We find what
scanners miss —
before attackers do.

Penetration testing (pen testing) is an authorised, simulated cyberattack against a software system, network or application, designed to identify exploitable vulnerabilities before real attackers do. KiwiQA's certified ethical hackers use the same tools, techniques and methodologies as malicious actors — including OWASP ZAP, Burp Suite, Metasploit and custom exploit scripts — but operate under a defined scope, rules of engagement and legal authorisation. Every engagement concludes with a risk-rated findings report containing proof-of-concept evidence, CVSS severity scores, business impact analysis and a prioritised remediation roadmap. Pen testing is distinct from automated scanning — it catches logic flaws, business workflow vulnerabilities and chained attack vectors that scanners miss.

OWASP (Open Worldwide Application Security Project) is a non-profit foundation that publishes the OWASP Top 10 — the globally recognised list of the most critical web application security risks, updated every 3–4 years based on real-world vulnerability data. The 2021 edition includes injection, broken access control, cryptographic failures, insecure design and security misconfigurations. KiwiQA uses the OWASP Testing Guide as the foundation for all web and API security assessments, ensuring comprehensive coverage of known vulnerability classes. OWASP compliance is referenced in ISO 27001, SOC 2, PCI DSS and the Australian Government Information Security Manual — making it the baseline standard for any defensible security posture.

KiwiQA offers a comprehensive suite of security testing services including web application penetration testing, mobile app penetration testing (iOS and Android), API security testing against the OWASP API Security Top 10, network and infrastructure penetration testing, cloud security review (AWS, Azure, GCP), vulnerability assessment and management, OWASP Top 10 testing, threat modelling and architecture review, GDPR/Privacy Act compliance auditing, PCI DSS testing, ISO 27001 gap assessment, AI-specific security testing including prompt injection and model extraction, and secure code review. All services are delivered by OSCP, CEH or GPEN certified engineers with industry-specific experience.

KiwiQA tests APIs against the OWASP API Security Top 10, covering broken object-level authorisation (BOLA), authentication and authorisation weaknesses, excessive data exposure, rate limiting gaps, mass assignment vulnerabilities, security misconfigurations, injection flaws and improper asset management. We test both REST and GraphQL APIs, examining every endpoint for authentication bypass, privilege escalation, data exfiltration and business logic flaws. Tools include Burp Suite Pro, OWASP ZAP, Postman and custom Python scripts for chained attack scenarios. Every finding includes a request/response proof-of-concept, CVSS score, business impact statement and specific remediation guidance — not just a scanner export.

KiwiQA tests against ISO 27001, SOC 2 Type I and II, PCI DSS Levels 1–4, HIPAA (healthcare data), GDPR (EU personal data), the Australian Privacy Act 1988, NIST Cybersecurity Framework, the Australian Government Information Security Manual (ISM), OWASP Top 10, SANS Top 25 and the EU AI Act for AI system security. We deliver compliance evidence packages — including test reports, vulnerability evidence, remediation records and executive summaries — that are suitable for submission to external auditors, regulators and certifying bodies. Our reports are accepted by Big Four audit firms and government procurement panels.

Engagement timelines vary by scope and application complexity. A web application penetration test typically takes 5–10 business days for execution and 2–3 days for reporting. Mobile app pen tests take 3–7 days. Network and infrastructure assessments range from 3 days for small environments to several weeks for complex enterprise networks. API-only assessments typically take 3–5 days. KiwiQA provides a detailed scope of work and timeline estimate in every proposal, based on the number of endpoints, user roles, business functions and integration points involved. Urgent engagements with compressed timelines can be accommodated with additional resource allocation.