ISO 27001 and Penetration Testing Companies in Auckland
Which Companies Provide ISO 27001 and Penetration Testing in Auckland?
Providers such as CyberSapiens, Thales Cyber Services (formerly Tesserent), Amaru, NZInfoSec and CyberCX serve Auckland, but their services differ, so check which of ISO 27001 support and penetration testing each one offers. A penetration test is not mandatory for ISO 27001, but it is strong evidence that your technical controls work.
Why Auckland Organisations Pair ISO 27001 with Penetration Testing
ISO 27001 gives you a management system, and a penetration test shows whether its technical controls hold up against a real attacker. Buyers in Auckland increasingly ask for both, and this guide compares five providers that serve the city.
How the Two Fit Together
ISO 27001 certification
Sets up and certifies your information security management system: risks, policies and controls.
Penetration testing
Checks whether controls such as patching, access and configuration actually work against an attacker.
Three Things to Know First
A.8.8 and A.8.29
The ISO/IEC 27001:2022 standard does not require a test, but auditors expect evidence under these two controls. Older guides cite 2013 numbers such as A.12.6.1, which no longer apply.
Privacy Act and NZISM
Breaches likely to cause serious harm must be notified, as the Office of the Privacy Commissioner explains. Government suppliers may also be asked to align with the New Zealand Information Security Manual.
We publish this guide
CyberSapiens is listed first, so the next section sets out our selection criteria. We support Auckland organisations remotely from our Australian office.
Our Recommended Sequence
Implement controls
Put the controls your risks call for in place first.
Test before Stage 2
Run the penetration test, fix the findings and retest.
Repeat on a schedule
Test again on a risk-based schedule, commonly yearly and after major changes.
Our ISO 27001 certification and implementation service and vulnerability assessment and penetration testing service follow this same sequence.
Top 5 ISO 27001 and Penetration Testing Companies in Auckland
The five providers below can support Auckland organisations with ISO 27001, penetration testing, or both. CyberSapiens publishes this guide and is listed first, and the order is not a ranking of quality. Details come from each provider’s public information as of October 2026, so confirm scope and pricing with them directly.
How We Assessed These Providers
- Breadth of ISO 27001 support, from gap analysis through to audit preparation or certification.
- Depth and accreditation of penetration testing services.
- Presence in Auckland or New Zealand.
- Fit for the size and sector of the organisation buying the service.
One detail buyers often miss is accreditation. The CREST Australasia page states that CREST ANZ membership alone is not recognised by CREST International as equivalent, so ask any tester which accreditation they hold. It is also worth confirming that the firm testing your systems is separate from the people who designed your controls.
Comparison at a Glance
| Provider | Presence | ISO 27001 support | Penetration testing | Best suited to |
|---|---|---|---|---|
| CyberSapiens | Australian office, serving Auckland remotely | ISO 27001:2022 consulting and implementation | VAPT across web, mobile, API, cloud, network, infrastructure and IoT | Organisations wanting one team for both |
| Tesserent | Australia and New Zealand, including Auckland | Governance, risk and compliance advisory | Penetration testing services | Organisations wanting a broad cyber security provider |
| Amaru | Auckland-based, New Zealand and Australia | Compliance services | CREST-accredited penetration testing | Organisations wanting a locally based team |
| NZInfoSec | Auckland-based, operates virtually | ISO 27001 audit, certification and training | Not a core service, appears in PCI DSS work | Organisations mainly needing a certification audit |
| CyberCX | New Zealand and Australia | ISO 27001 services within its governance, risk and compliance practice | CREST penetration testing across many test types | Organisations wanting a large testing team |
1. CyberSapiens
CyberSapiens is a cyber security and compliance consultancy that is itself ISO 27001:2022 certified. It supports Auckland organisations remotely from its Australian office, covering both ISO 27001 and penetration testing with one team. Because the same team handles both, testing findings can feed directly into your risk register and Statement of Applicability.
What it offers
- ISO 27001 certification and implementation, including gap analysis, risk assessment, policy design, control deployment and audit preparation.
- Vulnerability assessment and penetration testing for web applications, mobile applications, APIs and cloud environments.
- Testing of networks, infrastructure and IoT devices.
Best suited to
Organisations that want ISO 27001 implementation and penetration testing planned together, with no hand-offs between separate firms.
Talk to CyberSapiens2. Tesserent
Tesserent is a cyber security services provider operating across Australia and New Zealand, with an Auckland presence. Public information describes governance, risk and compliance advisory alongside penetration testing, so both needs can sit under one brand. It is a broad services provider, so confirm how its ISO 27001 work is scoped for an organisation of your size.
Best suited to
Organisations that want a broad cyber security provider across advisory and testing.
3. Amaru
Amaru, formerly Simplify Security, is an Auckland-based information security and compliance provider working across New Zealand and Australia. Its penetration testing is CREST accredited, and it offers compliance services alongside testing. Ask which CREST accreditation applies to the team that would test your systems.
Best suited to
Organisations that prefer a locally based New Zealand team for both compliance and testing.
4. NZInfoSec
NZInfoSec is an Auckland-based firm that operates virtually and focuses on audits, certification and training for ISO 27001, ISO 27701, ISO 22301, SOC 2 and PCI DSS. Penetration testing appears in its PCI DSS work rather than as a standalone service. If you choose it for certification, you may need a separate provider for broader penetration testing.
Best suited to
Organisations that mainly need an independent certification audit or training.
5. CyberCX
CyberCX is a cyber security firm operating across New Zealand and Australia with a local presence in New Zealand. Its CREST penetration testing covers web, mobile, network, wireless and thick client testing, among other types, and it offers ISO 27001 services within its governance, risk and compliance practice. Ask whether its testing and ISO 27001 teams work to a shared plan for your engagement.
Best suited to
Organisations that want a large testing team with a wide range of test types.
Which Provider Should You Choose?
If you want ISO 27001 implementation and testing planned together, shortlist providers that offer both and ask how findings flow into your risk assessment. If you mainly need a certification audit, a certification-focused firm may fit, with testing arranged separately. Whichever route you take, book testing early enough to fix and retest findings before your Stage 2 audit.
Certification and consulting are normally kept separate, so the firm that certifies you should not be the one that built your management system.
Choosing the Right ISO 27001 and Penetration Testing Partner in Auckland
ISO 27001 gives your organisation a structured way to manage information security, and penetration testing shows whether the technical controls inside it work against a real attacker. Penetration testing is not required for certification, but it is the clearest evidence for the vulnerability management and security testing controls auditors review. The best provider for you depends on whether you need both services, a certification audit, or deep testing capacity.
Testing your security measures is also consistent with New Zealand Government guidance. The Protective Security Requirements information security policy includes a requirement to validate your security measures, and it advises organisations beyond government agencies to adopt these requirements as best practice.
Three Practical Next Steps
Define your scope
Decide which systems, teams and data your ISMS covers. A clear scope also tells a tester exactly what to attack and what to leave alone.
Shortlist and question providers
Pick two or three providers from the list above. Ask about independence, accreditation, scope mapping, reporting and retesting.
Book testing before Stage 2
Schedule the test once controls are in place, and leave time to fix and retest findings before your certification audit.
If you want one team to plan both, our ISO 27001 certification and implementation and VAPT services are designed to run together.
Plan Your ISO 27001 and Penetration Testing Together
Speak with a CyberSapiens expert about your scope, timeline and certification goals. We support Auckland organisations remotely from our Australian office.
Book a Free ConsultationFrequently Asked Questions
Is penetration testing required for ISO 27001 certification?
No. ISO 27001:2022 does not explicitly require a penetration test, but auditors expect evidence that technical vulnerabilities are identified and managed under control A.8.8, and a test is one of the clearest ways to show it. Testing also supports A.8.29 on security testing and feeds your risk assessment, so most organisations with exposed systems include it as a risk-based decision.
Which companies offer ISO 27001 and penetration testing in Auckland?
CyberSapiens, Tesserent, Amaru and CyberCX all offer some combination of compliance support and penetration testing, while NZInfoSec focuses on ISO 27001 audits and certification. CyberSapiens publishes this guide and supports Auckland organisations remotely from its Australian office, so confirm each provider’s scope directly before you decide.
When should an Auckland organisation run a penetration test, and how often?
Run the test after your controls are in place and before your Stage 2 audit, so you can fix and retest findings first. After that, test on a schedule set by your risk assessment, commonly once a year and after major changes such as a new application or a cloud migration.
How long does ISO 27001 certification take in Auckland?
It depends on your size, scope and existing security maturity, but many projects take several months from gap analysis to certification. The certification audit has two stages, and the certificate is typically valid for three years with annual surveillance audits.
How much do ISO 27001 and penetration testing cost in Auckland?
Cost depends on scope, including the number of systems, applications, staff and test types, so providers normally quote after a scoping call. When comparing quotes, check whether the price includes a written report with fix guidance and a retest of the issues found.
Can the same company consult on ISO 27001 and certify my organisation?
Generally no. Accredited certification bodies must stay impartial, so the firm that certifies you should not be the one that built your management system. You can use one provider for consulting and penetration testing and a separate accredited body for the certification audit.
Content reviewed by Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
