September 30, 2025
Updated: November 5, 2026
NZ’s NCSC handled 1,129 incident reports in Q2 2026. Compare top pentest firms, PTaaS options, pricing, and compliance context (PCI DSS Req. 11.4, ISO 27001, NZISM).
Mohammed Khalil
Cyber risk in NZ remains high. NCSC NZ handled 1,129 incident reports in Q2 2026 alone, and Kiwi organizations face frequent and sophisticated attacks, especially identity abuse, phishing, SaaS token theft, API exploitation, and cloud misconfigurations. IBM puts the 2026 global average breach cost at a record $4.99M USD.
Comparing providers beyond New Zealand? Our worldwide list of penetration testing companies covers firms that deliver testing across regions.
Penetration testing is now a governance issue, not just IT. Some cyber insurers, auditors, and regulators ask for third-party manual testing and retests as evidence for policy issuance, renewals, or compliance; check your own policy and audit requirements.
Regulation and insurance are driving demand. PCI DSS v4.0.1, ISO 27001:2022, NZISM, and the Privacy Act 2020 shape the testing evidence New Zealand organizations are asked for, which pushes many toward more frequent validation rather than annual check-box audits.
What changed in 2026:
Selection criteria: Certifications (OSCP, CREST, CISSP, GIAC), manual exploit depth, service scope, compliance alignment, reporting quality, NZ delivery presence, innovation, and suitability for enterprise vs SMB vs regulated buyers. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.
Top providers highlighted:
Pricing: this guide does not quote NZD ranges because we found no public, verifiable New Zealand price data to support them; the cost-drivers section below explains what moves a quote.
Buyer guidance: Prioritize manual expertise, reporting clarity, retest inclusion, and API/identity coverage. Continuous testing is increasingly essential for cloud-native teams.
Common mistakes: Confusing vulnerability scans with real pentests, overvaluing tools, ignoring remediation quality, and overlooking identity/API attack surfaces.
New Zealand's National Cyber Security Centre (NCSC), a business unit of the GCSB that completed its integration of CERT NZ in July 2025, publishes quarterly incident data. The NCSC handled 1,129 incident reports in Q2 2026, with $2.7 million in reported direct financial losses. Phishing, credential harvesting, SaaS token abuse, and cloud misconfiguration remain common attack paths. Global breach cost averages reached a record $4.99 million USD per incident in 2026 according to IBM's Cost of a Data Breach report, and medium scale breaches in ANZ can run to seven figure recovery costs once legal, operational, and reputational impacts are considered.
Cyber insurance underwriting practices in the region have also evolved. Some insurers ask for third party validation, not only self reported questionnaires, before issuing or renewing policies, so evidence of manual penetration testing, remediation tracking, and retesting can help during underwriting. This makes penetration testing a board level governance issue as well as a technical best practice. Security leaders may be asked to demonstrate not only defensive controls, but evidence of resilience under simulated attack conditions.
The rules that most often bring a test into scope in New Zealand, including NZISM for government systems, Reserve Bank cyber resilience guidance for regulated financial entities, Privacy Act 2020 breach notification, and government Marketplace procurement, are summarized with sources in the regulatory and procurement section below. PCI DSS applies wherever card data is processed.
This comparison is based on official provider websites, public certification data, service transparency, methodology disclosure, and procurement oriented selection criteria. It is written for New Zealand organizations comparing providers of penetration testing, red teaming, cloud testing, PCI DSS testing, and PTaaS. The objective is not only vendor comparison, but clarity for decision makers balancing compliance mandates, technical depth, and long term risk reduction strategies.
Three practical changes matter for New Zealand buyers in 2026: incident reporting runs through the NCSC since CERT NZ's integration was completed in July 2025, many cloud and API teams now test more often than once a year, and scopes increasingly cover identity, SaaS and AI systems. The shifts below explain each one.
The rules that most often bring a penetration test into scope for New Zealand organizations are below (sources checked 3 November 2026).
Companies were selected and compared using the criteria below, designed to mirror real procurement decision processes; they were not scored:
Companies were compared across multiple dimensions rather than scored, reflecting real world buyer decision processes. DeepStrike publishes this list and lists itself first; list order is not a quality ranking. This approach prioritizes contextual suitability over marketing claims and brand recognition.
Candidate pool and checks for this New Zealand edition: providers with a New Zealand address or a stated New Zealand service focus, plus DeepStrike as publisher. On 3 November 2026 each entry was checked against the provider's own service, contact and certification pages, the Pae Hokohoko Marketplace approved-supplier list, and, where a provider claims CREST status, CREST's public marketplace. This is desk research; we did not commission test engagements from the providers. Large firms on the Marketplace technical-testing list, such as CyberCX, Datacom, Kordia (Aura Information Security), Deloitte, KPMG and PwC, are not profiled here; add them to your shortlist if you need a national-scale supplier.
Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.
New Zealand relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for New Zealand clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.
Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.
Official sources: Pricing , Contact Us
Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.
| Documented strengths | Limits and buying considerations |
|---|---|
| Human-led testing with reproduction evidence, root-cause information, and remediation guidance. | The service description is not an independently measured quality comparison. Assess the assigned team and a relevant sample report. |
| The published Basic plan lists Slack collaboration, customizable reports, and 12 months of remediation retesting. | No numeric price is displayed on the pricing page. Basic is a one-shot test; recurring coverage belongs to a different plan, with contract-specific terms. |
| Team certifications shown on the services page include OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate. | These are individual tester credentials, not a company-level accreditation; ask which certified testers will be assigned to your engagement. |
Public offering: Bastion Security describes CREST-accredited penetration testing across applications, systems, and networks, with listed services for external and internal infrastructure, web and other applications, source code and configuration reviews, OT/SCADA networks, AI systems, denial-of-service testing, social engineering, and red and purple teaming. Testing sits alongside advisory, governance and compliance, managed detection and response, and incident response services.
New Zealand relevance: Bastion lists offices at 51 Shortland Street, Auckland, and 10 Brandon Street, Wellington, plus Melbourne, and states it is a CREST member company, ISO 27001 certified, and an approved supplier on the NZ Government marketplace. Confirm which office and team will test, and define data handling and any subcontracting in the agreement.
Certifications: Bastion's awards and certifications page lists CREST membership and ISO 27001, and team certifications including OSCP, OSWE, OSCE3, OSED, OSWP, GMOB, CISSP, and PCI QSA.
Official sources: https://www.bastionsecurity.co.nz/solutions/penetration-testing; https://www.bastionsecurity.co.nz/contact-us
Buyer fit: Mid-sized and large New Zealand organisations, including public sector agencies, that want testing from a provider that also offers compliance and managed security services.
What sets it apart in New Zealand: Bastion Security Group is approved in all five categories of the Marketplace's Information Security Professional Services catalogue, including technical testing and incident response, which simplifies procurement for agencies that want testing and response from one supplier.
| Documented strengths | Limits and buying considerations |
|---|---|
| Published testing scope includes OT/SCADA networks, AI systems, DoS testing, and red and purple teaming. | A broad service catalogue does not show specialist depth on your stack; ask for named testers and a relevant sample report. |
| States CREST membership, ISO 27001 certification, PCI QSAs on staff, and NZ Government marketplace approval. | When the same group also advises on or runs your security controls, agree how testing independence will be kept. |
Public offering: ZX Security lists external and internal penetration tests, red team engagements, website and API tests, mobile application reviews for Android and iOS, source code review, Wi-Fi testing, host hardening reviews, phishing exercises, and OT/SCADA testing. Its methodology is based on OSSTMM and the OWASP Testing Guide, and reports focus on business risk with operational remediation advice. It also offers cloud security, cyber strategy and risk, and training services.
New Zealand relevance: ZX Security states that it is now a Bastion Security Group company and directs enquiries to Bastion's contact channels, so confirm which entity you contract with and which team will test. Define tester locations and data handling in the agreement.
Official sources: https://zxsecurity.co.nz/services/penetration-testing/; https://zxsecurity.co.nz/contact/
Buyer fit: Organisations that already know ZX Security's testing team and want continuity within the Bastion group.
What sets it apart in New Zealand: ZX operates as a Bastion group brand rather than an independent competitor, so treat Bastion and ZX as one supplier if you need two independent quotes or want to rotate testing firms.
| Documented strengths | Limits and buying considerations |
|---|---|
| Published methodology (OSSTMM, OWASP Testing Guide) and a detailed description of each test type. | The brand now sits within Bastion; confirm whether contracts, pricing, and teams follow Bastion's terms. |
| Scope includes OT/SCADA testing that can be scheduled around maintenance windows. | Retest terms are not described on the service page; confirm them in the proposal. |
Public offering: Blacklock combines continuous automated scanning (DAST, SAST, and SBOM) with on-demand manual penetration testing ordered through its platform. Listed services cover web applications and APIs, infrastructure, cloud (AWS, Azure, GCP), mobile apps, and AI applications. Each manual test includes executive, developer, and full reports, a penetration test certificate, and retesting after remediation.
New Zealand relevance: Blacklock lists its New Zealand address at Level 5, 33 Bunny Street, Wellington, with further addresses in Melbourne, Singapore, Detroit, and Lima. Confirm which location's testers will be assigned and where platform and findings data is hosted.
Official sources: https://www.blacklock.io/features/on-demand-manual-penetration-testing; https://www.blacklock.io/company/contact
Buyer fit: SaaS and product teams that want automated scanning and manual pentests managed in one platform.
What sets it apart in New Zealand: Blacklock Security is approved on the Marketplace for technical testing, so agencies can buy its platform-ordered manual tests and continuous scanning through the government channel.
| Documented strengths | Limits and buying considerations |
|---|---|
| States that manual testing is carried out by CREST-certified testers and aligned to OWASP, OSSTMM, and PTES. | Automated scanning results are not a substitute for manual testing depth; check how much of each test is manual. |
| Three report formats, a test certificate, and remediation tracking with retesting in the platform. | Platform subscription and test pricing are plan-specific; compare total cost for your asset count. |
Public offering: Pulse Security offers manual penetration testing of web applications and APIs, mobile and thick-client applications, cloud environments, external, internal, and wireless networks, and source code. It also lists red teaming and attacker emulation, architecture and DevOps reviews, and incident response. Reports rank vulnerabilities by severity with reproduction steps and recommendations, and critical findings are communicated immediately.
New Zealand relevance: Pulse Security lists a Wellington postal address (PO Box 610, Wellington 6140) and phone numbers for Wellington and Auckland. Define tester locations and data handling in the agreement.
Official sources: https://pulsesecurity.co.nz/services/penetration-testing; https://pulsesecurity.co.nz/
Buyer fit: Organisations that want research-driven manual testing of applications, networks, or source code, including PCI testing programmes.
What sets it apart in New Zealand: Pulse Security is approved on the Marketplace for technical testing and publishes its own security research, a fit for buyers who want a specialist Wellington consultancy rather than a multi-service group.
| Documented strengths | Limits and buying considerations |
|---|---|
| Runs an internal research programme and publishes technical security research on its site. | No company-level accreditation is stated on the service page; ask for tester credentials if procurement requires them. |
| States experience working with PCI QSAs to meet PCI DSS penetration testing requirements. | Retest terms are not described on the service page; confirm them in the proposal. |
Public offering: Tier Zero Security, established in 2024, offers web application, external, internal, API, mobile, and Wi-Fi penetration tests, AI red teaming, source code and configuration reviews, phishing exercises, red and purple teaming, and security training. It uses OSSTMM and OWASP Testing Guide methodologies, with peer-reviewed reports and retesting available on request.
New Zealand relevance: Tier Zero describes itself as New Zealand owned and operated and states it is an approved vendor on the NZ Government marketplace for source code, application review, and technical testing; it publishes an email contact rather than a street address. Confirm the contracting entity, tester locations, and data handling in the agreement.
Certifications: Tier Zero's site shows consultant certifications including OSCP, OSWE, OSEP, OSCE3, OSWP, CRTO, and CRTL.
Official sources: https://tierzerosecurity.co.nz/services/penetration-testing.html; https://tierzerosecurity.co.nz/
Buyer fit: Organisations that want a small senior team for application testing, red teaming, or AI security assessments.
What sets it apart in New Zealand: Although established only in 2024, Tier Zero is already approved on the Marketplace for technical testing and lists AI red teaming as a named service.
| Documented strengths | Limits and buying considerations |
|---|---|
| NZ Government marketplace approval for technical testing, and a published four-phase engagement process. | A young, small firm may have limited capacity for large or parallel engagements; confirm availability. |
| Team members present research at security conferences and hold offensive security certifications. | Certifications belong to individual consultants; ask which consultants will work on your test. |
Public offering: Amaru offers web application, external and internal network, mobile, wireless, and physical penetration testing, plus social engineering, OSINT, vulnerability assessments, and cloud security assessments. Testing sits alongside compliance services (ISO 27001, SOC 2, HIPAA, NIST CSF), managed detection and response, and security awareness training.
New Zealand relevance: Amaru lists its address at Level 5, 17 Customs Street East, Auckland, serves all New Zealand regions, and describes Australian coverage as expanding. It describes itself as a CREST-certified provider; ask for the accreditation certificate and accredited entity name, and define tester locations and data handling in the agreement.
Certifications: Amaru states its team consists of CREST-certified testers holding certifications including OSCP, OSEP, OSWE, CHFI, CPTC, and eWPT.
Official sources: https://amaru.co.nz/services/penetration-testing/; https://amaru.co.nz/contact/
Buyer fit: SMEs and mid-sized organisations that want penetration testing bundled with compliance or managed security support.
What sets it apart in New Zealand: CREST's public marketplace lists AMARU Ltd (formerly Simplify Security) with a Penetration Testing accreditation and describes it as having fewer than 10 employees, so check capacity for multi-week or parallel engagements.
| Documented strengths | Limits and buying considerations |
|---|---|
| Published test types include physical penetration testing, social engineering, and OSINT assessments. | CREST's public marketplace lists AMARU Ltd with a Penetration Testing accreditation; confirm it is current and covers the entity you contract with. |
| States its testers hold certifications including OSCP, OSEP, OSWE, CHFI, CPTC, and eWPT. | When the same provider runs your compliance programme or MDR, agree how testing independence will be kept. |
Public offering: Pentest NZ offers network penetration testing, vulnerability assessments, web and mobile application testing using NIST and OWASP methodologies, and source code review. It positions itself on affordability and prioritising the most critical risks.
New Zealand relevance: Pentest NZ states that it is delivered by Medical IT Advisors, a managed security service provider for New Zealand healthcare organisations; no street address is published on its homepage. Confirm the contracting entity, tester credentials, and data handling in the agreement.
Official sources: https://pentest.nz/
Buyer fit: Small New Zealand businesses that want a cost-focused network or application test.
What sets it apart in New Zealand: Its link to a managed security provider for healthcare organisations may suit smaller health-sector buyers; it did not appear on the Marketplace technical-testing list on 3 November 2026.
| Documented strengths | Limits and buying considerations |
|---|---|
| Published services cover network, application, and source code testing with named methodologies. | No tester certifications or accreditations are listed on the homepage; request them before engaging. |
| Backed by a managed security provider with a healthcare focus. | Report contents and retest terms are not described publicly; ask for a sample report. |
Public offering: Capture The Bug offers continuous penetration testing through a live findings dashboard, covering web applications (against OWASP ASVS), APIs, cloud environments, internal, external, and wireless networks, and AI and LLM systems. It lists Jira, Slack, and GitHub integrations, direct Slack contact with testers, and free retests for 90 days.
New Zealand relevance: Capture The Bug positions its service for New Zealand and Australian teams and states that its testers are CREST-certified; its homepage does not publish a street address. Confirm the contracting entity, tester locations, and data handling in the agreement.
Official sources: https://capturethebug.xyz/
Buyer fit: SaaS and product engineering teams that want testing aligned to release cycles with live findings.
What sets it apart in New Zealand: Its core offer is a continuous testing subscription with a published 90-day free retest window; it did not appear under that name on the Marketplace technical-testing list on 3 November 2026, so public agencies should confirm the contracting entity and procurement route.
| Documented strengths | Limits and buying considerations |
|---|---|
| Live dashboard, tool integrations, and free retests for 90 days are published on the homepage. | Continuous models suit frequently changing apps; confirm how depth per release compares with a scoped point-in-time test. |
| States that testing is performed by CREST-certified testers. | Individual tester certification is not company-level accreditation; ask which testers will be assigned. |
Public offering: Pākiki Security offers penetration testing of web applications and APIs, mobile and desktop applications, internal and external networks, and IoT and hardware devices, plus cloud, configuration, and code reviews. Reports include non-technical summaries, root causes, reproduction steps, and remediation advice, followed by a close-out meeting. It also provides governance, risk, and compliance services such as vCISO and ransomware readiness assessments.
New Zealand relevance: Pākiki describes itself as an Aotearoa-owned boutique based in Christchurch and Wellington and lists phone numbers for both cities. It states that it does not sell or implement security products; define tester locations and data handling in the agreement.
Official sources: https://www.pakiki.co.nz/pentesting/; https://www.pakiki.co.nz/contact/
Buyer fit: Organisations that need independent testing of non-standard assets such as IoT or hardware devices.
What sets it apart in New Zealand: Pākiki is approved on the Marketplace for technical testing and three other information security categories, and its Christchurch base gives South Island buyers a local option.
| Documented strengths | Limits and buying considerations |
|---|---|
| Published report structure includes root causes, reproduction steps, and a close-out meeting. | No company-level accreditation is stated on the service page; ask for tester credentials. |
| States independence from security product sales. | A boutique team may have limited capacity for large engagements; confirm scheduling. |
| Company | Specialization | Best For | Region | Frameworks named on provider site | Ideal Size |
|---|---|---|---|---|---|
| DeepStrike | Human-led app, cloud & infrastructure testing | Remediation collaboration | Remote (HQ Newark, Delaware) | PCI, ISO, SOC 2 | Mid–Enterprise |
| Bastion | CREST-accredited testing + managed security | Regulated orgs | NZ (Auckland, Wellington)/AU | PCI, ISO | Mid–Enterprise |
| ZX Security | Full spectrum testing (Bastion group) | Local enterprises | NZ (Wellington) | ISO | Mid–Enterprise |
| Blacklock | PTaaS + on-demand manual tests | CI/CD teams | NZ (Wellington)/AU | ISO, SOC 2 | SMB–Mid |
| Pulse Security | App & code depth | App heavy orgs | NZ (Wellington) | PCI | Mid–Enterprise |
| Tier Zero | AI & advanced red teaming | Emerging tech | NZ | Not stated | SMB–Mid (small team) |
| Amaru | Testing + compliance, CREST-certified testers | Compliance-led orgs | NZ (Auckland); AU expanding | PCI, ISO, SOC 2 | SMB–Mid |
| Pentest NZ | Cost-focused testing | SMEs | NZ | Not stated | SMB |
| Capture The Bug | Continuous PTaaS, CREST-certified | SaaS teams | NZ/AU | PCI, GDPR | SMB–Mid |
| Pākiki | IoT & hardware | Specialized assets | NZ (Christchurch, Wellington) | ISO | Mid |
This guide does not quote NZD price ranges: we found no public, verifiable New Zealand price data to support them, and quotes depend on scope, testing depth, and retest terms. Request scoped proposals from each shortlisted provider and compare them on the drivers below.
Scope and effort: the number of web apps, APIs, hosts, and cloud accounts in scope, and whether testing is authenticated, set the tester-days a provider quotes. Ask each provider to state its day count so proposals can be compared.
Assurance context and red team depth: a test that feeds NZISM certification and accreditation, RBNZ cyber-resilience work, or a PCI DSS assessment may need fuller documentation and retest evidence, which adds effort; adversary simulation is scoped on duration, objectives, and stealth requirements rather than asset count.
Retest Policies: Retest terms vary widely, from one complimentary retest of critical findings to free retests within a set window (for example, 90 days), so confirm retest scope and timing before signing.
Subscription vs One Off: continuous PTaaS is usually priced per month on asset count, manual validation frequency, and reporting depth, so compare its annual total with one-off tests plus retests. For how ongoing testing works, see continuous penetration testing.
AI is accelerating reconnaissance and payload generation for both attackers and defenders, increasing testing speed while simultaneously raising the bar for manual expertise and analytical interpretation.
For cloud native and SaaS environments, continuous validation is increasingly supplementing or partially replacing annual point in time tests rather than eliminating them entirely.
Some cyber insurers ask for evidence of third-party penetration testing before issuing or renewing a policy, but requirements vary by insurer, policy size and sector. Check your proposal form and policy wording rather than assuming a test is mandatory.
OSCP and OSWE remain strong indicators of technical exploitation depth, CISSP signals governance understanding, and CREST accreditation reflects organizational assurance and quality control.
Ready to Strengthen Your Defenses? The threats of 2026 demand more than just awareness; they require readiness. If you're looking to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike is here to help. Our team of practitioners provides clear, actionable guidance to protect your business. Explore our Penetration Testing Services to see how we can uncover vulnerabilities before attackers do. Drop us a line, we’re always ready to dive in.
About the Author: Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains, developing resilient defense strategies, and translating technical risk into executive level decision frameworks for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
