--- title: Penetration Testing & Technical Assurance description: Human-led penetration testing, red team exercises, web app and API security testing for Australian enterprises. Augmented by Korrosiv.AI for deeper coverage. image: https://saltt.tech/hubfs/raw_assets/public/saltt-theme/images/og-default.png --- [![SALTT Technologies](https://www.saltt.tech/hubfs/raw_assets/public/saltt-theme/images/logo.svg)](https://www.saltt.tech/) - [Home](https://www.saltt.tech/) - [Services](https://www.saltt.tech/services) [Cybersecurity Architecture & Engineering](https://www.saltt.tech/services/security-architecture) [Penetration Testing & Technical Assurance](https://www.saltt.tech/services/penetration-testing) [AI Cybersecurity](https://www.saltt.tech/services/ai-cybersecurity) [Governance, Risk & Compliance](https://www.saltt.tech/services/grc) [CyberOps Management](https://www.saltt.tech/services/cyberops) [View all services →](https://www.saltt.tech/services) - [About](https://www.saltt.tech/about) - [Insights](https://www.saltt.tech/insights) - [Contact](https://www.saltt.tech/contact) [Get in Touch](https://www.saltt.tech/contact) [Services](https://www.saltt.tech/services) › Penetration Testing & Technical Assurance Capability 02 # Penetration Testing & Technical Assurance Human-led adversarial testing, augmented by Korrosiv.AI — our in-house AI-native pen testing engine. We find what automated scanners miss and replicate the techniques of real threat actors, giving you a true picture of your exposure before an attacker does. [Enquire About This Service](https://www.saltt.tech/contact) [All Services](https://www.saltt.tech/services) What's included - External & internal penetration testing - Web application security testing - API security assessments - Red team engagements - Cloud configuration reviews - Assumed breach exercises - Technical security assurance - Vulnerability assessments The challenge ## Automated scanners find known problems. Attackers find the rest. Vulnerability scanners are a starting point, not a finish line. Real-world attackers combine technical skill, creative thinking, and persistence to find paths through your environment that no tool would flag. A clean scan report is not the same as a secure organisation. SALTT's offensive security services (OSS) capability approaches every engagement the way a motivated threat actor would — methodically, with business context in mind, and focused on what would actually cause you harm. Every finding comes with a risk-rated remediation plan your team can action.   External & Internal Penetration Testing Network penetration testing from both external (internet-facing) and internal (assumed network access) perspectives. Identifies exploitable paths through your perimeter and internal environment. Web Application Security Testing Manual assessment of web applications against OWASP and industry standards, augmented by Korrosiv.AI — our AI-native testing engine that analyses 100% of responses and adapts payloads in real time. API Security Testing Targeted assessment of REST and GraphQL APIs, powered in part by Korrosiv.AI's purpose-built API testing capability. Identifies excessive data exposure, broken object-level authorisation, and injection flaws. Red Team Engagements Adversary simulation exercises that test your detection and response capability against realistic, multi-stage attack scenarios. Designed to challenge your blue team, not just find vulnerabilities. Cloud Configuration Reviews Assessment of AWS, Azure, and GCP environments against security best practices and CIS benchmarks. Identifies misconfigured services, excessive permissions, and insecure architecture patterns. Assumed Breach Exercises Starting from a foothold inside your environment, we test what an attacker could access, escalate, and exfiltrate. Focuses on detection gaps and lateral movement paths. Technical Security Assurance Independent technical review of security controls, architecture decisions, and implementation quality. Used to validate that built systems meet their security design intent before go-live. Vulnerability Assessments Structured, scoped assessments that identify and risk-rate known vulnerabilities across your environment. Delivered with prioritised remediation guidance — not just a raw CVE list. ### What you gain - A clear, risk-rated picture of your exploitable vulnerabilities - Remediation guidance prioritised by business impact — not just severity score - Evidence for board reporting, compliance requirements, and cyber insurance - Validated detection and response capability against realistic attack scenarios - Independent assurance that security controls are working as intended - A trusted testing partner who understands your environment over time Start Here ### Talk to a specialist Tell us what you're trying to solve and we'll scope the right engagement. [Book a Consultation](https://www.saltt.tech/contact) All Services - [Security Architecture & Engineering](https://www.saltt.tech/services/security-architecture) - [Technical Testing & Assurance](https://www.saltt.tech/services/penetration-testing) - [AI Cybersecurity](https://www.saltt.tech/services/ai-cybersecurity) - [Governance, Risk & Compliance](https://www.saltt.tech/services/grc) - [CyberOps Management](https://www.saltt.tech/services/cyberops) Related Insights ## Resources from our team Podcast 30 Sep 2026 The Prompt Injection Podcast The Prompt Injection Podcast SALTT Tech Insights, Episode: Prompt Injection Is a Permissions Problem [Read article →](https://www.saltt.tech/insights/prompt-injection-podcast) Cybersecurity 30 Sep 2026 Prompt Injection Is a Permissions Problem Prompt Injection Is a Permissions Problem Two national agencies say the model can't be fixed. Google says attackers aren't waiting. Here's w... [Read article →](https://www.saltt.tech/insights/prompt-injection-is-a-permissions-problem) Cybersecurity 22 Jul 2026 The First Agentic Breach Was an Accident In July 2026, two of the most capable AI models in the world broke out of a locked-down test environment, found their way onto the open inte... [Read article →](https://www.saltt.tech/insights/openai-hugging-face-agentic-breach-2026) ## Ready to get started? Our team works across Australia. Every engagement is led by experienced practitioners — not offshore subcontractors. [Get in Touch](https://www.saltt.tech/contact) [![SALTT Technologies](https://www.saltt.tech/hubfs/raw_assets/public/saltt-theme/images/logo.svg) SALTT Technologies](https://www.saltt.tech) All Australian cybersecurity partner. Sydney · Melbourne · Brisbane. Services - [Security Architecture](https://www.saltt.tech/services/security-architecture) - [Penetration Testing](https://www.saltt.tech/services/penetration-testing) - [AI Cybersecurity](https://www.saltt.tech/services/ai-cybersecurity) - [GRC](https://www.saltt.tech/services/grc) - [CyberOps](https://www.saltt.tech/services/cyberops) Company - [About Us](https://www.saltt.tech/about) - [Insights](https://www.saltt.tech/insights) - [Contact](https://www.saltt.tech/contact) Legal - [Privacy Policy](https://www.saltt.tech/privacy-policy) - [Product Supply Terms and Conditions](https://www.saltt.tech/productsupplytermsandconditions) - [Voluntary Statement Against Modern Slavery](https://www.saltt.tech/voluntary-statement-against-modern-slavery) © 2026 SALTT Technologies Pty Ltd. All rights reserved. ABN 32 660 169 808. [saltt.tech](https://saltt.tech) ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Penetration testing (pen testing) is an authorised simulated cyberattack against your systems to identify exploitable vulnerabilities before malicious actors do. SALTT Technologies delivers human-led penetration testing for networks, web applications, APIs, and cloud environments across Australia." }, "name" : "What is penetration testing?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A penetration test targets specific systems or applications in a defined scope within a set timeframe. A red team exercise simulates a full, realistic adversary campaign — testing people, process, and technology with minimal scope constraints. SALTT Technologies offers both, tailored to your threat model." }, "name" : "What is the difference between a penetration test and a red team exercise?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A standard web application or network penetration test typically takes 5–10 business days, depending on scope. SALTT Technologies provides a scoping call to define the engagement and timeline before any work begins." }, "name" : "How long does a penetration test take?" } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://www.saltt.tech", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://www.saltt.tech/services", "name" : "Services", "position" : 2 }, { "@type" : "ListItem", "item" : "https://www.saltt.tech/services/penetration-testing", "name" : "Penetration Testing & Technical Assurance", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://saltt.tech/#organization", "@type" : [ "ProfessionalService", "LocalBusiness" ], "address" : [ { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "North Sydney", "addressRegion" : "NSW", "postalCode" : "2060", "streetAddress" : "Level 4/1 James Place" }, { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "Melbourne", "addressRegion" : "VIC", "postalCode" : "3000", "streetAddress" : "Suite 4423, 805/220 Collins Street" }, { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "Brisbane City", "addressRegion" : "QLD", "postalCode" : "4000", "streetAddress" : "Suite 4126, 29/97 Creek Street" } ], "areaServed" : "AU", "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "AU", "contactType" : "sales", "email" : "hello@saltt.tech" }, "description" : "All Australian cybersecurity consultancy providing technical testing, AI security, GRC, security architecture, and CyberOps services.", "foundingCountry" : "AU", "knowsAbout" : [ "Cybersecurity", "Penetration Testing", "AI Security", "Governance Risk and Compliance", "Security Architecture", "CyberOps" ], "legalName" : "SALTT Technologies Pty Ltd", "logo" : "https://saltt.tech/hubfs/raw_assets/public/saltt-theme/images/logo.svg", "name" : "SALTT Technologies", "sameAs" : [ "https://www.linkedin.com/company/saltt-technologies" ], "url" : "https://saltt.tech" } ```