RemotePenetration testing
Find the way in before an attacker does.
You probably have antivirus, a firewall and MFA. The question is whether someone could still get in. A penetration test answers it: independent testers from our partner Aegis Cybersecurity try to break in, with your permission, and show you exactly how. We manage it, fix what's found and test again.
One contact, a report written for people who don't work in IT, and engineers to close the gaps.
- Independent testers
- Plain report ranked by risk
- Fixed and retested
Reviewed by Blake Bath, General Manager, on 31 October 2026.
What we test
Four ways in, tested properly.
Most businesses need two or three of these, not all four.
From the internet
Website, email, remote access and anything else visible online.
- External
- Remote access
- Exposed services
From inside
Assume someone has a staff login or laptop, then see how far they get.
- Lateral movement
- Admin rights
- File shares
Web apps and portals
Client portals and forms, including one customer seeing another's data.
- Access control
- Logins
- Data exposure
Your people
Practice scam emails and calls, then short training for anyone caught out.
- Phishing
- Phone calls
- Training
Test scope picker
What should you actually test?
Two questions, and a scope in priority order you can take to any tester.
Tell us what you run and why you're testing. You get a suggested scope in priority order.
Suggested scope
3 tests, in this order
- External test of everything visible from the internet
- Cloud configuration review of Microsoft 365 or Google sign-in, sharing and admin access
- Phishing simulation to see who would hand over a password
- Start with the external test and the cloud review. They cover the most common ways in.
What you get
What the report covers.
Written for the board on page one and for engineers after that.
| Section | What's in it |
|---|---|
| Executive summary | Scope, overall risk and the findings most likely to matter |
| Scope and method | What was tested, what wasn't, and the rules of engagement |
| Findings | Each one rated by severity, with evidence and the fix |
| Attack paths | How findings chain together into a real way in |
| Fix plan | Now, next and later, with effort estimates |
| Retest | What was checked again and the result, in the same report |
How we actually do it
From first call to gaps closed.
- Agree the scopeSystems, dates, times and who to call if something looks wrong. Signed off before anything starts.
- Specialists testIndependent testers use real attacker techniques without taking you offline.
- Plain reportA page for leadership, then every finding ranked.
- We fix itOur engineers work through the fixes with you.
- They test againSo the report shows the gaps are closed.
The rules that apply
When testing is required, and what's off limits.
- Card paymentsPCI DSS requires internal and external testing at least every 12 months and after significant changes.
- Microsoft cloudNo Microsoft approval needed to test your own resources, but its rules of engagement apply and denial of service is banned.
- Written authorisationTesting without the owner's written permission is unauthorised access. We get it signed first.
When this is the wrong choice
When a penetration test isn't the next step.
- The basics aren't doneNo MFA or patching yet? Fix those first. A test will just list them.
- You want a checklistAn Essential Eight gap check is cheaper and answers different questions.
- Nothing has changed since the last testA retest of last year's findings may be enough.
Mistakes we see
Ways a penetration test gets wasted.
- Testing before the basicsPaying specialists to find missing MFA.
- Scope too narrowThe website tested, the remote access left out.
- Report filed, nothing fixedThe same findings next year.
- No retestNo proof for the insurer that it's closed.
- Testers fixing their own findingsIndependence matters for evidence.
How we take it on
Five steps, one contact.
- Step 1Scope
What's tested, when and how.
- Step 2Test
Independent specialists.
- Step 3Report
Plain words, ranked by risk.
- Step 4Fix
Our engineers, with you.
- Step 5Retest
Proof it's closed.
Related
Testing finds the gaps. These close them.
Where test findings usually land.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about penetration testing.
What is a penetration test?
An authorised, controlled attempt to break into your systems the way a real attacker would. It shows which weaknesses can actually be used and what an attacker could reach, not just a list of possible problems.
Will testing disrupt our business?
It shouldn't. Scope and testing windows are agreed before anything starts, and sensitive systems are tested after hours. Denial of service testing is out unless specifically agreed.
How often should we test?
At least once a year, and after any big change such as a new system going live or a move to the cloud. PCI DSS requires that cadence for card environments, and many insurers and clients expect it.
Who actually does the testing?
Aegis Cybersecurity, an independent Brisbane cyber security consultancy we partner with. Real Bytes manages the engagement, so you have one contact, and our engineers help fix what's found. The people testing aren't marking their own work.
Can you test Microsoft 365 and the cloud?
Yes, within each provider's rules. Microsoft doesn't need to approve testing of your own resources, but testers must follow its rules of engagement. You give written authorisation first.
What does it cost?
It depends on scope: how many systems, apps and people. Tell us what you run and we'll quote a fixed price for the scope you choose.
Next step
Want to know if someone could get in?
Tell us what you run and what worries you. We'll suggest what's worth testing and what can wait.
Keep reading
Reviewed by Blake Bath, General Manager, on 31 October 2026. PCI DSS and Microsoft testing rules via Microsoft Learn, checked 31 October 2026. Aegis Cybersecurity, our testing partner; Microsoft Learn, Penetration testing (Microsoft cloud rules of engagement); Microsoft Learn, PCI DSS Requirement 11