Top 11 Best Cloud Security Testing Service Providers in Australia
Quick answer
Cloud security testing is a hands-on check of your AWS, Azure or Google Cloud environment: configuration, identity and access, storage, network exposure and the applications running on top. In Australia, look for a provider that can show CREST accreditation (confirm whether it is CREST ANZ, CREST International or both), named experience on your cloud platform, and a report your auditor or regulator will accept. This guide lists CyberSapiens plus ten providers with evidence in Australia. It is not a ranking and we have not tested these firms, so check each provider’s certificate before you sign.
Most Australian organisations now run something in the cloud, and the cloud provider only secures its side of the arrangement. Your accounts, identities, settings, data and applications are your responsibility, and that is where most cloud incidents start: an over-permissioned role, a public storage bucket, a forgotten test environment.
Cloud security testing finds those gaps before an attacker does. It combines a review of how your environment is configured with hands-on attempts to exploit weaknesses, then reports what to fix first. For regulated sectors it can also supply the evidence an auditor or regulator asks for.
This page explains who offers cloud security testing in Australia, what each source says about them, and how to choose. We kept only firms where we found an Australian presence and a CREST listing or a CREST statement on the firm’s own site, plus a source that mentions cloud testing. After CyberSapiens, the order is alphabetical.
The Providers
CyberSapiens is listed first as the publisher of this page. The other ten follow in alphabetical order. Each entry states what the source says, and “ask” notes show what we could not see.
Recommended
1. CyberSapiens
CyberSapiens is a cybersecurity consultancy with its head office in Port Melbourne and offices in Australia, Canada, India and the USA. Its cloud VAPT service assesses configurations, permissions and services across AWS, Azure and GCP, and covers public, private and hybrid environments. Its page says the team includes EHC, OSCP and CISSP certified professionals with cloud specialisation, and that testing is run to keep disruption to live services minimal. Platform-specific pages cover AWS, Azure and GCP penetration testing.
States: ISO 27001:2022 certification; CVSS-rated findings with proof of concept; a free re-test on every engagement.
Note: CyberSapiens does not hold CREST accreditation, so it may suit work where CREST is not a contract, customer or regulator requirement.
How a CyberSapiens cloud test runs
1. Define scope
Agree the cloud assets, services and compliance goals to test.
2. Plan the assessment
Choose manual and automated methods that fit your architecture.
3. Recon and mapping
Map the attack surface and likely weak points.
4. Vulnerability scanning
Scan for known threats, misconfigurations and weak points.
5. Penetration testing
Simulate real attacks to prove impact, within agreed rules.
6. Reporting
Receive findings with risk ratings and mitigation steps.
7. After-sales support
Get guidance and patch validation until fixes are confirmed.
Teams that have worked with CyberSapiens
2. Acumenis
A Brisbane-based consultancy with a second location in Toowoomba, according to its Clutch profile. The profile says its CREST-accredited team tests web and mobile applications, APIs, cloud platforms (AWS, Azure and Google Cloud), corporate networks and wireless environments. The CREST listing does not break down cloud testing, so ask for a sample cloud report and which testers hold cloud certifications. See the CREST listing and the Clutch profile.
States: CREST penetration testing accreditation; Essential Eight and ISO 27001 listed as company certifications; fewer than 10 employees; 6 years of CREST membership (listing).
3. Borderless CS
A Sydney-based penetration testing firm. Its site says it tests networks, web applications, APIs, cloud environments on Azure and AWS, Microsoft 365 and internal systems, and describes itself as CREST-accredited. Its own pages claim accreditation under both CREST ANZ and CREST International, which we could not confirm independently, so check the CREST marketplace and ask for the certificate. See the Borderless CS page.
States: CREST ANZ and CREST International accreditation (company claim).
4. Cliffside
A Sydney-headquartered firm with teams in Sydney, Melbourne and Brisbane. Its penetration testing page says cloud testing covers Azure, AWS and hybrid environments, including IAM misconfigurations, storage bucket permissions, serverless function security and container escape paths. The page refers to OSCP, OSWE, OSCE and CREST-certified testers rather than a CREST-accredited company, so ask whether the firm itself holds CREST accreditation. See the Cliffside page.
States: Australia-based testers with no offshore delivery; fixed-fee quotes; lead auditors since 2008.
5. Cloudtrace
An Australian cybersecurity firm that serves Amazon Web Services customers. Its CREST listing shows penetration testing accreditation, and says it is an AWS Advanced Tier Services partner with the Level 1 Managed Security Services Provider Competency and a PCI SSC Qualified Security Assessor Company. Services include PCI DSS and ISO 27001 compliance, penetration testing, code reviews, secure coding training and cyber incident response. The listing centres on AWS, so ask about Azure or Google Cloud testing if you need it. See the CREST listing.
States: ISO 27001 certified by BSI; focus split of 50% security testing, 30% managed security services and 20% governance, risk and compliance advisory; fewer than 10 employees; 1 year of CREST membership (listing).
6. CyberCX
Its site describes more than 1,400 cyber security and cloud professionals, and its CREST page says CyberCX holds CREST membership as part of its assurance offering. For cloud, its Azure Secure Configuration Assessment page covers review of Azure configuration against best practice, and an AWS Marketplace listing says its security configuration review covers AWS tenancies, instances, VPCs and services. Ask which team and office would deliver your engagement and whether the CREST accreditation covers the testers assigned. See the CREST page, the Azure assessment page and the AWS Marketplace listing.
States: CREST membership for penetration testing; AWS and Azure configuration reviews (company pages).
7. HackLabs
HackLabs Australia says it is CREST-accredited with offices in Sydney, Melbourne, Brisbane and Singapore. Its site lists cloud security work including architecture reviews, security assessments and hardening for AWS, Azure and GCP environments, aimed at finding misconfigurations and design flaws. We could not match it to a CREST register entry in our search, so ask for the certificate and which testers hold cloud certifications. See the HackLabs site.
States: penetration testing, red team operations, incident response, cloud security and managed SOC services (site).
8. Intrix
An Australian security firm whose penetration testing page covers network, web application, cloud, mobile, API, IoT, social engineering and red team work. Its cloud section covers AWS, Azure and GCP and focuses on misconfigurations and access control issues, and it says assessments follow OWASP, NIST, PTES, OSSTMM and CREST guidance. The page shows a CREST logo but gives no register entry, so ask for the certificate. See the Intrix page.
States: ISO 27001 certified; risk-rated reports showing what was found and how to fix it (page).
9. Stratus Security
A Melbourne-based offensive security consultancy. A CREST announcement dated 9 March 2026 says Stratus received CREST accreditation for penetration testing and vulnerability assessment. Its CREST marketplace entry describes CREST-aligned penetration testing, red-team operations and cloud security assessments that pair cloud expertise with adversary simulation. The accreditation is recent, so ask for examples of cloud engagements and a sample report. See the CREST announcement and the CREST marketplace.
States: CREST accreditation for penetration testing and vulnerability assessment (March 2026).
10. Tesserent (Thales Cyber Services ANZ)
Its CREST listing says Thales Cyber Services was formerly known as Tesserent in Australia and New Zealand and was acquired by Thales Australia in October 2023, and shows penetration testing accreditation. A trade report says it is a Microsoft Solution Partner in security, Azure infrastructure and modern work. The sources we read do not describe its cloud testing in detail, so ask for its cloud scope, a sample report and which team tests AWS, Azure or GCP. See the CREST listing and the trade report.
States: CREST penetration testing accreditation; ISO 27001 process certification (trade report); CREST membership start date 1 May 2023 (listing).
11. Vectra
Part of Ensign InfoSecurity. Its penetration testing page says all testing is done in Australia by Australia-based testers, and its infrastructure testing covers cloud posture, including AWS, Azure and GCP reviews. The page says it has been a CREST-certified Australian provider since 2001, while its CREST marketplace entry shows 1 year of membership and penetration testing accreditation, so ask which CREST body issued each accreditation. See the Vectra page and the CREST listing.
States: six CREST accreditations across security testing and red teaming; Australia’s first certified QSA company in 2006; 10 to 49 employees (page and listing).
Provider details come from each source and may change. Confirm current scope, accreditations and terms with the provider before you buy.
What Cloud Security Testing Covers
Cloud testing focuses on your side of the shared responsibility model: the accounts, settings, identities, data and applications you control. A good scope usually spans these areas.
Configuration
Settings across accounts, subscriptions and projects, compared with vendor guidance and benchmarks such as CIS.
Identity and access
Roles, permissions, privilege escalation paths, multi-factor authentication, conditional access and service accounts.
Storage and data
Public buckets and blobs, database exposure, encryption in transit and at rest, and key management.
Network exposure
Security groups, firewall rules, internet-facing services and how well workloads are segmented.
Containers and serverless
Kubernetes permissions, container breakout risks, function permissions and build pipelines.
Cloud-hosted apps and APIs
Web applications and APIs running in the cloud, tested for access control, input handling and business logic.
Logging and detection
Whether the right logs are switched on and kept, and whether an attack would raise an alert.
Each cloud provider publishes its own rules for security testing. Amazon, Microsoft and Google all set conditions on what you may test and how, so confirm your provider’s current policy and give your tester written authorisation before testing starts.
Cloud Penetration Test vs Cloud Configuration Review
Providers sell these separately or together, and they answer different questions. Many cloud-native companies benefit from both.
| Configuration review | Penetration test | |
|---|---|---|
| Main question | Is the environment set up securely? | Can a weakness be exploited, and what would the impact be? |
| Method | Checks settings, identity, logging and encryption against best practice. | Simulates an attacker chaining weaknesses into a real attack path. |
| Output | A list of gaps against a benchmark, with fixes. | Proven findings with evidence, risk ratings and remediation steps. |
| Best when | You are new to a platform, migrating, or want broad coverage across many accounts. | A customer, auditor or regulator wants proof that controls hold up under attack. |
How to Choose a Cloud Security Testing Provider
Use these checks to compare providers on evidence rather than on marketing claims.
1. Check the accreditation
In Australia, “CREST accredited” can mean CREST International or CREST ANZ. CREST says its formal relationship with CREST ANZ ended in April 2019 and that CREST ANZ membership alone is not recognised as equivalent. Look the firm up on the CREST marketplace and ask which body issued the certificate. Company accreditation is different from individual testers holding CREST exams.
2. Ask about your cloud platform
AWS accounts, Azure subscriptions with Entra ID, and Google Cloud projects use different identity models. Ask for testers with experience and certifications on your platform, and for a sample report from a similar engagement.
3. Agree the scope in writing
List the accounts, regions, services and applications in scope, what is excluded, whether testing is configuration review, exploitation or both, and when testing may run.
4. Look at the report
Ask for a redacted sample. Good reports rank findings with a recognised scale such as CVSS, include evidence and fix guidance, and read well for both engineers and executives.
5. Confirm retesting
Ask whether a retest after your fixes is included, how long it stays open, and whether you get an updated report you can give to an auditor or customer.
6. Ask where the work happens
Check where testers are based, where findings and logs are stored, and whether your contracts or regulator expect Australian-based delivery. Government work may have extra requirements.
Australian Rules and Frameworks That Affect Cloud Testing
Which rules apply depends on your sector and customers. These come up most often. This section is general information, not legal advice.
APRA CPS 234 Information Security
CPS 234 has applied to APRA-regulated entities since 1 July 2019. It expects entities to systematically test the effectiveness of their information security controls, including controls run by third parties, with the frequency matched to factors such as how fast threats change and how critical the information assets are. It does not set one penetration testing checklist, so scope should reflect your assets and risks. See the APRA CPS 234 standard.
APRA CPS 230 Operational Risk Management
CPS 230 took effect on 1 July 2025 and covers operational risk, critical operations and service provider arrangements, which includes cloud providers. For information security it points entities back to CPS 234, so technical testing is usually mapped to CPS 234. Confirm transition arrangements for your existing contracts with APRA or your adviser.
ACSC Essential Eight
The Essential Eight is the Australian Cyber Security Centre’s set of baseline mitigation strategies and maturity levels. Cloud testing can show whether controls such as multi-factor authentication and restricted administrative privileges work in your cloud tenancy. See our ACSC Essential Eight service.
Information Security Manual and IRAP
Government agencies, and suppliers that serve them, often need cloud services assessed against the Information Security Manual by an IRAP assessor. An IRAP assessment is separate from penetration testing, although test results can support it. Ask any provider whether it has IRAP assessors or works with them.
Privacy Act 1988 and the Notifiable Data Breaches scheme
Australian Privacy Principle 11 requires organisations to take reasonable steps to protect personal information, and the Notifiable Data Breaches scheme requires notification of eligible breaches. Neither names penetration testing, but regular cloud testing is one practical way to show reasonable steps. See our data privacy services.
ISO 27001, SOC 2 and PCI DSS
Customers and auditors often ask for a recent independent test report. PCI DSS includes penetration testing requirements, and ISO 27001 and SOC 2 both expect evidence that you manage technical vulnerabilities. See our guides to ISO 27001 and SOC 2 compliance in Australia.
Do ask each customer, auditor or regulator what evidence they accept before you buy a test.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor
ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Cloud Security Testing in Australia: Frequently Asked Questions
What is cloud security testing?
It is an authorised assessment of your cloud environment that looks for weaknesses in configuration, identity, data protection, network exposure and the applications you run there, then reports how to fix them.
What is the difference between a cloud penetration test and a configuration review?
A configuration review checks whether the environment is set up securely. A penetration test tries to exploit weaknesses to show the real impact. Many organisations use both.
Do I need a CREST-accredited provider?
Not always. Some customers, contracts and regulated sectors prefer or ask for it, so check what yours require. If CREST is required, confirm whether CREST International, CREST ANZ or either is acceptable.
Do I need permission from AWS, Microsoft or Google?
Each cloud provider publishes its own testing rules. Follow the current policy for your platform and get written authorisation from the owner of the resources before testing starts.
How often should we test?
At least annually and after significant changes is a common practice. Your regulator, customers or contracts may set their own frequency, and APRA-regulated entities should match testing to risk.
How much does it cost, and how long does it take?
It depends on the number of accounts or subscriptions, the services in use, the depth of manual testing and whether a retest is included. Ask for a quote and timeline against a written scope.
Will testing disrupt our live services?
Testing is normally planned to keep disruption low. Agree the rules of engagement, test windows and contacts up front, and use a non-production copy for riskier tests where you can.
Can a provider outside Australia test our cloud?
For most private-sector work, yes, if your contracts and regulators allow it. Ask where testers are based and where findings are stored. Government and some regulated work may expect Australian-based delivery.
Need Cloud Security Testing for Your Australian Business?
Talk to CyberSapiens about your cloud platforms, scope and goals. We will help you decide what to test first and whether our cloud VAPT service fits your requirements.
Contact Us