External scans · Web apps · Pen testing
Vulnerability scanning and penetration testing
Automated scanning to find known weaknesses, manual testing where the risk justifies it, and clear reports with fixes and retesting included.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is an automated check for known weaknesses across your internet-facing systems, best run monthly or quarterly. A penetration test is a manual, expert attempt to exploit weaknesses and show what an attacker could achieve, best done before launches, after major changes or when clients require it. Cyberstore scans start in our $1,500 Starter assessment.
// Know the difference
Which do you need?
Both have their place. Most organisations should scan regularly and commission a penetration test when the stakes justify it.
| Vulnerability scan | Penetration test | |
|---|---|---|
| What it is | Automated discovery of known weaknesses | Manual, expert attempt to exploit weaknesses |
| Answers | "What is exposed and out of date?" | "What could an attacker do with it?" |
| Best for | Regular hygiene, broad coverage, compliance evidence | Launches, major changes, high-value systems, client or tender requirements |
| Frequency | Monthly or quarterly | Annually or per major release |
| Typical cost | Included in Starter ($1,500 + GST) and Ongoing plans | Scoped and quoted per engagement |
// What we test
Scanning and testing services
External vulnerability scanning
Internet-facing websites, servers, VPNs and services checked for known vulnerabilities, weak TLS and exposed admin interfaces.
Web application testing
CMS sites, portals, member areas and custom applications tested for injection, broken access control, authentication flaws and insecure configuration, guided by the OWASP Top 10.
Configuration audits
Server, hosting, DNS, Microsoft 365 and access control settings reviewed against good practice.
Penetration testing
Manual testing of applications and networks by experienced testers, delivered with specialist partners where the scope calls for it.
Reports you can act on
Every finding comes with a risk rating, evidence, what it means for the business and clear remediation steps. Your developers and IT provider get the technical detail; your leadership gets a one-page summary.
And because we fix websites for a living, we can close most web findings ourselves and retest to prove it.
Every report includes
- Executive summary for non-technical readers
- Risk-rated findings with evidence
- Step-by-step remediation guidance
- Retest of fixed issues
- Evidence suitable for insurers and tenders
// FAQ
Common questions
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan uses automated tools to find known weaknesses across many systems quickly. A penetration test goes further: a tester manually tries to exploit weaknesses, chain them together and show what an attacker could achieve. Scans are best done regularly; penetration tests are best before launches, after major changes, and when a client or regulator asks for one.
How often should we scan?
At least quarterly for most organisations, and monthly for sites that take payments, hold member or client data, or change often. Our ongoing consulting plan includes monthly scanning and reporting.
Will testing take our website down?
We plan testing to avoid disruption, agree timing with you in advance and avoid destructive tests on production systems. Higher-risk tests can be run against a staging copy.
Do you need our permission in writing?
Yes. We never test anything without written authorisation from someone entitled to give it, including hosting or cloud providers where their terms require it.
Will you fix what you find?
Yes, if you would like us to. Because we build and maintain websites and web applications, we can fix most web findings ourselves, and work with your IT provider on the rest.
// Keep going
Related services
Website Security & Maintenance
Website security and maintenance plans for Perth businesses: hardening, daily monitoring, tested updates and off-server backups for WordPress, Joomla and more.
Cyber Security Consulting
Independent cyber security consulting in Perth: risk assessments, Essential Eight, Privacy Act, incident readiness and board reporting. From $1,500.
Essential Eight Assessment
Essential Eight assessments for Perth and WA organisations: evidence-based maturity scores, a risk register and a practical roadmap to Level 2.
// Next step
Talk to us about Vulnerability Scanning & Pen Testing
Tell us what you run and what you are worried about. We will come back within one business day and, if it helps, send you a fixed-price quote.
- No-obligation first consult
- Fixed scope and price before work starts
- A clear written report and next steps
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
