Security Built Into the Software We Build

A vulnerability assessment is a systematic scan and review of your environment to identify known weaknesses; it catalogues what is potentially exploitable. A penetration test goes further: testers actively attempt to exploit discovered vulnerabilities, chain them together, escalate privileges and demonstrate real world impact. Penetration tests answer the question “can an attacker actually use this to cause harm?” rather than simply “does this weakness exist?” Both are valuable: regular scanning catches new issues quickly, while periodic penetration tests check that your defences hold against a motivated attacker.

Security is tested during every build, including automated penetration testing before launch. Static analysis, dependency scanning and container scanning run on every change, and we fix what they find as we go. An independent penetration test by a specialist firm is your choice, and we can help you arrange it.

It should not. The automated penetration testing we run before launch is aimed at a staging environment that mirrors production, so live users are not affected. If you commission an independent penetration test against production, the testing firm agrees testing windows and rules of engagement with you, and we help set those up.

The right cadence depends on your risk and how often your system changes. Many organisations run a full penetration test at least once a year, and many compliance frameworks expect one. Systems that change often, or that handle financial or health data, may warrant more frequent testing, with continuous automated scanning in between. We can suggest a cadence that fits your risk and budget; an independent test by a specialist firm is your choice.

Yes, for the systems we build and run. Cloud environments bring their own risks: complex identity and access management, misconfiguration at scale, confusion over the shared responsibility model and fast moving infrastructure. We review cloud setups against CIS benchmarks and the provider security frameworks, check infrastructure as code for insecure patterns, and set up detective controls such as AWS Security Hub, GuardDuty and GCP Security Command Center so misconfigurations are caught automatically.

No. Our methodology is aligned with SOC 2 and ISO 27001 controls, and we can map the controls in the software we build to those frameworks so your auditor has what they need. Certification is done by an accredited auditor, and whether your system meets a standard is for them to confirm.

No. AWLabs is not CREST accredited, and we do not present our testing as a CREST accredited test. Our security testing is led by experienced engineers using recognised methods, such as the OWASP testing guidance, alongside the automated scanning and automated penetration testing we run during every build. If a contract, regulator, insurer or compliance framework requires a test by a CREST accredited provider, we can work alongside that provider, scope the test with you, give the testers what they need and fix the findings in the software we built, or refer you to an accredited provider directly.

Start with a Discovery Audit. It is a fixed fee, credited in full against the build. It sets out the risks we find across your product, including security, and assesses it against recognised standards, so you know where the highest risk gaps are before anything is built or changed. If you also want an independent penetration test of an existing system, we can help you find a specialist firm.

If a system we built or support has a security problem, contact us and we will work with you to contain it and fix the cause in the software. We do not run an incident response team or forensic investigations; for a serious breach, engage a specialist incident response firm. Whether you must notify anyone under the Notifiable Data Breaches scheme in the Privacy Act 1988 is a question for your lawyer, and the Office of the Australian Information Commissioner publishes guidance on it.

Secure software development means building security into every stage of the software lifecycle, from design and threat modelling through code review, dependency scanning and security testing to deployment and monitoring, instead of testing for problems only at the end. Frameworks such as the NIST Secure Software Development Framework and the OWASP guidance describe the practices; we apply them in our own delivery and can help your team adopt them.

Application security testing checks your own software for weaknesses attackers could exploit. It combines static analysis of source code, dependency scanning for known vulnerable libraries, dynamic testing of the running application, and manual penetration testing of the logic automated tools miss, such as broken access control between users.

Most Australian penetration tests cost about $8,000 to $55,000 (AUD, ex GST), according to published price guides. A small external test of one web application sits around $8,000 to $14,000, an application with several user roles around $16,000 to $30,000, and a multi site internal network around $30,000 to $55,000. Automated scanning packages are cheaper. These are third party market ranges, not our quote; our penetration testing cost guide explains the drivers.

A security audit reviews your controls against a standard or checklist, covering areas such as access management, logging, backups, patching and policies, while a penetration test tries to exploit the running system. An audit shows whether the right protections exist; a pen test shows whether an attacker can get past them. Most organisations benefit from both. For software, a code audit adds a third view by reading the source itself.

Only if something still requires it. On 15 October 2026 ASD published ASD Essentials, which evolves the Essential Eight into principles, actions and domains, with chapters for enterprise IT, cloud and operational technology. ASD says organisations should keep meeting any regulatory, contractual or other obligations that require Essential Eight implementation or reporting, and PSPF Release 2026 still names Maturity Level Two for each strategy for the entities it covers. Government clients, insurers or contracts may still ask for a target level. Otherwise, ASD advises against starting work solely to reach a superseded Essential Eight target. Our Essential Eight guide explains what changed for software you build or buy.