How Pensure works
Every Pensure test runs the same way: agreed scope, real attack techniques against your live system, and a report that tells you what to fix first.
No day rates. No open-ended scoping. You know the price and the process before you start.
Who does what
Traditional testing asks you to write a scope document, sit through kick-off calls and chase a quote. We have removed most of that.
Your part
2 minutesof your time, total.
Only if you want authenticated areas covered
Our part
Everything after that.
The method
The same sequence runs whether you buy Core or Core Plus. Core is AI-powered and fully automated. Core Plus adds hands-on testing by a specialist penetration tester.
We confirm the target in writing: domains, IP ranges, authenticated areas, and anything off limits.
We map what is actually reachable - exposed services, subdomains, endpoints, technologies and versions.
We attempt real exploitation, safely and within the agreed window. A theory is not a finding until it is proven.
Issues get joined into full attack paths - not “a misconfiguration”, but how someone reaches your customer data.
Every material finding must be supported by technical evidence before write-up, so your remediation time goes straight to what is real.
An executive summary for the people asking for assurance, technical detail for the people doing the fixing.
We tell you what to fix first. Once you have fixed it, we retest to confirm the issue is closed.
Methodology
Our method follows recognised industry testing standards, and every finding is scored on a consistent severity scale - so a security questionnaire or an auditor can be answered straight from the report.
The categories reviewers expect to see covered.
Core is Level 1-informed. Core Plus is Level 2-aligned. Full Level 3 verification is tailored.
Comparable across tests and across vendors.
Testing and reporting are managed in Australia.
The deliverable
One report, written for two audiences: the people who have to fix the findings, and the people who have to be satisfied they were addressed.
The page you forward to a customer, an insurer or a board.
Ranked by what an attacker could actually reach, not by scanner score.
Your engineers can confirm each finding themselves rather than take our word for it.
Specific to your stack, then retested to confirm the issue is closed.
This is an example layout. Severity counts and finding titles are examples, not results.
Ready when you are
Start with your URL. We confirm the scope with you before any testing begins — and the price is the price.
Start a test
