Professional services
A scoped penetration test with a report, a debrief for your technical and executive teams, and a retest once fixes are in.
Scope a penetration test
PENETRATION TESTINGFind out what an attacker could reach, then close the path.
Manual penetration testing by individually certified testers, with every finding ranked by business impact, a fix for each one, and a retest to prove it holds.
- 01Internet · exposed serviceEntry
- 02Stolen credentialBroken
- 03Domain adminUnreachable
- 04Customer dataProtected
Illustrative example · Path broken after the fix
- ISO/IEC 27001 certified
- SMB1001 Gold
- Nueva 24x7 SOC
- In house digital forensics and incident response
- CREST Registered Testers in our team
- ARN Innovation Awards: SMB Partner of the Year 2024 and 2025
The challenge
A scan tells you what is weak. A test tells you what is exploitable.
Vulnerability scanners produce long lists. They do not show which weaknesses an attacker can chain together to reach your customer data, your finance system or your domain admin account. Too many test reports end with the same list of findings as last year, because nobody owned the fixes.
How Nueva helps
Test like an attacker. Report like an advisor. Fix like an engineer.
Our testers work manually, supported by tooling, to find the paths that matter. Findings are ranked by business impact rather than by score alone, and each comes with a fix. Nueva engineers can close the gaps, and we retest to confirm they are closed.
Attack path
Before the fix, and after the retest.
A test shows how weaknesses chain together. The fix breaks the chain, and the retest proves it.
- 01InternetEntry
- 02Exposed serviceReachable
- 03Stolen credentialReachable
- 04Domain adminReachable
- 05Customer dataReachable
Four steps from the internet to customer data.
Illustrative example.
What we do
Tests we run
- External penetration testing. Your internet facing systems, as an outside attacker sees them.
- Internal penetration testing. What an attacker could reach once inside, including Active Directory and Entra ID attack paths.
- Web application and API testing. Aligned to the OWASP testing guides.
- Mobile application testing. Aligned to the OWASP mobile testing methodology.
- Cloud penetration testing. Azure, AWS, Google Cloud and Microsoft 365.
- Wireless testing.
- AI and LLM application testing. Prompt injection, data leakage and agent abuse.
WHAT YOU RECEIVE
What is in a Nueva test report
- An executive summary written for your board and leadership team
- Attack paths, not just findings: how weaknesses chain together to reach something that matters
- Each finding ranked by business impact, with evidence, reproduction steps and a fix
- A debrief for your technical team and a separate one for your executives
- A retest once fixes are in, to confirm they hold
“Nueva has helped us stay audit-ready for ISO 27001 and RFFR, test our defences the way a real attacker would, and make sure our data in Azure and Microsoft 365 is protected and recoverable.”
Read the SSI story
Nueva CyberA defined engagement Your extended testing team
A project or a partnership. Your call.
Managed service
A planned testing calendar, testing after major change, remediation tracked to closure and reporting on how your exposure trends over time.
Talk about a testing programHow it works
From first call to proof it holds.
STEP 01 OF 06
Recommended frequency: at least once a year, and after any major change: a new application, a cloud migration, an acquisition or a significant incident.
Outcomes
What changes for you.
- A clear view of your real, exploitable exposure
- Fixes ranked by business risk, and confirmed by retest
- Evidence for boards, insurers, auditors and customers
One team across three practices
- Nueva CyberProve the path, then retest
- Nueva TechnologyEngineers close the path
- Nueva SecurePhysical entry points on request
Customer outcome
Settlement Services International
Security you can prove, data you can recover
Nueva keeps SSI audit-ready for ISO 27001 and RFFR, tests defences like a real attacker, and protects Microsoft 365 and Azure data.
- Cyber
- Technology
YHA Australia
Safer stays, on site and online
Nueva helped YHA Australia modernise video security across its hostel network and build cyber maturity it can measure, year on year.
- Cyber
- Secure
FAQ
Questions buyers ask us.
Still deciding? Talk to a security specialistAre your testers CREST certified?
Our testers hold individual CREST Registered Penetration Tester certifications, alongside OSCP, OSWE, OSEP, CRTO, CRTP and GIAC GPEN. Nueva is not a CREST accredited company. If a tender or contract requires company level CREST accreditation, tell us early and we will confirm whether we can meet it.
How often should we test?
At least once a year, and after any major change: a new application, a cloud migration, an acquisition or a significant incident.
Will testing disrupt our systems?
Every test runs under written rules of engagement agreed before testing starts, covering scope, timing and how to pause testing if something unexpected happens.
What is the difference between a penetration test and a red team?
A penetration test finds and proves exploitable weaknesses in a defined scope. A red team pursues a specific objective, such as reaching sensitive data, and tests whether your people and detection can spot and stop it.
Should we do a penetration test or a red team?
A penetration test finds as many exploitable weaknesses as possible within a defined scope. A red team pursues specific objectives across the organisation to test whether your detection and response would stop a real attacker. Most organisations start with penetration testing and move to red teaming as their controls mature.
Nueva Cyber
See your environment the way an attacker would.
Cyber incident happening now?+61 2 7252 5678
Call our incident team any time. If we can't answer straight away, leave a message and a responder will call you back as soon as possible.