Services About us The team Research Discuss an engagement

Choose an engagement / A few questions

Which security test do you need?

Seven short steps place your organisation on a maturity ladder. From there the questions change: towards penetration testing while the foundations are forming, or towards adversary simulation once testing, fixing and detection are in place. The result is a plan, with the reason for each step.

This is indicative guidance, not an audit, certification or validated maturity score. Answers are processed in this page and are not sent to SilentGrid. Do not include system names, credentials or incident details.

Maturity planner

The planner needs JavaScript. Without it, start from where your organisation is today.

No clear picture of what is exposed to the internet: a perimeter assessment.
Little independent testing, or findings that stay open: penetration testing of your applications and infrastructure.
Testing and fixing in place, alerts watched: assumed breach or purple teaming.
Defenders who have caught a simulated attacker: red teaming, or CAOS through the year.
Several needs over a year: an annual testing program.

Step 1

Choose the statement closest to everyday reality

Internet exposure

Which sounds most like your internet-facing systems?

We don’t have a clear list of what is exposed to the internet. We know the main systems, but there could be forgotten ones: old sites, acquisitions, test environments. We keep an inventory of internet-facing systems and it is mostly current. The inventory is current and we check regularly for anything new.

Applications

Which sounds most like the applications and APIs you build or run for customers?

They have never been independently security tested. Some have been tested, usually before a major launch. Key applications are tested regularly and findings are fixed before release. Security testing is part of how we ship; every significant release is covered. We don’t build or run customer-facing applications.

Internal network

Which sounds most like your internal network and identity (staff devices, Active Directory, Entra ID)?

It has never been tested. It has been tested once or twice; we’re not sure how far an attacker could get. It is tested regularly, and admin access and segmentation have been tightened. It is tested regularly, and an attacker working from inside has been simulated.

Cloud

Which sounds most like your cloud platforms (AWS, Azure, Google Cloud)?

No one has looked at our cloud setup from an attacker’s point of view. Configuration is reviewed, but no one has tested what a compromised identity could reach. Identities and permissions are tightly managed and have been tested. They have been tested, and cloud activity feeds our monitoring and response. We use little or no cloud infrastructure of our own.

Fixing findings

What usually happens to findings from security testing?

Most are still open. They get fixed eventually, but there is a backlog. They are fixed within agreed timeframes. They are fixed and retested, and recurring issues are tracked. We haven’t had independent testing yet.

Detection

If an attacker got onto a staff laptop tonight, what would happen?

We would probably hear about it from someone else, or not at all. Monitoring tools would raise alerts, but no one is dedicated to watching them. A security operations team or managed provider watches alerts around the clock. Our SOC would catch it, and has caught and contained a simulated attacker before.

People

How would staff handle a convincing phishing email or phone call?

We have never tested it. Staff get awareness training, but we don’t know how they would respond. We run phishing simulations and track how many staff report them. Staff reliably report, and phone and physical approaches have been tested too.

Your situation

Is anyone requiring this testing?

No, it is our own decision A customer or contract An audit or certification A regulator CORIE, in the financial sector

How often do your systems change?

Every month or fasterFrequent releases, new systems or integrations. A few significant changes a yearPlanned projects and upgrades. RarelyThe environment is mostly stable.

Do you also run any of these?

Select all that apply.

Industrial or operational technology Connected devices or hardware we make AI features, chatbots or agents None of these

Narrowing it down

What do your customers and partners use?

Select all that apply. Your applications scored low, so these are the ones to test.

Websites or web portals APIs, used by partners or integrations Mobile apps Software installed on their computers

How do people connect to your systems?

Select all that apply. Your internal network scored low, so these shape where testing starts.

Offices with a staff network and Active Directory Wi-Fi at our offices or sites Virtual desktops, Citrix or kiosks Remote access over VPN Mostly cloud and SaaS; little office network

Which attack worries your leadership most?

Ransomware that stops the businessEncryption and extortion. A compromised supplier or software packageAn attacker arriving through something we trust. Someone talking their way past the help deskPassword and MFA resets, impersonating staff. Disruption to industrial systemsAn attacker moving from IT into operations. A determined attacker reaching critical systems or dataWhatever route they find. No single scenarioWe want to know how our defences hold up overall.

The exercise

Where do your most important systems live?

In our own network, or split with the cloud Mostly in the cloud

How should your defenders take part?

Test them without warningSee the response as it would really happen. Work alongside themShare activity, then tune and replay detections together.

Where should the attack begin?

Starting from agreed access skips testing the initial compromise.

Outside, as a real attacker wouldReconnaissance, phishing or exposed services. From agreed access insideFocus on what happens after a compromise.

How to plan

How would you like to plan testing?

One engagement nowThe most useful next test. A plan for the next 12 monthsSeveral engagements in sequence. Recommend what fitsBased on your answers.

What budget is available?

AUD, excluding GST. It does not change the recommendation; it helps shape the conversation.

Under $25,000 $25,000–under $50,000 $50,000–under $100,000 $100,000–under $200,000 $200,000 or more Prefer not to say

The questions after step 7 depend on your answers. Answers stay in this page.

The plan

Once that is done

Your profile

Scored 0–3 from your answers. Orange marks the weakest areas.

Across the year

Explore Discuss the plan

Indicative guidance, not an audit. “Discuss the plan” copies it into the contact form, where you can edit it before sending.

Advanced
Offensive Security.

info@silentgrid.com 1300 615 201

Level 35 Tower One, 100 Barangaroo Ave
Barangaroo NSW 2000

Explore

Services About us The team Research Security advisories Contact LinkedIn (opens in a new tab)

Australian presence

Sydney
Melbourne
Perth
Brisbane
Adelaide
Hobart