IT security: penetration testing
Penetration testing in Auckland, Wellington and Christchurch
A penetration test is a controlled attack on your own systems, run by people on your side, to prove which weaknesses an attacker could actually use. You get a risk-ranked report with plain-language summaries for leadership, technical detail for your IT team, and a retest once the fixes are in. For New Zealand businesses of 20 to 200 staff.
Or call 0800 242 206
Why choose OxygenIT for penetration testing
Experienced specialists
Testing is run by security specialists with hands-on experience across networks, web applications, Microsoft 365 and cloud environments, working to recognised testing frameworks.
Knowledge of the New Zealand threat landscape
From targeted phishing to misconfigured cloud services, we know what is actually hitting New Zealand businesses. Every test reflects genuine threats to organisations in Auckland, Wellington and Christchurch, not a generic global checklist.
Manual testing beyond automated scans
Automation helps and it does not catch everything. We add careful manual validation to find the subtle flaws and logic errors scanning tools routinely miss.
Clear, business-focused reporting
Structured, plain-language reports with an executive summary and detailed technical findings. Each issue is risk-ranked with practical, prioritised remediation steps.
Remediation and retesting
The engagement does not stop at the report. We work with your IT and security teams to close the gaps, then verify the fixes.
Our penetration testing services
Cyber threats do not all look the same. Some probe from the outside, others start from within. Each engagement combines skilled manual testing with proven frameworks to expose weaknesses safely, accurately and without disrupting your operations.
Network penetration testing
Internal and external testing of your perimeter defences, firewalls and access controls, to check exactly how your network holds up against real-world attack.
Web application penetration testing
We examine your sites and web apps for authentication flaws, injection weaknesses and insecure coding that could be used to reach data or escalate privileges.
Cloud and Microsoft 365 security testing
Your cloud platforms hold critical information. We evaluate configuration, identity and permission controls across Microsoft 365 and public or hybrid cloud environments against security and compliance requirements.
Internal security testing
If an attacker or an insider gains limited access, how far could they go? We emulate that scenario to uncover lateral-movement paths, privilege escalation risks and internal misconfigurations before they can be abused.
Wireless network testing
Wireless convenience should not mean an open door. We test your Wi-Fi for weak encryption, unauthorised devices and segmentation gaps that give an attacker an easy way in.
Our penetration testing methodology
A structured approach that delivers accurate, repeatable outcomes while keeping your systems safe and operational.
Scoping and engagement planning
We define objectives, systems in scope and testing parameters. This sets boundaries and priorities so the project stays focused on real business risk.
Controlled attack simulation
Specialists replicate authentic attacker behaviour in a planned, monitored engagement. Every action is contained so you see how your defences respond under pressure without the consequences.
Vulnerability validation and exploitation
Not every alert is a real threat. We manually validate and, where safe and agreed, carefully exploit vulnerabilities to confirm what is genuinely exploitable.
Risk assessment and prioritisation
Technical discoveries become clear, ranked risks. You see which issues pose the highest threat and where to focus remediation first.
Reporting and remediation guidance
The report includes plain-language summaries for leadership, technical detail for your IT team, and practical advice for remediation and retesting.
Benefits of professional penetration testing
Regular testing gives you a true picture of your resilience: clear insight into how secure your systems really are, and the knowledge to strengthen them before an attacker tries.
Identify exploitable weaknesses
We simulate the tactics most attackers use, show exactly which vulnerabilities can be exploited, and how to shut them down.
Validate existing security controls
Tools and policies sound good on paper. We test them under pressure to confirm that controls, configurations and response plans work.
Cut breach risk and downtime
A single missed gap can take your systems offline or cost you a client. Early detection and decisive fixes keep outages, and headlines, off your plate.
Satisfy audits and client security demands
Whether it is ISO/IEC 27001, SMB1001, PCI DSS or a customer’s due diligence, test results give you hard evidence rather than assurances.
A stronger posture after every test
Each test feeds into better configurations, quicker response and less time putting out fires.
Common security weaknesses we identify
Even well-maintained systems hide vulnerabilities. Testing goes beyond automated scans to expose the flaws that stay hidden until they are breached.
Exposed services and misconfigurations
Open ports, outdated software and loose settings create new attack surfaces. We locate them so you can close them first.
Weak authentication and access controls
Basic login methods or shared credentials make it easy for an intruder to move around. We review access paths and recommend stronger, layered authentication.
Vulnerable web applications
Flaws in code or logic leave a door open to sensitive data. We identify injection points, insecure handling and broken access controls.
Cloud configuration weaknesses
Cloud platforms gain speed and lose protection through poor permissions or loose integrations. We check configuration, identity and policy alignment.
Privilege escalation risks
If one compromised account can cascade into complete control, an incident becomes a disaster. We map those internal routes so your team can restrict them.
What you receive from a penetration test
More than numbers or scan output. Reports are structured for both business and technical readers:
- A detailed penetration testing report
- Executive and technical summaries
- Risk-ranked vulnerabilities
- Clear remediation recommendations
- Audit and compliance evidence
Findings feed straight into your remediation plan, and into the risk register if you run our vCSO service.
Penetration testing cost, retesting, and what to check before you sign
Vulnerability scanning and penetration testing solve different problems, and pricing depends on more than the number of systems in scope. Here is what drives cost, what to expect from retesting, and what to confirm before you commit to any provider, including us.
Vulnerability scanning versus penetration testing
A vulnerability scan uses automated tools to find known issues quickly and cheaply, which suits regular hygiene checks and patch verification. A penetration test uses manual validation to confirm which of those issues are actually exploitable, which is what audits, compliance reviews and new system launches usually require. Most businesses use both: regular scans for broad coverage and a targeted test on critical assets for proof of real-world risk.
What drives penetration testing cost
Scope size, asset count, application complexity, authentication flows and cloud footprint. Time-and-materials pricing suits a scope that may change during the engagement. A fixed-scope quote gives budget certainty for a clearly defined project. Add-ons such as source code review, social engineering, and wireless or physical testing increase the price and add value where the risk profile justifies them.
Retesting and remediation support
Ask what counts as a fix, not just whether a patch was applied, because a software update does not always close every access path a test uncovered. Confirm whether a retest is included in the quoted price or charged separately, how long the retest window stays open, and how residual risk is documented and formally accepted if something cannot be closed straight away.
What to check before you sign
- What sits inside and outside the agreed scope
- Expected deliverables, timelines and reporting depth
- Whether remediation support is advisory only or hands-on
- Retesting terms and how residual risk gets signed off
- Every assumption built into the quote
A clear, detailed quote against this checklist is the difference between a penetration test that closes real risk and one that just produces a report.
Penetration testing FAQs
How often should penetration testing be conducted?
At least once a year, or after a major system change. Regular testing finds vulnerabilities early and confirms that earlier fixes still hold. Between tests, a vulnerability assessment cycle covers the broad hygiene checks.
Is penetration testing safe for live systems?
Yes. Each scenario is planned to keep your network, users and applications running while testing takes place. Anything with a realistic chance of disruption is agreed with you in advance, scheduled outside peak hours, or excluded from scope.
Do you provide remediation support?
Yes. We work with your IT staff, or our own managed IT team, to prioritise vulnerabilities, apply practical fixes and verify through retesting that the gaps have been closed.
Can this help with compliance or audits?
Yes. Penetration testing supports ISO/IEC 27001, SMB1001, PCI DSS and customer due diligence by providing documented evidence of testing, analysis and remediation. See IT compliance services for the certification work around it.
How long does a penetration test take?
It depends on scope and complexity. A typical engagement runs five to ten business days, followed by reporting sessions that walk through findings, risk priorities and remediation steps.
Talk to a founder about testing
Fifteen minutes with a founder, not a sales rep. Tell us what you run and who is asking for the test, and we will tell you plainly whether you need a penetration test yet or whether an assessment should come first.
Or call 0800 242 206
