independently verified security assessments and procurement panels want a CREST certified provider on file. Defence industry primes and second tier suppliers around Russell, Brindabella Park, and Fairbairn come because DISP membership and Commonwealth contract clauses require certified penetration testing on a documented schedule. Critical infrastructure operators come because risk management programme reporting and Security of Critical Infrastructure Act obligations need evidence based assessment, not a paper exercise.
Technology vendors selling into Commonwealth procurement come because their sales cycle now turns on IRAP status, hosting certification, and a current penetration test report. ACT Government agencies come because Territory cyber security policy requires periodic third party testing. Universities come because research grants and student data carry obligations that the Office of the Australian Information Commissioner takes seriously. Healthcare and aged care providers operating in the ACT come because the My Health Record system and Privacy Act obligations require evidence of ongoing assurance.
What is penetration testing and why do Canberra organisations need it?
Penetration testing is an authorised security assessment where certified professionals attempt to exploit vulnerabilities in your systems the same way a real attacker would. Canberra organisations need it to satisfy obligations under the Information Security Manual, the Protective Security Policy Framework, the Defence Industry Security Programme, and the Security of Critical Infrastructure Act, and to identify vulnerabilities in IT, cloud, and operational environments before an adversary does.
How much does penetration testing cost in Canberra?
A Canberra penetration testing engagement typically starts from a fixed price for a focused web application test and scales depending on scope, environment complexity, and clearance requirements. We provide a fixed price quote after the scoping call. Cost depends on the number of systems in scope, whether on site testing is required at Russell, Barton, or another Canberra location, and whether the engagement involves classified workloads.
Does Intrix test against the Information Security Manual and Essential Eight?
Yes. Every Intrix engagement involving Commonwealth systems can be mapped to ISM controls and to Essential Eight Maturity Model levels. The report identifies findings against specific control IDs so your team or your IRAP assessor can use the output as evidence in maturity assessments and audit responses. We test on the current ISM baseline and update our methodology each time the Australian Signals Directorate publishes a revision.
Does Intrix work with defence industry suppliers in Canberra?
Yes, Intrix works with defence industry suppliers operating around Russell, Brindabella Park, and Fairbairn in the ACT. Defence supply chain organisations face Commonwealth security obligations that require testing by independently certified professionals with documented methodology. Intrix holds CREST accreditation and our engagements follow the Australian Government Information Security Manual, satisfying the requirements of most defence procurement panels.
Can Intrix conduct penetration testing for IRAP assessments?
Yes. Intrix conducts penetration testing that produces evidence suitable for an IRAP assessor reviewing a system seeking certification or an existing certified system due for reassessment. Findings are mapped to ISM controls and presented in a format IRAP assessors can use directly. We can coordinate testing windows around the assessor’s schedule and provide artefacts in the format your assessor expects.
Ready to Uncover Your Hidden Risks?
Intrix Cyber Security provides CREST certified penetration testing to organisations across Canberra CBD, Civic, Barton, Russell, Deakin, Forrest, Belconnen, Woden, Tuggeranong, Gungahlin, and the broader ACT including Queanbeyan and the Capital Region. Contact our team to book a free scoping call.