1import{c as p,j as e}from"./index-CYWzIoL_.js";import{b as f}from"./vendor-recharts-CNbq9ujH.js";import{M as y}from"./MarketingLayout-CR_KGAkJ.js";import{S as r,R as s,a as l}from"./Reveal-C3RuW-yT.js";import{b,C as i,c as n,d as o}from"./Primitives-BTyEvmS6.js";import{P as j,F as w,C as k}from"./PageShell-CmfqPHK9.js";import{C as v}from"./contact-dialog-ORFe9fY_.js";import{S as N}from"./shield-check-BfKL90mu.js";import{C as c}from"./circle-check-big-DJDiQ2bd.js";import{B as S}from"./badge-check-DG9LxEbL.js";import{L as C}from"./list-checks-fntJcN7m.js";import{G as A}from"./globe-C1hDhXEi.js";import{S as T}from"./server-CvWTC0V9.js";import{C as P}from"./cloud-DneDe4nS.js";import{S as W}from"./smartphone-C7Ah5Y3j.js";import{B as u}from"./bot-Cpeh8Be8.js";import{R as I}from"./radar-CoaarUoK.js";import{T as B}from"./triangle-alert-CNTU6BGr.js";import{S as h}from"./star-Bs7d2IE0.js";import"./cybergrape-logo-light-CM5Um-zp.js";import"./logo-picture-CRl8AHm0.js";import"./file-check-DyCSYFNE.js";import"./briefcase-BmbFNcNF.js";import"./graduation-cap-Desfe6pB.js";import"./dialog-CtEOGYlm.js";import"./index-DdsOhTNN.js";import"./Combination-4h0MUD61.js";import"./button-CKTFDFlx.js";import"./animations-8dOrGFrp.js";import"./input-aYsR2GAX.js";import"./label-Dmr4QUlJ.js";import"./startAuthentication-DUAEdA0o.js";import"./cybergrape-logo-DUdReq5R.js";import"./cybergrape-logo-h0rAfGKD.js";import"./arrow-left-CC_Obl3R.js";import"./shield-4y0JuBi_.js";import"./building-2-U1ltOT5x.js";import"./key-round-B9i8TzIq.js";import"./tenant-signup-form-CbubICyY.js";import"./form-CHwrjctL.js";import"./plus-nL9MAfWu.js";import"./select-3DlU0bPm.js";import"./index-BdQq_4o_.js";import"./index-CPFQCbBx.js";import"./index-ZLblNrkv.js";import"./chevron-down-DSXWubwf.js";import"./check-Duy9todO.js";import"./chevron-up-DfIIpUd0.js";import"./search-Dz3iab4_.js";import"./popover-BP8jysS0.js";import"./chevrons-up-down-CtZPFQHz.js";import"./badge-hGuU_1lf.js";import"./mail-Cg1gkmE2.js";import"./circle-check-BjqR18Os.js";import"./circle-alert-CxoedvwX.js";import"./circle-x-D62yCLPF.js";import"./diamond-icon-BPzaEVoa.js";import"./menu-CwrYGVBW.js";import"./chart-column-Bfbu4mvn.js";import"./settings-Dl7CZ2Bz.js";import"./users-tgouOeSH.js";import"./gauge-B8sCxgyV.js";import"./book-open-JxZPkmUA.js";import"./clock-B9-7wanh.js";import"./textarea-D89S5I9J.js";import"./message-square-CfqsNjBB.js";/** 2 * @license lucide-react v0.562.0 - ISC 3 * 4 * This source code is licensed under the ISC license. 5 * See the LICENSE file in the root directory of this source tree. 6 */const L=[["path",{d:"M2.97 12.92A2 2 0 0 0 2 14.63v3.24a2 2 0 0 0 .97 1.71l3 1.8a2 2 0 0 0 2.06 0L12 19v-5.5l-5-3-4.03 2.42Z",key:"lc1i9w"}],["path",{d:"m7 16.5-4.74-2.85",key:"1o9zyk"}],["path",{d:"m7 16.5 5-3",key:"va8pkn"}],["path",{d:"M7 16.5v5.17",key:"jnp8gn"}],["path",{d:"M12 13.5V19l3.97 2.38a2 2 0 0 0 2.06 0l3-1.8a2 2 0 0 0 .97-1.71v-3.24a2 2 0 0 0-.97-1.71L17 10.5l-5 3Z",key:"8zsnat"}],["path",{d:"m17 16.5-5-3",key:"8arw3v"}],["path",{d:"m17 16.5 4.74-2.85",key:"8rfmw"}],["path",{d:"M17 16.5v5.17",key:"k6z78m"}],["path",{d:"M7.97 4.42A2 2 0 0 0 7 6.13v4.37l5 3 5-3V6.13a2 2 0 0 0-.97-1.71l-3-1.8a2 2 0 0 0-2.06 0l-3 1.8Z",key:"1xygjf"}],["path",{d:"M12 8 7.26 5.15",key:"1vbdud"}],["path",{d:"m12 8 4.74-2.85",key:"3rx089"}],["path",{d:"M12 13.5V8",key:"1io7kd"}]],M=p("boxes",L);/** 7 * @license lucide-react v0.562.0 - ISC 8 * 9 * This source code is licensed under the ISC license. 10 * See the LICENSE file in the root directory of this source tree. 11 */const E=[["path",{d:"m18 16 4-4-4-4",key:"1inbqp"}],["path",{d:"m6 8-4 4 4 4",key:"15zrgr"}],["path",{d:"m14.5 4-5 16",key:"e7oirm"}]],O=p("code-xml",E),q="/assets/blacklock-logo-C1BRqZIL.png",G="/assets/tower-insurance-logo-B9PriVtN.png";function R(){return e.jsx("div",{className:"flex items-center justify-center py-4 lg:py-0",children:e.jsxs("svg",{viewBox:"80 0 265 310",className:"w-full max-w-[380px] h-auto","aria-hidden":"true",style:{filter:"drop-shadow(0 0 48px rgba(107,82,151,0.30))"},children:[e.jsxs("defs",{children:[e.jsxs("radialGradient",{id:"pt-copper",cx:"34%",cy:"28%",r:"78%",children:[e.jsx("stop",{offset:"0%",stopColor:"#9B7FD0"}),e.jsx("stop",{offset:"52%",stopColor:"#6B5297"}),e.jsx("stop",{offset:"100%",stopColor:"#3B2C58"})]}),e.jsxs("radialGradient",{id:"pt-copper-dim",cx:"34%",cy:"28%",r:"78%",children:[e.jsx("stop",{offset:"0%",stopColor:"#5A4682"}),e.jsx("stop",{offset:"100%",stopColor:"#291F3E"})]})]}),e.jsxs("g",{stroke:"#17B5A5",strokeWidth:2,fill:"none",opacity:.88,children:[e.jsx("path",{d:"M198 14 V34"}),e.jsx("path",{d:"M212 10 V34"}),e.jsx("path",{d:"M226 14 V34"})]}),e.jsx("rect",{x:190,y:34,width:44,height:13,rx:2,fill:"#171122",stroke:"#17B5A5",strokeWidth:1.4}),e.jsx("path",{d:"M234 54 C 270 42, 300 52, 312 72 C 286 90, 250 86, 234 54 Z",fill:"#17B5A5",opacity:.12}),e.jsxs("g",{stroke:"#17B5A5",strokeWidth:1.3,fill:"none",opacity:.32,children:[e.jsx("path",{d:"M234 54 C 270 42, 300 52, 312 72 C 286 90, 250 86, 234 54 Z"}),e.jsx("path",{d:"M236 56 L307 71"}),e.jsx("path",{d:"M260 50 L264 78"}),e.jsx("path",{d:"M283 49 L287 82"})]}),e.jsx("circle",{cx:307,cy:71,r:2.8,fill:"#17B5A5",opacity:.3}),e.jsx("path",{d:"M212 47 V116",stroke:"#17B5A5",strokeWidth:3,fill:"none"}),e.jsx("circle",{cx:212,cy:116,r:7,fill:"#0D0A14",stroke:"#17B5A5",strokeWidth:2}),e.jsx("path",{d:"M212 116 H170 L128 158 V178",stroke:"#8F74C4",strokeWidth:2.6,strokeLinecap:"round",strokeLinejoin:"round",fill:"none",opacity:.16}),e.jsx("path",{d:"M212 116 H254 L296 158 V178",stroke:"#8F74C4",strokeWidth:2.6,strokeLinecap:"round",strokeLinejoin:"round",fill:"none",opacity:.16}),e.jsx("path",{d:"M212 116 V178",stroke:"#8F74C4",strokeWidth:2.6,strokeLinecap:"round",fill:"none"}),e.jsx("circle",{cx:212,cy:178,r:56,fill:"none",stroke:"#17B5A5",strokeWidth:.8,opacity:.38}),e.jsx("circle",{cx:212,cy:178,r:45,fill:"url(#pt-copper)"}),e.jsx("circle",{cx:212,cy:178,r:45,fill:"none",stroke:"#17B5A5",strokeWidth:1.8}),e.jsx("text",{x:212,y:189,textAnchor:"middle",style:{fontWeight:600,fontSize:31,fill:"#fff",letterSpacing:"-0.02em"},children:"A"}),e.jsx("circle",{cx:212,cy:222,r:5,fill:"#0D0A14",stroke:"#17B5A5",strokeWidth:1.6,opacity:.3}),e.jsx("path",{d:"M212 222 V240 H190 L166 264",stroke:"#8F74C4",strokeWidth:2.2,strokeLinecap:"round",strokeLinejoin:"round",fill:"none",opacity:.12}),e.jsx("path",{d:"M212 222 V240 H234 L258 264",stroke:"#8F74C4",strokeWidth:2.2,strokeLinecap:"round",strokeLinejoin:"round",fill:"none",opacity:.12}),e.jsx("circle",{cx:338,cy:254,r:14,fill:"url(#pt-copper-dim)",stroke:"#8F74C4",strokeWidth:1,opacity:.22}),e.jsx("circle",{cx:86,cy:254,r:14,fill:"url(#pt-copper-dim)",stroke:"#8F74C4",strokeWidth:1,opacity:.22})]})})}const D=[{title:"A customer or insurer is asking for evidence",body:"A big client sends through a security questionnaire. Your insurer wants to know when you last tested. The contract sits there waiting on an answer you do not have yet. A test that drags on for six weeks costs you the deal."},{title:"Your last report is already out of date",body:"Annual testing gives you a snapshot of one Tuesday in March. You have shipped forty releases since. The report is a PDF in a shared drive, the findings got copied into a spreadsheet, and n
11obody is quite sure which ones were actually fixed."},{title:"You cannot tell what is exposed right now",body:"Subdomains spun up for a campaign and never taken down. An old admin interface still answering on the internet. A dependency with a known flaw buried three layers into your build. None of it shows up until someone goes looking."}],m=[{label:"When you see findings",traditional:"On delivery, weeks later",cybergrape:"Live, as each one is confirmed"},{label:"What you receive",traditional:"One long PDF",cybergrape:"Executive, developer and full technical reports, plus a test certificate"},{label:"Remediation",traditional:"Your team transcribes it into a spreadsheet",cybergrape:"One-click tickets into Jira, Azure DevOps, GitHub, GitLab or Bitbucket"},{label:"Retesting a fix",traditional:"Email the tester, book time, wait",cybergrape:"Your developer triggers it and gets the result"},{label:"Between tests",traditional:"Nothing",cybergrape:"Continuous automated scanning of your attack surface"},{label:"Cost model",traditional:"Quoted per engagement, every time",cybergrape:"Subscription plus scoped manual testing"},{label:"Who owns the outcome",traditional:"The report is the end of it",cybergrape:"We stay across remediation and report progress to your board"}],F=[{icon:A,title:"Web applications and APIs",body:"Authenticated and unauthenticated, including REST APIs and single page applications."},{icon:T,title:"Infrastructure",body:"External perimeter and internal networks, reached through a zero configuration VPN so no hardware is needed."},{icon:P,title:"Cloud environments",body:"AWS, Azure and Google Cloud configuration and exposure."},{icon:W,title:"Mobile applications",body:"iOS and Android, tested across the app, its APIs and its storage."},{icon:u,title:"AI applications",body:"Chatbots, copilots, agents and MCP tool workflows."}
11,{icon:O,title:"Source code (SAST)",body:"Static analysis across 30 or more languages, wired into your CI/CD pipeline."},{icon:M,title:"Software bill of materials",body:"Every library and dependency checked for known flaws and licence problems, exportable as CycloneDX or SPDX."},{icon:I,title:"Continuous vulnerability assessment",body:"Scheduled and on demand scanning, with alerts into Slack or Teams when something changes."}],H=[{title:"Executive report",body:"What was found, what it means commercially, what happens next. Written to be read by people who do not work in security."},{title:"Developer report",body:"Each finding with steps to reproduce, evidence, remediation code for your stack, and references."},{title:"Full technical report",body:"The complete engagement record, OWASP-aligned, suitable for an auditor or a due diligence request."},{title:"Penetration test certificate",body:"The artefact your customer, insurer or procurement team actually asked for."}],V=[{q:"What is penetration testing?",a:"Penetration testing is a controlled, authorised attack on your own systems, carried out by security specialists to find weaknesses before a real attacker does. Unlike an automated scan, a penetration test includes manual work: a human tester chains small weaknesses together to see how far into your business they can get."}
11,{q:"What is PTaaS?",a:"PTaaS, or penetration testing as a service, delivers testing through a subscription platform rather than as a one-off project. You get continuous automated scanning year round, manual expert testing when you need it, findings in a live dashboard instead of a PDF, and retesting on demand when a fix is deployed."},{q:"Does a penetration test satisfy SMB1001 Level 5?",a:"Only half of it. Control 1.11.0.0 requires an annual external penetration and vulnerability test, and it also requires assessment of your workforce against social engineering, covering phishing, vishing and physical security. Both halves need evidence. We cover the technical testing through Blacklock and the social engineering side through our human risk management service."},{q:"What does ISO 27001 require?",a:"ISO/IEC 27001:2022 does not name penetration testing in the Annex A control text, but the ISO 27002 guidance for A.8.8 and A.8.29 points directly at it, and auditors expect to see testing for significant systems at least annually, with findings tracked through to closure."},{q:"How often should we test?",a:"At minimum once a year, and after any significant change to your systems. If you release software regularly, continuous scanning between annual manual tests closes the gap that annual-only testing leaves open."},{q:"How long does a test take?",a:"Most engagements run from a few days to two weeks depending on how many applications, user roles and integrations are in scope. Findings appear as they are confirmed, so remediation starts before the engagement finishes."},{q:"Will testing take our systems offline?",a:"No. Testing is scoped and scheduled with you in advance, with agreed rules of engagement and windows for anything intrusive. Destructive testing is out of scope unless you specifically ask for it in an isolated environment."},{q:"Who actually does the testing?",a:"Blacklock Security, our specialist testing partner, using CREST-certified consultants and its own PTaaS platform. CyberGrape scopes the engagement, holds the commercial relationship, and manages the work that follows the report. We name our partner openly rather than white-labelling the service."},{q:"Do we get something we can show customers?",a:"Yes. Every penetration test finishes with a certificate, alongside an executive report, a developer report and a full technical report. The certificate is what most procurement teams and insurers are asking for."},{q:"What does it cost?",a:"Penetration testing is priced on the size and complexity of what is being tested, so it is scoped before it is quoted. A scoping call takes about thirty minutes and ends with a fixed price and a clear statement of what is in and out of scope."},{q:"Can you test our AI features?",a:"Yes. AI applications, LLM integrations, agents, RAG pipelines and MCP tool workflows can all be tested, covering prompt injection, data leakage, unsafe tool use and excessive agency, alongside the conventional application and API testing underneath."},{q:"We already have an IT provider. Does this replace them?",a:"No. We test, report and prioritise. Your IT provider or development team fixes. We can manage that handover and verify the fixes, which usually works better than asking a provider to assess its own work."}];function st(){const[x,d]=f.useState(!1);return e.jsxs(y,{children:[e.jsx(j,{eyebrow:"A · Pentesting",title:"Find out how someone gets in, before they do.",lede:"Penetration testing for Australian businesses, delivered through a platform where you watch findings appear in real time, hand them straight to your developers, and retest a fix the same day it ships. The testing is done by CREST-certified consultants at Blacklock, our specialist testing partner. The scoping, the translation into business risk and the follow-through are ours.",primary:{label:"Book a free scoping call",onClick:()=>d(!0)},secondary:{label:"See what a test covers",href:"#what-can-be-tested"},aside:e.jsx(R,{})}),e.jsx(r,{tone:"base",className:b,children:e.jsx(i,{children:e.jsx(s,{children:e.jsxs("div",{className:"flex flex-wrap items-center justify-center gap-x-8 gap-y-3 text-sm text-muted-foreground",children:[e.jsxs("span",{className:"inline-flex items-center gap-2",children:[e.jsx(N,{className:"w-4 h-4 text-primary/60"}),"Testing delivered by Blacklock Security, CREST-certified"]}),e.jsxs("span",{className:"inline-flex items-center gap-2",children:[e.jsx(c,{className:"w-4 h-4 text-primary/60"}),"OWASP-aligned methodology"]}),e.jsxs("span",{className:"inline-flex items-center gap-2",children:[e.jsx(S,{className:"w-4 h-4 text-primary/60"}),"ISO 27001:2022 certified testing partner"]}),e.jsxs("span",{className:"inline-flex items-center gap-2",children:[e.jsx(C,{className:"w-4 h-4 text-primary/60"}),"Penetration test certificate included"]})]})})})}),e.jsx(r,{tone:"tint",className:n,children:e.jsxs(i,{children:[e.jsx(s,{children:e.jsx("div",{className:"text-center mb-12",children:e.jsx(o,{className:"mb-4",children:"Most businesses only think about a pen test when someone asks for one."})})}),e.jsx(l,{className:"grid grid-cols-1 md:grid-cols-3 items-stretch gap-6 [&>.reveal]:h-full",children:D.map(({title:t,body:a})=>e.jsxs("div",{className:"h-full rounded-xl border border-border p-7 flex flex-col gap-3",style:{background:"hsl(var(--card))"},children:[e.jsx("h3",{className:"font-sora font-semibold text-foreground text-base leading-tight",children:t}
11),e.jsx("p",{className:"text-foreground/65 text-sm leading-relaxed flex-1",children:a})]},t))})]})}),e.jsx(r,{tone:"base",className:n,children:e.jsx(i,{className:"max-w-3xl",children:e.jsxs(s,{children:[e.jsx(o,{className:"mb-6",children:"Testing that keeps running after the report lands."}),e.jsxs("div",{className:"space-y-5 text-muted-foreground leading-relaxed",children:[e.jsx("p",{children:"Penetration testing is a controlled attack on your own systems. Skilled testers try to break in the way a real attacker would, then write down exactly how they did it and what to do about it."}),e.jsx("p",{children:"The traditional version is a one-off exercise ending in a long document. We deliver it as a service instead, through the Blacklock platform. Automated scanning runs continuously across your web applications, APIs and infrastructure. On top of that, CREST-certified consultants do the manual work that tools cannot: business logic abuse, broken access control, chaining small weaknesses into a real attack path."}),e.jsx("p",{children:"Findings land in a dashboard as they are confirmed, so your team starts fixing on day two instead of week six. Each one can go straight to Jira, Azure DevOps, GitHub or GitLab as a ticket with remediation code attached. When a developer pushes a fix, they trigger a retest on that specific vulnerability and get an answer without waiting for anyone."}),e.jsx("p",{children:"You finish with three reports and a penetration test certificate you can send to the customer who asked."})]})]})})}),e.jsx(r,{tone:"tint",className:n,children:e.jsxs(i,{children:[e.jsx(s,{children:e.jsx("div",{className:"text-center mb-10",children:e.jsx(o,{className:"mb-4",children:"How this differs from a traditional pen test."})})}),e.jsxs(s,{children:[e.jsx("div",{className:"hidden md:block rounded-2xl border border-border overflow-hidden",style:{background:"hsl(var(--card))"},children:e.jsxs("table",{className:"w-full text-sm",children:[e.jsx("thead",{children:e.jsxs("tr",{className:"border-b border-border",children:[e.jsx("th",{className:"text-left font-sora font-semibold text-foreground p-4 w-[26%]",children:" "}),e.jsx("th",{className:"text-left font-medium text-muted-foreground p-4",children:"Traditional pen test"}),e.jsx("th",{className:"text-left font-sora font-semibold text-primary p-4",children:"Testing with CyberGrape"})]})}),e.jsx("tbody",{children:m.map(t=>e.jsxs("tr",{className:"border-b border-border last:border-b-0",children:[e.jsx("td",{className:"p-4 font-medium text-foreground align-top",children:t.label}),e.jsx("td",{className:"p-4 text-muted-foreground align-top",children:t.traditional}),e.jsx("td",{className:"p-4 text-foreground/85 align-top",children:t.cybergrape})]},t.label))})]})}),e.jsx("div",{className:"md:hidden space-y-4",children:m.map(t=>e.jsxs("div",{className:"rounded-xl border border-border p-5",style:{background:"hsl(var(--card))"},children:[e.jsx("p",{className:"font-sora font-semibold text-foreground text-sm mb-3",children:t.label}),e.jsxs("div",{className:"space-y-2",children:[e.jsxs("div",{children:[e.jsx("span",{className:"text-xs text-muted-foreground block mb-0.5",children:"Traditional pen test"}),e.jsx("span",{className:"text-sm text-muted-foreground",children:t.traditional})]}),e.jsxs("div",{children:[e.jsx("span",{className:"text-xs text-primary block mb-0.5",children:"Testing with CyberGrape"}),e.jsx("span",{className:"text-sm text-foreground/85",children:t.cybergrape})]})]})]},t.label))})]})]})}),e.jsx(r,{tone:"base",className:n,id:"what-can-be-tested",children:e.jsxs(i,{children:[e.jsx(s,{children:e.jsx("div",{className:"text-center mb-12",children:e.jsx(o,{className:"mb-4",children:"What we can put under test."})})}),e.jsx(l,{className:"grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 items-stretch gap-5 [&>.reveal]:h-full",children:F.map(({icon:t,title:a,body:g})=>e.jsxs("div",{className:"h-full rounded-xl border border-border p-6 flex flex-col gap-3",style:{background:"hsl(var(--card))"},children:[e.jsx("div",{className:"w-10 h-10 rounded-lg bg-primary/10 flex items-center justify-center flex-shrink-0",children:e.jsx(t,{className:"w-5 h-5 text-primary/70"})}),e.jsx("h3",{className:"font-sora font-semibold text-foreground text-base leading-tight",children:a}
11),e.jsx("p",{className:"text-foreground/65 text-sm leading-relaxed flex-1",children:g})]},a))})]})}),e.jsx(r,{tone:"tint",className:n,children:e.jsx(i,{className:"max-w-4xl",children:e.jsx(s,{children:e.jsxs("div",{className:"rounded-2xl border border-primary/20 p-8 md:p-10",style:{background:"hsl(var(--primary)/0.04)"},children:[e.jsx("div",{className:"w-11 h-11 rounded-xl bg-primary/10 flex items-center justify-center mb-5",children:e.jsx(u,{className:"w-5 h-5 text-primary/70"})}),e.jsx("h3",{className:"font-sora font-extrabold text-foreground text-2xl md:text-3xl leading-tight mb-5",children:"If you have shipped something with AI in it, it has a new attack surface."}),e.jsxs("div",{className:"space-y-4 text-muted-foreground leading-relaxed text-sm",children:[e.jsx("p",{children:"An AI feature accepts untrusted language, pulls in sensitive context, calls tools and sometimes acts on a user's behalf. Traditional application testing was never designed to look at any of that."}),e.jsx("p",{children:"Testing here covers prompt injection, both direct and indirect. System prompt extraction. Sensitive data leaking through model output. Poisoning of the documents your retrieval pipeline trusts. For agents and MCP integrations it goes further: tool poisoning, exposed tokens and secrets, command injection through a tool that accepts a URL, unauthorised tool invocation, and whether the model can be talked into an action a human was supposed to approve."}),e.jsx("p",{children:"The methodology is aligned to the OWASP Top 10 for large language models, the OWASP MCP Top 10 and MITRE ATLAS. Conventional application, API and infrastructure testing runs alongside it, because an AI feature still sits on ordinary authentication and authorisation that can be broken in ordinary ways."})]})]})})})}),e.jsx(r,{tone:"base",className:n,children:e.jsxs(i,{children:[e.jsx(s,{children:e.jsx("div",{className:"text-center mb-12",children:e.jsx(o,{className:"mb-4",children:"Three reports, one certificate, no interpretation required."})})}),e.jsx(l,{className:"grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-4 items-stretch gap-5 [&>.reveal]:h-full",children:H.map(({title:t,body:a})=>e.jsxs("div",{className:"h-full rounded-xl border border-border p-6 flex flex-col gap-2",style:{background:"hsl(var(--card))"},children:[e.jsx("h3",{className:"font-sora font-semibold text-foreground text-base leading-tight",children:t}),e.jsx("p",{className:"text-foreground/65 text-sm leading-relaxed flex-1",children:a})]},t))})]})}),e.jsx(r,{tone:"tint",className:n,children:e.jsxs(i,{className:"max-w-5xl",children:[e.jsx(s,{children:e.jsxs("div",{className:"text-center mb-6",children:[e.jsx(o,{className:"mb-4",children:"The controls that put you here."}),e.jsx("p",{className:"text-muted-foreground max-w-2xl mx-auto leading-relaxed",children:"If a framework brought you to this page, here is exactly which part of it is asking for testing, and what satisfies it. We work with both of these standards every week, so scoping against the specific control is straightforward rather than guesswork."})]})}),e.jsxs(l,{className:"grid grid-cols-1 lg:grid-cols-2 items-stretch gap-6 mt-10 [&>.reveal]:h-full",children:[e.jsxs("div",{className:"h-full rounded-2xl border border-border p-7",style:{background:"hsl(var(--card))"},children:[e.jsx("h3",{className:"font-sora font-bold text-foreground text-lg mb-4",children:"SMB1001:2026"}),e.jsxs("div",{className:"space-y-4 text-sm text-muted-foreground leading-relaxed",children:[e.jsxs("p",{children:[e.jsx("strong",{className:"text-foreground",children:"Level 4, control 1.7.0.1, vulnerability scanning of internet-facing resources."})," Continuous scanning of your external attack surface satisfies this, and it runs year round rather than as a point-in-time exercise."]}),e.jsxs("p",{children:[e.jsx("strong",{className:"text-foreground",children:"Level 5, control 1.11.0.0, penetration, vulnerability and social engineering testing."})," This one is specific. The test must be conducted by an external provider, at least once every year, and it must assess your workforce as well as your technology, covering phishing, vishing and physical security."]}),e.jsxs("div",{className:"rounded-lg border border-primary/15 bg-primary/5 px-4 py-3 flex items-start gap-2.5",children:[e.jsx(B,{className:"w-4 h-4 text-primary/60 flex-shrink-0 mt-0.5"}),e.jsx("p",{className:"text-xs leading-relaxed",children:"Worth being clear about something most providers will not tell you: a penetration test on its own does not close 1.11.0.0. The social engineering half has to be evidenced too. We cover that side through our human risk management service, which runs phishing simulation and awareness testing, so the two halves of the control are evidenced together rather than leaving a gap your assessor finds later."})]}),e.jsx("p",{children:"Both Level 4 and Level 5 require third-party assessment by an accredited DSC, so the evidence needs to hold up to someone else's review."})]})]}),e.jsxs("div",{className:"h-full rounded-2xl border border-border p-7",style:{background:"hsl(var(--card))"},children:[e.jsx("h3",{className:"font-sora font-bold text-foreground text-lg mb-4",children:"ISO/IEC 27001:2022"}),e.jsxs("div",{className:"space-y-4 text-sm text-muted-foreground leading-relaxed",children:[e.jsx("p",{children:"The standard does not use the words penetration test in the Annex A control text. The ISO 27002 implementation guidance does, and auditors expect to see it. Three controls are in play:"}),e.jsxs("ul",{className:"space-y-3",children:[e.jsxs("li",{children:[e.jsx("strong",{className:"text-foreground",children:"A.8.8 Management of technical vulnerabilities."})," Expects a running vulnerability management programme with regular scanning of internet-facing systems, severity-based remediation timelines and findings tracked to closure. Guidance points to penetration testing at least annually for significant systems."]}),e.jsxs("li",{children:[e.jsx("strong",{className:"text-foreground",children:"A.8.29 Security testing in development and acceptance."})," Expects security testing built into the delivery process rather than bolted on: static analysis, dynamic testing, component analysis, and penetration testing for significant systems, with security acceptance criteria enforced before go-live."]}),e.jsxs("li",{children:[e.jsx("strong",{className:"text-foreground",children:"A.5.36 Compliance with policies, rules and standards."})," Technical compliance checks, including vulnerability scans and penetration tests, with results documented."]})]}),e.jsxs("p",{children:["Static analysis in your pipeline also supports ",e.jsx("strong",{className:"text-foreground",children:"A.8.28 Secure coding"}),", which is useful if your development process is where your auditor has been pushing."]}),e.jsx("p",{children:"Testing also supports evidence requirements under SOC 2, PCI DSS, HIPAA and GDPR."})]})]})]}),e.jsx(s,{children:e.jsx("p",{className:"text-center text-muted-foreground text-sm leading-relaxed max-w-2xl mx-auto mt-10",children:"If you are already working with us on compliance, findings flow into CyberGrape GRC, our own platform, so the control, the evidence and the remediation status sit in one place instead of across three email threads."})})]})}),e.jsx(r,{tone:"base",className:n,children:e.jsx(i,{className:"max-w-3xl",children:e.jsxs(s,{children:[e.jsx(o,{className:"mb-6",children:"Blacklock does the testing. We make sure it lands."}),e.jsxs("div",{className:"space-y-5 text-muted-foreground leading-relaxed",children:[e.jsx("p",{children:"We are open about how this works, because we write it the same way into every statement of work. Blacklock Security runs the testing, on its own CREST-certified platform, with consultants holding C
11REST, OSCP, OSWE, OSCE, CISSP and CEH certifications. CyberGrape Pty Ltd holds the commercial relationship with you and stays accountable for the outcome."}),e.jsx("p",{children:"That middle part matters more than it sounds. Scoping is where most pen tests go wrong, either paying to test things that do not matter or leaving out the one system that does. We scope against your actual risk and the control you are trying to satisfy, not a price list."}),e.jsx("p",{children:"Then there is everything after the report. A list of forty findings is only useful if someone decides what gets fixed first, argues the case for the budget, chases it through your development team or your managed service provider, and explains it to your board in language that makes sense. That is the work we do as your virtual CISO, and it is the reason a test bought through us tends to end with things actually fixed."}),e.jsx("p",{className:"text-foreground/85 font-medium",children:"One contract, one invoice, one person to call. Specialist capability without the specialist procurement exercise."})]})]})})}),e.jsx(r,{tone:"tint",className:n,children:e.jsxs(i,{className:"max-w-5xl",children:[e.jsx(s,{children:e.jsxs("div",{className:"rounded-2xl border border-border p-8 md:p-10 mb-8",style:{background:"hsl(var(--card))"},children:[e.jsx("img",{src:G,alt:"Tower Insurance",className:"h-7 w-auto mb-5"}),e.jsx("p",{className:"text-muted-foreground leading-relaxed text-sm mb-5",children:"Tower is an insurer operating across Australia and New Zealand, and a long-standing CyberGrape client. We introduced Tower to Blacklock, scoped the engagements, and Tower has run its penetration testing through us ever since, including REST API and web application testing delivered on the Blacklock platform. The same relationship also covers third-party cyber risk monitoring. It is a fair picture of how this service works in practice: we hold the relationship and the scoping, the specialist platform does the testing, and the client deals with one party throughout."}),e.jsxs("blockquote",{className:"border-l-2 border-primary/30 pl-5 mb-5",children:[e.jsx("p",{className:"text-foreground/85 text-sm italic leading-relaxed mb-2",children:'"CyberGrape has been an excellent partner to us. Providing excellent niche products backed with great service."'}),e.jsxs("footer",{children:[e.jsx("span",{className:"block text-foreground/85 text-sm font-medium",children:"Darren Beattie, Head of Information Security, Tower Insurance"}),e.jsxs("span",{className:"flex items-center gap-1 mt-1",children:[e.jsx("span",{className:"flex items-center gap-0.5","aria-hidden":"true",children:Array.from({length:5}).map((t,a)=>e.jsx(h,{className:"w-3.5 h-3.5 fill-primary text-primary"},a))}),e.jsx("span",{className:"text-muted-foreground text-xs",children:"Google review"})]})]})]}),e.jsx("p",{className:"text-muted-foreground text-xs",children:"Tower Insurance, ANZ general insurer. Penetration testing and third-party cyber risk monitoring delivered through CyberGrape since 2023."})]})}),e.jsx(s,{children:e.jsxs("div",{className:"rounded-2xl border border-border p-8 mb-6",style:{background:"hsl(var(--card))"},children:[e.jsxs("div",{className:"flex items-center gap-3 mb-4",children:[e.jsx("span",{className:"text-primary/70 text-[11px] font-semibold uppercase tracking-wider",children:"Powered by"}),e.jsx("img",{src:q,alt:"Blacklock",className:"h-5 w-auto"})]}),e.jsx("div",{className:"grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-2.5",children:["CREST-certified penetration testing","ISO 27001:2022 certified","Testers hold CREST, OSCP, OSWE, OSCE, CISSP and CEH","Testing methodology aligned to OWASP, PTES and OSSTMM"].map(t=>e.jsxs("div",{className:"flex items-start gap-2.5",children:[e.jsx(c,{className:"w-4 h-4 text-primary/50 flex-shrink-0 mt-0.5"}),e.jsx("span",{className:"text-muted-foreground text-sm",children:t})]},t))})]})}),e.jsx(s,{children:e.jsxs("div",{className:"rounded-2xl border border-primary/20 p-8 mb-6",style:{background:"hsl(var(--primary)/0.06)"},children:[e.jsx("div",{className:"grid grid-cols-2 sm:grid-cols-5 ga
11p-6 text-center mb-4",children:[{n:"150+",l:"customers"},{n:"1,000+",l:"tests performed"},{n:"120,000+",l:"vulnerabilities reported"},{n:"48,656",l:"hours saved through PTaaS delivery"},{n:"99%",l:"customer happiness index"}].map(({n:t,l:a})=>e.jsxs("div",{children:[e.jsx("div",{className:"font-sora font-extrabold text-foreground text-2xl md:text-3xl mb-1",children:t}),e.jsx("div",{className:"text-muted-foreground text-xs leading-snug",children:a})]},a))}),e.jsx("p",{className:"text-center text-muted-foreground text-[11px]",children:"Blacklock platform figures, as published by Blacklock Security"})]})}),e.jsx(s,{children:e.jsxs("div",{className:"rounded-2xl border border-border p-8",style:{background:"hsl(var(--card))"},children:[e.jsx("span",{className:"text-muted-foreground text-[11px] font-semibold uppercase tracking-wider block mb-4",children:"CyberGrape credentials"}),e.jsx("div",{className:"grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-2.5",children:["Winner, New Zealand Reseller News Innovation Awards 2023","Finalist, ARN Innovation Awards 2026, Australia","4.8+ Google rating","Clients across Australia, New Zealand and beyond"].map(t=>e.jsxs("div",{className:"flex items-start gap-2.5",children:[e.jsx(h,{className:"w-4 h-4 text-primary/50 flex-shrink-0 mt-0.5"}),e.jsx("span",{className:"text-muted-foreground text-sm",children:t})]},t))})]})})]})}),e.jsx(r,{tone:"base",className:n,children:e.jsx(i,{children:e.jsxs(s,{children:[e.jsx(o,{className:"mb-8",children:"Common questions."}),e.jsx(w,{items:V,idPrefix:"pentesting"})]})})}),e.jsx(k,{heading:"Find out what a test would actually cover.",body:"A scoping call takes about thirty minutes. We will tell you what is worth testing, what is not, and what it costs. If the answer is that you need something else first, we will tell you that too.",primary:{label:"Book a free scoping call",onClick:()=>d(!0)},secondary:{label:"See all services",href:"/services"},footer:e.jsx("p",{className:"text-muted-foreground/60 text-xs",children:"Services contracted through CyberGrape Pty Ltd (Australia). Penetration testing delivered by Blacklock Security Limited."})}),e.jsx(v,{open:x,onOpenChange:d})]})}export{st as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.