You can feel it before you even open the laptop. A sales call is going well, the buyer is nodding, then they ask for your latest pentest report. If you've got a SaaS product, customer data, SSO, APIs, maybe a mobile app too, that question lands like a brick. No report means no comfort, and in a lot of cases, no deal.
That's why penetration testing services have moved from “nice to have” to “show me now” for NZ and AU founders. The pressure isn't just enterprise procurement either. Investors ask. Auditors ask. Enterprise customers ask. And in New Zealand, the local threat picture gives that pressure real weight, not abstract worry. CERT NZ's 2024 Cyber Security Insights Report recorded 7,122 incident reports and NZ$1.2 million in total reported financial losses, with credential theft and compromise at 36% and fraud and scams at 22% of incidents, plus 56% of reported incidents carried out by organised groups (CERT NZ incident data summary). That's not background noise. That's the business climate.
New Zealand's cyber services market is growing too. The Cyber Daily Australia/New Zealand market profile places the NZ cybersecurity market at NZ$1.24 billion in 2024, with a forecast of NZ$1.58 billion by 2028, which implies about 6.2% annual growth. It also says there were around 2,552 cyber professionals in 2024 and roughly 1,721 job openings, which tells you a simple thing, there aren't enough in-house specialists to cover every gap (NZ market profile and talent data). That's one reason founders keep bringing in external testers. It's not a luxury line item. It's part of the security stack.
If you want a useful outside view while you're sizing up the market, find penetration testing in Saskatchewan is a decent example of how vendors frame the service elsewhere. The lesson is the same everywhere. Buyers don't want theatre. They want proof.
The founder on the call says, “We've got security covered.” Then the customer asks one more question, and the room goes quiet. Do you have a recent pentest? Can you show that the app's auth flow, admin access, and cloud setup were tested? If the answer is “not yet,” the deal starts wobbling. A lot of security work only becomes visible when someone outside the team asks for evidence.
For NZ and AU SaaS companies, the question is not whether testing sounds sensible. It is whether your buyers think your product is mature enough without it. If you sell into healthcare, fintech, B2B infrastructure, or any workflow that touches sensitive data, the ask becomes routine. Enterprise procurement loves checklists. Security review teams love documented findings. Nobody wants to be the person who waved through a shaky vendor.
New Zealand's incident data makes the case more concrete. With 7,122 incident reports in 2024 and most reported incidents tied to credential theft, fraud, scams, and organised groups, the local threat model is active, familiar, and expensive to ignore (CERT NZ incident data summary). The common weak spots are the usual suspects, exposed services, sloppy access control, weak authentication, and the odd misconfiguration that looks harmless until a real attacker pokes at it. Pentesting exists to find those faults before somebody else does.
Practical rule: If your product has login, payments, admin functions, or customer data, you are already in pentest territory. Waiting for a bigger revenue number is a risky habit.
There is another signal founders should not ignore. The NZ cybersecurity market is expanding, but the talent pool is tight, with 2,552 cyber professionals and 1,721 openings in the market profile cited above (NZ market profile and talent data). That shortage matters. It means buyers cannot assume internal teams will catch everything. External specialists fill a real gap, especially when engineering teams are already flat out shipping product.
NZISM changes the timing too. The manual requires penetration testing before systems go live, after significant change, and after exploitation of a vulnerability (NZISM testing trigger summary). That is a trigger-based model, not a once-a-year tick box. If you are running releases, cloud changes, or major feature work, the clock starts earlier than many founders expect.
For teams that want a broader buyer's view beyond New Zealand, the general market logic is similar across regions. Security evidence helps sales. It helps due diligence. It helps keep the next renewal from turning awkward. If you want a useful outside view while you are sizing up the market, find penetration testing in Saskatchewan is a decent example of how vendors frame the service elsewhere. Buyers do not want theatre. They want proof.
A lot of people hear “pentest” and picture someone hammering at a login page until something gives. That is the wrong mental model. Real penetration testing services are controlled, authorised, and evidence-driven. They are built to show whether an attacker can move through your system, not just whether a tool thinks something looks suspicious. The UK NCSC describes penetration testing as a way to gain assurance in the security of an IT system by trying to breach some or all of it using the same tools and techniques an adversary might use (NCSC definition and process). That sentence does most of the work. It is not a scan. It is a structured attempt to prove exposure.
Automated vulnerability scanning is useful, but it stops short of proof. A scanner can flag a weakness. A pentest shows whether that weakness gives an attacker a path. ScienceDirect describes penetration testing as a legal, authorised attempt to locate and successfully exploit computer systems, using proof-of-concept attacks to show vulnerabilities are real and to support specific recommendations for fixing them (ScienceDirect definition). That proof-of-concept part matters. Engineers fix clear impact faster than they fix vague warnings.
A scanner is the locksmith checking whether the front door is closed. A pentester is the locksmith testing whether the deadbolt, the side window, and the spare key under the mat all fail under pressure. One gives you a list. The other gives you a path an attacker could take.
The OWASP testing framework sets out PTES in seven phases, from pre-engagement and intelligence gathering through reporting (OWASP PTES framework). Other technical work describes five core stages, intelligence gathering, vulnerability scanning, exploitation, privilege escalation, and post-exploitation, and notes that there is no single universal definition of pentesting (arXiv paper on penetration testing stages). The labels vary. The discipline does not. Good pentesting is controlled work, not random poking.
A decent report does more than list weaknesses. It tells engineering teams what happened, how far the tester got, why the issue matters, and what to fix first. The better ones split executive summary from technical detail, so leadership can read the risk in plain English while developers get steps they can act on straight away. If the report just looks like scanner output with a logo on top, you paid for paperwork.
A good pentest report should feel like a map, not a trophy. It should point to the shortest route from weakness to fix.
Authorised testing is the key distinction. Real pentesters work inside a contract, under rules of engagement, with agreed scope and timelines. That is what makes the exercise useful to both your team and your customers. It gives you proof without chaos, which is the point.
Here's where founders waste money. They buy a “full” test because it sounds safer, then realise half of it doesn't touch their real attack surface. Or they go too narrow, test one web app, and leave cloud identity or mobile auth untouched. The right call depends on how your product works, not how a vendor brochure is worded.
If your product is mostly browser-based SaaS, a web application test is usually the first honest move. If your product leans on APIs, mobile clients, cloud IAM, or admin tooling, those need to be in scope too. For a lot of NZ and AU founders, the problem is not one giant perimeter. It's a messy stack of SaaS tools, cloud services, and user roles all glued together. That's why testing scope matters more than brand names.
For cloud-heavy teams, this often starts with infrastructure and identity review. If you want to see how cloud services fit into the rest of the stack, NZ Apps cloud IT services is a useful internal reference point for the kind of environment many local founders are running. Real-world stacks don't stay tidy for long. One SSO integration, one admin portal, one storage bucket used “temporarily,” and the attack surface gets busy fast.
| Test Type | What It Covers | Best For | Typical Duration |
|---|---|---|---|
| Web application test | Browser app, auth flows, session handling, roles, business logic | SaaS products, customer portals | Usually a short, focused engagement |
| API test | Endpoints, auth, object access, role controls | Products with heavy backend integration | Often similar to web tests, but more API-focused |
| Mobile app test | App storage, API calls, device-side risks | Consumer or field apps | Depends on platform and backend scope |
| Cloud test | IAM, exposed services, architecture, misconfigurations | AWS, Azure, or GCP-heavy products | Usually broader than a single app test |
| Network test | External or internal services, exposed assets | Older estates, hybrid environments | Often used for broader infrastructure review |
| Red team exercise | Realistic adversary paths and chained compromise | Mature security teams | Longer, more intensive, and more disruptive |
The table above is the clean version. The messy version is more useful. If your company is small and budget is tight, start where customer data or admin access lives. Don't pay for a big red-team style engagement if your real issue is a fragile web login and poor access control. That's like buying a sports car to drive to the dairy.
Red-team work has its place. So does deeper cloud testing. But they're not the default answer for every startup. If you're still smoothing out core product flows, a focused test gives better return than a broad, expensive sweep. The common mistake is assuming breadth equals safety. It doesn't. It often just means thinner coverage where it counts.
The best vendor will ask about authentication, roles, tenant boundaries, deployment model, and what changed since the last release. If they don't, they're probably selling a menu, not a service.
A proper pentest has rhythm. It starts slow, gets technical, then turns into a hard conversation about what failed. That structure matters because it keeps the work controlled and useful. NCSC breaks the service into five stages, initial engagement, scoping, testing, reporting, and follow-up (NCSC penetration testing guidance). PTES expands the same idea into a fuller workflow, from pre-engagement to reporting (OWASP PTES framework).
Initial engagement and scoping are where the tester and client agree what's fair game. You set boundaries, production versus staging, user accounts, APIs, IP ranges, and any business rules. It sounds dull. It isn't. Clear scope prevents scope creep, surprise outages, and the classic “we thought you were testing that too” mess.
For NZ and AU SaaS founders, the budget either gets used well or gets burned. If your app handles customer data, admin access, or regulated workflows, the first job is to decide exactly which environments and roles need scrutiny. That decision matters more than chasing a wide, noisy test that spends time on low-value surfaces.
Then comes intelligence gathering, which mirrors how a real attacker starts. Public-facing information, exposed services, app behaviour, and user journeys all tell a story. PTES treats this as a formal stage for a reason. Attackers do the same homework. They just don't send you a statement of work first.
Once the tester starts validating weaknesses, the work becomes methodical. They check whether a finding is real, whether it can be chained, and whether access can be raised from low privilege to something more dangerous. The flow usually runs through scanning, exploitation, privilege escalation, and post-exploitation, which is why a small issue can turn into a much larger exposure if the surrounding controls are weak. One weak control by itself is annoying. Two or three together become a breach path.
That chain matters for founders watching spend. A login flaw, a weak API check, or a bad tenant boundary can be far more serious than a long list of minor findings. If you are deciding where to spend first, start with the paths that reach customer data, admin functions, and the systems that would force you into disaster and recovery planning. That is the work that changes the outcome after an incident.
Useful mental model: A strong pentest report doesn't just say “this broke.” It shows how the break happened, what it reached, and where you should patch first.
Reporting is where good providers earn their keep. A sharp report gives evidence, screenshots where needed, reproduction steps, severity context, and remediation advice that engineering can work with. Follow-up matters too. Without it, you only know what was broken. You don't know whether your fixes held.
This is the point where budgets get tested. The report lands, the team opens a few tabs, everyone agrees the findings matter, and then the core question arrives, what gets fixed now, what waits, and who owns the work. If you do not turn findings into changes, the pentest was just expensive reading. That is the blunt version, but it is the right one.
Start with triage. Split issues that block revenue, issues that create real exploitation risk, and issues that are noisy but low impact. Then assign ownership by system, not by committee. Developers fix code. Cloud engineers fix infrastructure. Product owners handle business logic and access decisions. If everyone owns it, nobody does.
Retesting is the next step, and it is where serious teams separate real progress from wishful thinking. It proves the fix worked and did not just move the problem elsewhere. That matters when a customer, auditor, or enterprise prospect wants evidence that the work was done properly. If you need the business case for repeatable recovery work and resilience planning, disaster and recovery planning for SaaS teams sits in the same practical lane. Security work and recovery planning should talk to each other. Too many companies treat them like strangers.
CERT NZ's incident reporting shows the same pattern year after year, threats do not pause between annual reviews. That does not mean you need a giant engagement every month. It does mean a single report will not hold the fort for long if your app keeps changing. New releases, new integrations, new cloud settings, new staff, they all reopen questions that the old test never saw.
A better pattern for most SaaS teams is simple. Run a focused pentest, fix the important issues, retest the fixes, then fold the lessons into ongoing vulnerability management. That can be as plain as a backlog of security findings, tracked like product bugs, with owners and due dates. The more mature version is platform-based testing and recurring checks. The point stays the same, keep the feedback loop alive.
Do not let the report become a PDF that lives in a folder no one opens again.
The teams that get real value treat the test as a change cycle, not an event. That mindset is worth more than another glossy report.
A bad vendor choice can waste a founder's week on polished slides, vague promises, and a contract that hides the work. That is avoidable. You want a tester who can find issues, explain them in plain language, and stay useful when your team starts fixing them. The contract matters just as much. A loose scope note creates more pain than a missed finding.
Ask for the methodology first. If a provider cannot explain how they test, that is a bad sign. Ask for a sample report too, because the report is the product, not the logo in the email signature. You also want to know who will do the work, whether they are full-time testers, and how much hands-on experience they have.
Use a tight checklist in sales calls.
Contract terms should also reflect the timing rules you work under. The NCSC model still gives a clean structure for engagement, scoping, testing, reporting, and follow-up, and that structure belongs in the paperwork somewhere. In New Zealand, NZISM makes the trigger more direct, because testing is expected before systems go live, after significant change, and after vulnerability exploitation. If your provider acts like timing is optional, they are ignoring the environment around them. If you are sorting out compliance expectations as well, New Zealand GDPR and privacy basics is worth keeping beside the contract notes.
Cheap quotes can be fine. Suspiciously cheap quotes usually mean shallow testing, junior staff, or generic reporting. On the other side, a huge quote is not automatically better if the scope is padded with work you do not need. The right partner should be specific about assumptions and clear about why a certain depth fits your product.
A vendor's own checks matter too. If their online footprint looks sloppy, slow, or inconsistent, that is a warning sign, and red flags during online checks is a good reminder to look for those problems early. Founders should ask the awkward questions before they sign. It saves time, money, and embarrassment later.
Budget is where the coffee gets serious. You do not need to overbuy, but you also cannot pretend security evidence is free. For NZ and AU SaaS founders, the smart spend is the one that matches the actual blast radius of your product. A small web app test belongs in one budget band, a cloud-heavy or product-level assessment in another, and red-team work sits higher still. The point is not the sticker price. The point is whether the test tells you something useful before customers or regulators force the issue.
If your app is mostly one product, one auth system, and one clean deployment path, begin with a focused web or API test. If your product sprawls across web, mobile, cloud, and a pile of integrations, you need a wider scope from day one. Do not pay for testing you cannot act on. Do not pretend a tiny engagement covers a tangled platform. That is just expensive reassurance.
The NZ market context also makes outside help the sensible call. As noted in NZ market profile and talent data, the market for commercial testing is growing while specialist talent stays tight. That matters for founders trying to budget around product delivery, incident response, and compliance triggers at the same time. If you need credible testing without dragging your own engineers off the roadmap, a specialist provider is often the only clean option.
A practical first-engagement checklist looks like this:
My blunt take: If you can only afford one test this quarter, test the thing that would hurt sales or customer trust most if it failed.
If you are comparing providers, choose the one that fits your scope, compliance pressure, and pace of change. Ignore the flashy deck. Ignore the cheapest line item if it reads like a templated scan. Pick the partner that will give your team clear findings, enough context to fix them, and a retest path that proves the work moved the needle.
A CTA for NZ Apps.
Add your NZ or Australian app or tech company to the NZ Apps directory and get discovered by founders and operators across the region.
Get ListedReach tech decision-makers across New Zealand and Australia. Sponsored and dofollow editorial links, permanent featured listings, and sponsored articles on a DA30+ .co.nz domain.
See Options