A penetration test, also known as ethical hacking, is an authorised and carefully controlled attempt to break into your organisation’s information technology (IT) systems, applications, cloud services, premises and people, in the same way a real attacker would, but with your permission and without the damage. The goal is simple: find the weaknesses before someone else does, explain clearly what they mean for your business, and give you a prioritised plan to fix them.
01
Scoping and Agreement
We meet with you to understand your business and agree what will be tested, when, and the rules of engagement. Nothing is tested without your written authorisation.
02
Information Gathering
We collect publicly available information about your organisation, including domain names, internet-facing systems, staff details and leaked passwords, just as a real attacker would.
03
Scanning and Testing
We identify the systems, services and accounts in scope, look for vulnerabilities and misconfigurations, and safely attempt to exploit them to prove the real-world risk, without disrupting your business.
04
Reporting and Debrief
You receive a plain-language executive summary and a detailed technical report, with every finding rated by risk and a clear recommended fix. We then walk you through the results.
05
Retest
Once fixes are in place, we retest every finding to confirm it has been resolved, and update your report so you have evidence for your board, insurer or auditor.
Every engagement ends with two reports. An executive summary written for business owners and boards explains your overall risk in plain language. A technical report for your IT team lists each finding with its risk rating, supporting evidence and the steps needed to fix it, in order of priority.
Recognised testing standards
- Open Worldwide Application Security Project (OWASP)
- National Institute of Standards and Technology (NIST) Cybersecurity Framework
- Open Source Security Testing Methodology Manual (OSSTMM)
- Penetration Testing Execution Standard (PTES)
- New Zealand Information Security Manual (NZISM)
- Australian Government Information Security Manual (ISM)
Retest included
After you have fixed the issues we found, we come back and retest them, so you know they are resolved rather than assumed to be.
Backed by Computer Services Ltd
Whitehat is the security testing division of Computer Services Ltd, which has supported more than 200 organisations across New Zealand and Australia since 2004. When we find a problem, we can also help you fix it.
Whitehat is led by Alex Locatelli, Director and Chief Technical Officer of Computer Services Ltd. Alex has worked in information technology since 1996, holds a degree in Computer Science, and is a Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defender (CND), Cisco Certified Network Associate (CCNA) and Microsoft Certified Systems Engineer (MCSE). Every engagement is scoped, tested and reported by Alex personally, so you deal directly with the person doing the work.
Not sure where to start? Book a free, no-obligation scoping call. We will talk through your systems and concerns and recommend the testing that makes sense for your business and budget.
Social Engineering and Phishing Simulation
People remain the most common way in. We run realistic, pre-agreed scenarios, including phishing emails, phone calls impersonating your help desk or a trusted supplier, and payment redirection attempts, to measure how your team responds. The results are turned into practical, blame-free training. Recommended: At least twice a year.