# Ironbark Cyber: full text > Concatenated plain-text content of the core Ironbark Cyber pages for LLM ingestion. Canonical site: https://ironbarkcyber.com. See also https://ironbarkcyber.com/llms.txt --- ## AI Security & Penetration Testing Australia | Ironbark Cyber https://ironbarkcyber.com/ Forging Cybersecurity Resilience Penetration testing and AI security for Australian organisations. Senior consultants test your systems, report what matters, and quote fixed prices within one business day. Clients ### Who we work with FifthDomain FifthDomain We had an excellent experience working with Ironbark Cyber for our penetration testing. The team was highly professional, responsive, and receptive to our feedback throughout the entire process. Their detailed report provided clear, actionable insights into our network's security posture, and they went above and beyond in addressing our concerns. We are satisfied with the quality of their service and look forward to partnering with Ironbark Cyber for future security assessments. Kevin BoutilierApplication Security Specialist, Assent Inc. Our services ### What we do We test your systems the way an attacker would, then help you fix what we find. Every engagement is delivered by a senior consultant and includes a free retest within 90 days. 01 #### AI Security & Assurance Security testing and assurance for organisations building, buying or deploying AI. We attack LLM applications and agents, then help you prove to boards and regulators that the risk is managed. - LLM application penetration testing - AI red teaming - AI agent security testing - Secure AI architecture review - ISO/IEC 42001 readiness - AI governance & assurance Explore AI security → 02 #### Offensive Security Manual penetration testing across web applications, APIs, networks, cloud and people. This is the work Ironbark Cyber was built on. - Web application penetration testing - API penetration testing - External network penetration testing - Cloud penetration testing - ISO 27001 & compliance testing - Social engineering · OSINT · Secure development Explore penetration testing → Drowning in bug bounty or VDP reports? Our sister service Triagers.com handles the triage so your engineers can keep shipping fixes. Founder ### Luke Stephens (hakluke) Widely known bug bounty hunter and security researcher, author of open-source offensive tooling including hakrawler, and featured by HackerOne on AI red teaming. Luke scopes and leads Ironbark Cyber engagements personally. hakluke.com LinkedIn X GitHub Government & defence ### Cyber and AI security for Australian government Australian owned and operated, eligible for direct SME engagement under the Commonwealth Procurement Rules. Essential Eight, ISM-aligned testing, IRAP-readiness pentesting and AI assurance for agencies, plus subcontracting for primes that need sovereign delivery. How to engage us Mid-audit and need a pentest fast? Get a fixed quote in 1 business day Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## AI Security & Assurance Australia | Ironbark Cyber https://ironbarkcyber.com/ai-security AI Security & Assurance Offensive testing and assurance for organisations building, buying or deploying AI. Ironbark Cyber attacks your LLM applications, agents and AI supply chain the way a real adversary would, then helps you prove to boards, auditors and regulators that the risk is managed. Last updated 21 August 2026 ### What is AI security and assurance? AI security and assurance is the practice of finding and fixing the ways AI systems can be attacked, abused or fail, and being able to demonstrate that to the people who ask. It spans offensive testing (LLM penetration testing, AI red teaming, agent security testing), architecture and threat modelling before you build, and governance work that maps what you've built to the standards buyers and regulators now expect: ISO/IEC 42001, the NIST AI RMF, and in Australia the Government's AI Technical Standard and AI Impact Assessment regime. Ironbark Cyber approaches all of it from the attacker's side first. Assurance paperwork that isn't grounded in real adversarial testing is a comfortable fiction. We do the testing first, so the assurance reflects what's actually true. ### Who is this for? Teams for whom an AI failure is a board-level problem, not an inconvenience. - Product and engineering teams shipping AI features (LLM applications, copilots, agents, RAG over sensitive data) who need them tested before customers or attackers get there. - Security leaders buying or approving AI who need evidence-based answers for vendor reviews, risk committees and customer questionnaires. - Australian government agencies and their suppliers aligning with the AI Technical Standard, completing AI Impact Assessments, or preparing for the mandatory standards flagged for 2027. - Regulated and export-exposed organisations working toward ISO/IEC 42001 or navigating the EU AI Act. Who it's not for: if you want a certificate without testing, a rubber stamp on a model card, or a tool subscription that promises "AI security" from a dashboard, we're the wrong firm, and we'll tell you that on the scoping call rather than after the invoice. ### What services does Ironbark Cyber offer? - LLM application penetration testing. Hands-on attack of your LLM-backed application: prompt injection, data exfiltration, guardrail bypass, excessive agency and everything the OWASP LLM Top 10 doesn't have a name for yet. - AI red teaming. Objective-driven adversarial campaigns against your AI systems as deployed, including guardrails, monitoring and human oversight. - AI agent security testing. Security testing for agentic systems: tool abuse, privilege escalation through agent chains, memory poisoning and confused-deputy attacks. - Secure AI architecture review. Threat modelling and design review of your AI stack before (or after) you build it. - ISO/IEC 42001 readiness. Gap assessment and remediation roadmap for the AI management system standard your enterprise customers are starting to ask about. - AI governance & assurance. Alignment with the Australian Government AI Technical Standard, AI Impact Assessments, the NSW AI Assessment Framework and Queensland's FAIRA. ### How does an engagement work? The same way every Ironbark Cyber engagement works. A free 30-minute scoping call with the senior consultant who will do the work; a fixed quote within one business day; an agreed scope and rules of engagement; testing with an open channel to your team and live escalation of critical findings; then a report and debrief. Fixed issues get a free retest within 90 days. ### What do we receive at the end? - An executive summary written for boards and risk committees, in plain language. - A technical report with evidence, reproduction steps and remediation guidance for every finding, ranked by real-world impact. - Framework mapping to the standards you care about (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the AU AI Technical Standard). - A debrief call with your engineering team, and an attestation letter you can share with customers. - A free retest of fixed issues within 90 days. ### What does AI security testing cost? Every engagement is fixed-price, quoted within one business day of scoping. As a guide, focused assessments start from AU$20,000 and multi-phase assurance programmes are scoped to AU$100,000+. You'll know the exact number before you commit to anything. ### Which frameworks do you map to? Ironbark Cyber maps findings and recommendations to the frameworks your stakeholders actually cite: the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework, ISO/IEC 42001, the Australian Government AI Technical Standard, the DTA Policy for responsible use of AI in government (v2.0, including AI Impact Assessments), the National AI Centre's Guidance for AI Adoption, and the EU AI Act for organisations exporting into Europe. FAQ ### Frequently asked questions How much does AI security testing cost in Australia? + Ironbark Cyber quotes fixed fees after a free 30-minute scoping call, with the quote delivered within one business day. Focused assessments such as an LLM application pentest are fixed-fee; multi-phase AI assurance programmes are scoped and phased to your risk profile. Indicative ranges are published on this page, and the price never changes mid-engagement. What is AI security testing? + AI security testing is authorised, adversarial testing of systems that use machine learning models: LLM applications, agents, RAG pipelines and the infrastructure around them. It covers attacks that traditional penetration testing does not, such as prompt injection, jailbreaking, data extraction from models and context, tool and agent abuse, and failures of the guardrails between the model and your data. We only call a model API. Do we still need testing? + Yes. Most real-world AI vulnerabilities live in the application around the model, not in the model itself: what data reaches the context window, what tools the model can invoke, how outputs are trusted downstream, and how tenants are separated. Those are your responsibility regardless of whose model you use, and they are exactly what Ironbark Cyber tests. What is the difference between AI red teaming and an LLM penetration test? + An LLM penetration test is scoped to a specific application and hunts for exploitable vulnerabilities in it. AI red teaming is broader and objective-driven: we emulate a motivated adversary against your AI system as deployed, including its guardrails, monitoring and the humans in the loop, to test whether realistic attack objectives can be achieved. See our comparison of AI red teaming vs penetration testing for a full breakdown. Which frameworks and standards do you map findings to? + Depending on the engagement: the OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the Australian Government AI Technical Standard, the DTA Policy for responsible use of AI in government (including AI Impact Assessments), the National AI Centre Guidance for AI Adoption, and the EU AI Act for exporters. You tell us what your auditors and customers ask for; we speak the language. How long does an AI security engagement take? + Focused assessments typically run one to three weeks of testing, with the report delivered within a week of testing finishing. Broader red team or assurance programmes are phased over one to three months. Critical findings are escalated live during testing, so remediation never waits for the report. Can you test production AI systems safely? + Yes. We agree rules of engagement up front, including rate limits, data handling and kill-switch contacts, and test carefully. Where a staging environment mirrors production we will usually prefer it, but many AI-specific risks only manifest against production data flows, and we are experienced at testing them without disruption. Who actually does the testing? + Senior offensive security consultants, led by Ironbark Cyber founder Luke Stephens (hakluke), a widely known security researcher featured by HackerOne on AI red teaming. The consultant who scopes your work is the one who does it, with no junior bench and no rebadged scanner output. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## LLM Penetration Testing Australia | Ironbark Cyber https://ironbarkcyber.com/llm-penetration-testing LLM Penetration Testing A senior tester attacks your LLM application the way a motivated adversary would: the prompts, the retrieval layer, the tools it can call and the application wrapped around it. You get exploitable findings with reproduction steps, not screenshots of a chatbot being rude. Last updated 21 August 2026 ### What is an LLM penetration test? An LLM penetration test is a time-boxed, authorised attack on an application built on a large language model, a chatbot, copilot, RAG search product or LLM-powered workflow. It tests the whole system: the model's behaviour, the data and tools connected to it, and the application code that trusts its output. The goal is the same as any Ironbark Cyber pentest: prove real-world impact, then show you exactly how to close it. ### What do you test? - Prompt injection, direct and indirect. Instructions smuggled through user input, retrieved documents, emails, web pages and file uploads, anything that reaches the context window. - Data exfiltration. System prompt disclosure, cross-tenant leakage through shared context or caches, and extraction of sensitive data from RAG sources the user shouldn't see. - Tool and function abuse. What the model is allowed to call, with whose privileges, and what happens when an attacker steers it, the "excessive agency" class of the OWASP LLM Top 10. - Guardrail and filter bypass. Jailbreaks that matter for your risk profile: not "will it say a bad word", but "will it approve the refund, leak the record, or execute the action". - Output handling. Downstream code that trusts model output: markdown/HTML injection, SSRF via generated URLs, injection into queries and shell commands built from responses. - The classic layer. Authentication, authorisation, rate limiting and business logic around the AI feature, because attackers don't respect the boundary between "AI bug" and "web bug". ### How do you test it? Manually, with tooling for breadth. We build a threat model of your application on the scoping call, then combine adversarial prompt campaigns with conventional application testing, chaining findings across both layers. Testing maps to the OWASP Top 10 for LLM Applications and MITRE ATLAS, and is driven by consultants who research these attacks, Ironbark Cyber's founder has been featured by HackerOne on exactly this work. ### What do we receive? - An executive summary written for non-technical stakeholders. - A technical report: evidence, reproduction steps and remediation guidance for every finding, ranked by real-world impact. - Mapping to the OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF where your stakeholders need it. - A debrief call with your engineering team, an attestation letter, and a free retest of fixed issues within 90 days. ### How long does it take and what does it cost? Most single-application engagements run 5–10 testing days, with the report inside a week of finishing. Pricing is fixed-fee: indicatively from AU$20,000 for a focused LLM application test, quoted exactly within one business day of scoping. FAQ ### Frequently asked questions How much does an LLM penetration test cost? + LLM penetration tests are fixed-fee, quoted within one business day of a free scoping call. The price depends on the number of applications, the tools and data sources the model can reach, and whether agentic behaviour is in scope. Indicative pricing is published on this page, and the quote never changes mid-engagement. What is the difference between an LLM pentest and a regular web application pentest? + A web application pentest targets deterministic code paths: authentication, access control, injection. An LLM pentest adds the probabilistic layer: prompt injection, jailbreaks, retrieval poisoning, tool abuse and output-handling flaws. It tests how the model layer and the application layer fail together. Most serious LLM findings chain both, which is why Ironbark Cyber tests them as one system. We use OpenAI, Anthropic or a hosted model, is testing still useful? + Yes, and it is where most findings come from. The model vendor secures the model; you are responsible for what you connect to it, system prompts, RAG data, tools, tenant separation and how outputs are used downstream. Those are application-layer decisions, and they are what we attack. Do you follow the OWASP Top 10 for LLM Applications? + Yes. Testing covers every OWASP LLM Top 10 category and maps findings to it, alongside MITRE ATLAS techniques where relevant. But the checklist is only the floor. The highest-impact findings usually come from your application's specific business logic and tool integrations. How long does an LLM penetration test take? + Typically 5–10 testing days for a single application, with the report delivered within a week of testing finishing. Critical findings are escalated live during the engagement. Will the results satisfy customer security reviews and auditors? + Yes. You receive an executive summary, a technical report with reproduction steps, framework mapping (OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF) and an attestation letter you can share externally. Enterprise customers increasingly ask specifically whether AI features have been tested, this answers that question with evidence. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## AI Red Teaming Australia | Ironbark Cyber https://ironbarkcyber.com/ai-red-teaming AI Red Teaming We emulate a motivated adversary against your AI systems as they actually run, across models, guardrails, monitoring and the humans in the loop, and pursue the objectives that would hurt: data theft, fraud, hijacked agents, poisoned pipelines. Last updated 21 August 2026 ### What is AI red teaming? AI red teaming is an authorised adversarial campaign with objectives instead of a vulnerability checklist. Ironbark Cyber agrees a set of attacker goals with you, the ones that map to your real risk register, and then attempts to achieve them against your deployed AI systems, using the same persistence and creativity a real adversary would. The output is not a list of theoretical weaknesses; it's a demonstrated answer to "could this actually happen to us, and would we notice?" ### What does a campaign cover? - Objective-driven attacks against LLM applications, agents and AI-backed workflows: data extraction, unauthorised actions, fraud paths, persistent manipulation. - Guardrail and safety-system evaluation. Filters, moderation layers, output classifiers and policy enforcement, bypassed the way attackers bypass them, iteratively and in combination. - Detection and response. Did your monitoring see us? Did anyone act? A red team is as much a test of your telemetry as your controls. - Supply chain and pipeline attacks where in scope: model registries, fine-tuning data, prompt and template stores, MLOps tooling. - The human layer. Operators who approve agent actions, review flagged outputs or handle AI-generated content are part of the system, with your agreement, they're part of the scope. ### How is the campaign run? In phases: reconnaissance and threat modelling, attack development, execution, then reporting and replay. Campaigns are structured around MITRE ATLAS so every technique we use has a name your defenders can look up. Rules of engagement, boundaries and stop conditions are agreed before anything runs, and critical objective achievements are reported the day they happen. ### What do we receive? - A campaign narrative: what we tried, what worked, what your systems caught, told end-to-end so your team can replay it. - Technical findings with evidence and remediation guidance, ranked by real-world impact. - ATLAS technique mapping and control recommendations that map to NIST AI RMF and ISO/IEC 42001. - An executive debrief for boards and risk committees, plus a free retest of fixed issues within 90 days. ### How long does it take and what does it cost? Campaigns typically run two to six weeks. Pricing is fixed-fee per phase: indicatively from AU$30,000, with multi-phase campaigns scoped to AU$100,000+, quoted exactly within one business day of a scoping call. Wondering whether you need a red team or a pentest first? Read our comparison, for most teams the honest answer is a pentest first. FAQ ### Frequently asked questions How much does an AI red team engagement cost in Australia? + AI red teaming is scoped to objectives rather than assets, so pricing varies more than a pentest. Ironbark Cyber quotes fixed fees within one business day of a scoping call; indicative ranges are published on this page. Phased campaigns can be staged so you commit one phase at a time. What is AI red teaming? + AI red teaming is an objective-driven adversarial campaign against your AI systems as deployed. Instead of enumerating vulnerabilities in one application, we pursue realistic attacker goals (extract the training data, hijack the agent, defraud the workflow, poison the pipeline) against the full stack: models, applications, guardrails, monitoring and the people operating them. How is AI red teaming different from an LLM penetration test? + A pentest asks "what vulnerabilities exist in this application?" A red team asks "can a motivated adversary achieve this objective against our organisation?" Pentests are broad within a scope; red teams are deep along attack paths, and they test your detection and response as well as your prevention. Our comparison page covers when to choose which. Do you follow a recognised methodology? + Campaigns are structured around MITRE ATLAS tactics and techniques, informed by the OWASP LLM Top 10, and reported so findings map cleanly to NIST AI RMF and ISO/IEC 42001 controls. The methodology is documented in the report so your auditors can follow the reasoning. Will you disrupt production systems? + No. Rules of engagement are agreed up front, objectives, boundaries, data handling, escalation contacts and stop conditions. Destructive actions are simulated or performed against replicas. We have run adversarial campaigns against live systems for organisations of every size without operational impact. How long does an AI red team take? + Typically two to six weeks depending on objectives, phased as reconnaissance, attack development and execution. You receive interim updates throughout, and if we achieve a critical objective early, you hear about it that day, not in the closing report. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## AI Agent Security Testing Australia | Ironbark Cyber https://ironbarkcyber.com/ai-agent-security-testing AI Agent Security Testing When an LLM can call tools, spend money and act on your behalf, a prompt injection stops being a text problem and becomes an action problem. Ironbark Cyber tests agentic systems the whole way through, from the untrusted input to the consequential action at the end of the chain. Last updated 21 August 2026 ### What is AI agent security testing? AI agent security testing is adversarial testing of AI systems that take actions, not just produce text. An agent that can read your email, call your APIs, query your database or trigger payments has real-world reach, and every piece of untrusted content it processes is a potential instruction. Ironbark Cyber tests the full path: can an attacker influence what the agent sees, and can that influence be turned into an action that hurts you? ### What do you test? - Tool and function abuse. Every tool the agent can invoke, the privileges it runs with, and what an attacker can make it do through crafted input. - Excessive agency. Actions the agent can take that it never should have been able to, the gap between "what we intended" and "what the permissions actually allow". - Indirect prompt injection to action. Instructions planted in documents, tickets, emails or web content that the agent reads and obeys, chained through to a consequential tool call. - Memory and context poisoning. Persistent manipulation of an agent's memory or knowledge base that changes its behaviour for later, legitimate users. - Multi-agent trust boundaries. Confused-deputy attacks and privilege escalation through agent-to-agent calls in orchestrated systems. - Human-in-the-loop bypass. Whether approval steps constrain the agent, or can be socially engineered or overwhelmed. ### How do you test it? We map the agent's trust graph, inputs, tools, permissions, memory and other agents, then attack each edge and chain the results. Testing is aligned to the OWASP LLM Top 10 (particularly excessive agency and insecure output handling) and MITRE ATLAS, and reported so the action impact of each finding is explicit, not left as "the model can be tricked". ### What do we receive? - An executive summary and an impact-ranked technical report with reproduction steps. - A trust-graph diagram of the agent system with the attack paths marked. - Remediation guidance covering permissions, tool design, input handling and human oversight. - A debrief call, an attestation letter, and a free retest of fixed issues within 90 days. ### How long does it take and what does it cost? Typically 5–12 testing days depending on scope. Fixed-fee, indicatively from AU$20,000, quoted exactly within one business day of a scoping call. FAQ ### Frequently asked questions How much does AI agent security testing cost? + Agent testing is fixed-fee, quoted within one business day of a scoping call. Cost tracks the number of tools the agent can invoke, how many agents interact, and whether the agent acts autonomously or with a human in the loop. Indicative pricing is published on this page. What is an AI agent, for testing purposes? + An AI agent is an LLM given the ability to take actions, call APIs and tools, read and write data, spend money, or invoke other agents, often across multiple steps with memory. That autonomy is exactly what makes agents useful and what makes them dangerous: a prompt injection stops being a text problem and becomes an action problem. What is the biggest risk with agentic systems? + Excessive agency combined with untrusted input. If an attacker can influence what the agent reads, and the agent can take consequential actions, the attacker can often chain the two: injected instructions in a document lead to a tool call that leaks data or moves money. We test that whole path, not just the prompt. Do you test multi-agent systems? + Yes. Multi-agent systems add confused-deputy attacks, trust boundaries between agents, and privilege escalation through agent-to-agent calls. We map the trust graph and test each edge, because the weakest agent often becomes a pivot into the others. How does this differ from an LLM penetration test? + LLM pentesting focuses on a model-backed application; agent security testing focuses on what the model can do, the tools, permissions, memory and orchestration around it. There is overlap, and for an agentic product we usually scope both together so injection findings are followed through to their real-world action impact. How long does agent security testing take? + Typically 5–12 testing days depending on the number of tools and agents in scope, with the report delivered within a week of testing finishing. Critical findings are escalated live. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Secure AI Architecture Review Australia | Ironbark Cyber https://ironbarkcyber.com/secure-ai-architecture-review Secure AI Architecture Review The cheapest AI vulnerability to fix is the one still on the whiteboard. Ironbark Cyber threat-models your AI design, data flows, tool permissions, trust boundaries and tenant separation, and tells you what to change before it's expensive. Last updated 21 August 2026 ### What is a secure AI architecture review? A secure AI architecture review is an analytical assessment of how your AI system is designed and built, focused on where it can be attacked. Ironbark Cyber reads your architecture, data flows and key code paths, builds a threat model, and hands back a prioritised list of design changes. It's the earliest and cheapest place to remove AI risk, before a single attacker, or a single auditor, gets involved. ### What does the review cover? - Trust boundaries. Where untrusted input enters the system and how far it can travel before something trusts it. - Data flows and context. What data reaches the model's context window, from where, and whether that respects tenant and permission boundaries. - Tool and permission design. What the model can invoke, with whose privileges, the difference between a helpful agent and a confused deputy. - Retrieval and knowledge sources. How RAG content is ingested, trusted and isolated, and whether it can be poisoned. - Output handling. Where downstream code trusts model output, and what injection that opens. - Secrets, isolation and monitoring. Key management, sandboxing of tool execution, and whether you'd detect an attack in progress. ### How does it work? We start with a scoping call and a request for design docs, data-flow diagrams and access to key code and configuration. We then run structured threat-modelling sessions with your team, referenced to the OWASP LLM Top 10, MITRE ATLAS and NIST AI RMF, and deliver a written threat model and remediation roadmap. Where the system is already running, we'll usually recommend following the review with an LLM penetration test to prove the fixes hold. ### What do we receive? - A written threat model: trust boundaries, data flows, attacker objectives and control gaps. - A prioritised list of design and configuration changes, ranked by risk reduction. - Framework mapping so the work feeds directly into ISO/IEC 42001 or AU AI Technical Standard alignment. - A debrief session with your engineering and product teams. ### What does it cost? Fixed-fee, indicatively from AU$12,000, quoted exactly within one business day of a scoping call. FAQ ### Frequently asked questions How much does a secure AI architecture review cost? + Architecture reviews are fixed-fee, quoted within one business day of a scoping call. Cost depends on the size of the system and how many integrations and data flows are in scope. Indicative pricing is published on this page. When should we do an architecture review, before or after building? + Before, if you can. A design-stage review catches expensive mistakes, over-privileged tools, untrusted data reaching the context, weak tenant separation, while they are still cheap to fix. But a review of an existing system is just as valuable, and we do both. What is the difference between this and an LLM penetration test? + An architecture review is analytical: we read the design, data flows and code and reason about what could go wrong. A penetration test is empirical: we attack the running system to prove what does go wrong. Reviews are cheaper and earlier; pentests are proof. Many clients do a review at design time and a pentest before launch. Do you provide a threat model? + Yes. The core deliverable is a threat model of your AI system, trust boundaries, data flows, attacker objectives and the controls that should sit between them, plus a prioritised list of design changes. Which frameworks do you reference? + Reviews reference the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI RMF and, where relevant, ISO/IEC 42001 and the Australian Government AI Technical Standard, so the recommendations line up with the assurance work that follows. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## ISO 42001 Readiness Australia | Ironbark Cyber https://ironbarkcyber.com/iso-42001-readiness ISO/IEC 42001 Readiness Your enterprise customers are starting to ask whether you govern AI to a standard. ISO/IEC 42001 is that standard. Ironbark Cyber runs the gap assessment, builds the roadmap and does the technical testing that proves your AI controls hold, so certification is a formality, not a scramble. Last updated 21 August 2026 ### What is ISO/IEC 42001? ISO/IEC 42001 is the international management-system standard for artificial intelligence. It gives an organisation a certifiable way to show it governs AI responsibly, assessing risks and impacts, controlling the AI lifecycle, and improving continually. It is the AI counterpart to ISO/IEC 27001, and it is becoming the thing that unblocks enterprise and government deals where "how do you manage AI risk?" now appears in the questionnaire. ### What does readiness involve? - Scoping. Which AI systems and processes the management system should cover, usually narrower than "everything", and getting that right saves months. - Gap assessment. A structured review of your current practice against every clause and Annex A control, with a clear picture of what exists, what's partial and what's missing. - Remediation roadmap. A prioritised, costed plan to close the gaps, policies, processes, risk and impact assessments, and technical controls. - Impact assessments. Support building the AI system impact assessments the standard requires, aligned where relevant with the Australian Government's AI Impact Assessment expectations. - Evidence through testing. Where a control claims your AI is secure, we can prove it with LLM penetration testing or red teaming, real evidence, not an assertion. ### How does it fit with your other compliance work? ISO/IEC 42001 shares its management-system backbone with ISO/IEC 27001, so if you're already certified there, much of the machinery, risk process, internal audit, management review, is reusable. We map controls across ISO 42001, the NIST AI RMF and the Australian Government AI Technical Standard so one programme of work satisfies several audiences. If you're weighing the frameworks, see ISO 42001 vs NIST AI RMF. ### What do we receive? - A scoping statement and a full gap assessment against ISO/IEC 42001. - A prioritised, costed remediation roadmap to audit-readiness. - Templates and support for AI risk and impact assessments. - Any supporting technical testing needed to evidence controls, delivered by the same team. ### What does it cost and how long does it take? A gap assessment typically runs two to four weeks; full readiness is usually a few months of phased work. Fixed-fee, indicatively a gap assessment from AU$15,000, with full readiness programmes scoped individually, quoted within one business day of a scoping call. FAQ ### Frequently asked questions How much does ISO 42001 readiness cost? + Readiness engagements are fixed-fee, quoted within one business day of a scoping call. Cost depends on the size of your organisation and how many AI systems fall in scope of the management system. Indicative pricing is published on this page. What is ISO/IEC 42001? + ISO/IEC 42001 is the international management-system standard for artificial intelligence, published in 2023. It is to AI what ISO/IEC 27001 is to information security: a certifiable framework for governing how an organisation develops, deploys and oversees AI systems, covering risk assessment, impact assessment, lifecycle controls and continual improvement. Is Ironbark Cyber a certification body? + No, and no consultancy can be, certification must come from an accredited certification body to stay independent. Ironbark Cyber does the readiness work: the gap assessment, the remediation roadmap and the technical testing that proves your AI controls actually work, so that when the auditor arrives you pass. How does ISO 42001 relate to ISO 27001 and the NIST AI RMF? + ISO 42001 sits alongside ISO 27001 (information security) and reuses its management-system structure, so if you are already certified to 27001 much of the groundwork exists. The NIST AI RMF is a complementary, non-certifiable risk framework; we map between them so one body of work serves multiple stakeholders. Our comparison of ISO 42001 and the NIST AI RMF covers the differences. Do we need penetration testing for ISO 42001? + The standard requires you to assess and treat AI risks, and demonstrating that credibly usually means testing. A readiness engagement identifies where technical testing, LLM pentesting, AI red teaming, is needed to evidence a control, and we can deliver that testing as part of the same programme. How long does readiness take? + A gap assessment typically takes two to four weeks; closing the gaps to audit-ready depends on how much needs to change, and is usually a few months. We phase it so you always know what is left and what it costs. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## AI Governance & Assurance Australia | Ironbark Cyber https://ironbarkcyber.com/ai-governance-and-assurance AI Governance & Assurance Alignment with the Australian Government AI Technical Standard, AI Impact Assessments and the state frameworks, backed by real testing rather than a template. Ironbark Cyber helps agencies and suppliers show that their AI is governed and that the controls hold up. Last updated 21 August 2026 ### What is AI governance and assurance? AI governance and assurance is the work of showing, to boards, regulators, agency executives and customers, that your AI systems are used responsibly and that the controls around them hold. In Australia that increasingly means aligning to a specific set of government frameworks and producing evidence a reviewer will accept. Ironbark Cyber does that grounded in adversarial testing, so the assurance is honest rather than aspirational. ### Which Australian frameworks do you align to? - Australian Government AI Technical Standard. The Commonwealth's technical baseline for AI systems, security, testing, transparency and monitoring expectations. - DTA Policy for responsible use of AI in government (v2.0). Accountable officials, transparency statements and mandatory AI Impact Assessments. - National AI Centre, Guidance for AI Adoption. The voluntary good-practice guidance underpinning responsible AI in the private sector. - NSW AI Assessment Framework. The assessment expectations for AI use across NSW government. - Queensland FAIRA. The Foundational Artificial Intelligence Risk Assessment used across Queensland government. - International anchors. NIST AI RMF, ISO/IEC 42001 and the EU AI Act, mapped in where they matter to your stakeholders. ### What does an engagement produce? - Alignment assessments. A clear read of where a given AI system sits against the AU AI Technical Standard and the relevant state framework, with gaps and actions. - AI Impact Assessments. Assessments that document risks, affected people, mitigations and oversight to the standard the DTA policy expects. - Transparency statements. Support producing the public-facing statements government AI use now requires. - Evidence through testing. LLM penetration testing and red teaming to substantiate security and robustness claims. - A governance roadmap that ties the above into your existing risk and security processes. ### Who is this for? Commonwealth and state agencies deploying AI; the prime contractors and SMEs who build AI systems for them and must meet the same expectations; and regulated private-sector organisations that want government-grade assurance. If you're a government buyer, our government page covers how to engage Ironbark Cyber directly as an Australian SME. ### What does it cost? Fixed-fee, indicatively from AU$15,000 per system, with programmes scoped individually, quoted within one business day of a scoping call. FAQ ### Frequently asked questions How much does AI governance and assurance work cost? + Governance and assurance engagements are fixed-fee, quoted within one business day of a scoping call. Cost depends on the number of AI systems and which frameworks you need to satisfy. Indicative pricing is published on this page. What is the Australian Government AI Technical Standard? + It is the Commonwealth's baseline of technical requirements for AI systems used in government, covering security, transparency, testing and monitoring expectations. Agencies and their suppliers are expected to align to it, and it sits alongside the DTA Policy for responsible use of AI in government, which mandates AI Impact Assessments and accountable officials. What is an AI Impact Assessment? + An AI Impact Assessment is a structured evaluation of a proposed AI use, its risks, affected people, mitigations and oversight, required under the DTA policy for government AI use and increasingly expected in the private sector. Ironbark Cyber helps you produce assessments that stand up to scrutiny rather than tick a box. Do you cover state government frameworks? + Yes. We align work to the NSW AI Assessment Framework and Queensland's FAIRA (Foundational Artificial Intelligence Risk Assessment) as well as Commonwealth expectations, so state agencies and their suppliers get assurance in the language their own governance asks for. Is this the same as ISO 42001 readiness? + Related but distinct. ISO/IEC 42001 readiness targets a certifiable management system. AI governance and assurance is broader and often government-focused: aligning specific AI systems to the AU AI Technical Standard, producing AI Impact Assessments and transparency statements, and evidencing controls. We frequently do both, and map between them. Do you provide the technical testing to back the assurance? + Yes. Assurance without testing is an opinion. Where a control or an impact assessment claims an AI system is secure, we can prove it with LLM penetration testing or red teaming delivered by the same team. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Penetration Testing | Ironbark Cyber https://ironbarkcyber.com/penetration-testing Penetration Testing Manual, scope-tailored offensive testing across your web apps, APIs, networks, cloud environments and corporate infrastructure. Findings ranked by real-world impact, with reports your team will actually read. ### What we test - Web applications & APIs. Modern SPAs, REST and GraphQL APIs, authentication and authorisation flows, business logic. - Cloud environments. AWS, Azure and GCP configuration review, identity, network controls and exposed services. - Internal & external networks. From internet-facing perimeter sweeps to assumed-breach internal engagements. - Mobile. iOS and Android applications, including their backends and inter-process trust boundaries. Testing for ISO 27001, SOC 2 or a customer security review? We scope compliance-driven engagements so you get exactly what your auditor needs. No more, no less. ### How we work Every engagement starts with a scoping call so we understand what success looks like for you. We agree on goals, rules of engagement and reporting expectations up front. No surprises, no scope creep. During testing, we keep an open channel with your team. Critical findings are escalated the moment we see them. At the end of the engagement, we deliver: - An executive summary written for non-technical stakeholders. - A technical report with full reproduction steps, evidence and remediation guidance. - A debrief call with your engineering team to walk through the findings. - A free retest of fixed issues within 90 days. ### Why teams choose us Many penetration testing firms run scanners, lightly review the output, and ship a report. We don't. Every Ironbark engagement is run hands-on by an experienced offensive tester who finds the issues automated tools miss. Our team has presented at major industry conferences, contributed to widely-used open source security tooling, and written some of the most-read content in the offensive security space. We bring that depth to every test. Engagements ### Choose your engagement Every engagement is scoped to your environment and quoted fixed-price. These are the most common starting points. #### Web application Authentication, access control, business logic and the OWASP Top 10, tested by hand. → #### API REST and GraphQL. BOLA/IDOR, broken auth and the data exposure your UI never shows. → #### External network Deep recon of your internet-facing footprint, then manual attack, by the people who build the recon tools. → #### Cloud AWS, Azure and GCP. IAM escalation paths, public exposure and assumed-breach scenarios. → #### ISO 27001 & compliance Auditor-ready testing scoped to what certification actually requires. Also SOC 2 and PCI. → FAQ ### Frequently asked questions How much does a penetration test cost in Australia? + Most Ironbark engagements run 4–15 testing days at a fixed day rate. As a guide: a focused web application or API test typically lands between AU$8,000 and AU$18,000, and an external network test between AU$6,000 and AU$12,000. We provide a fixed quote within one business day of a free scoping call. How long does a penetration test take? + Typically 1–3 weeks from kickoff to report depending on scope. Critical findings are escalated the moment we discover them, so remediation can start before testing even finishes. How often should we get a penetration test? + At least annually. That's the cadence ISO 27001, SOC 2 and enterprise customers expect, plus after major changes like a new product, a re-architecture or an acquisition. What's the difference between a penetration test and a vulnerability scan? + A vulnerability scan is automated pattern-matching against known issues. A penetration test is a skilled human actively attacking your systems: chaining weaknesses, abusing business logic and proving real-world impact. If a report you paid for reads like scanner output, you bought a scan. Who actually does the testing? + The senior tester who scopes your engagement is the one who tests it. No bait-and-switch to a junior bench. Our testers have deep backgrounds in bug bounty hunting, offensive security research and open-source security tooling used across the industry. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Cyber & AI Security for Australian Government | Ironbark Cyber https://ironbarkcyber.com/government Cyber and AI security for Australian government Ironbark Cyber is an Australian-owned and operated SME delivering offensive security and AI assurance to Commonwealth and state agencies, and to the primes who serve them. Essential Eight, ISM and PSPF-aligned testing, IRAP-readiness pentesting, and AI assurance backed by real adversarial testing. Last updated 21 August 2026 ABN 18 692 781 561 · Australian owned and operated · Queensland, Australia ### What can Ironbark Cyber do for a Commonwealth agency? Offensive security testing and AI assurance mapped to the frameworks the Commonwealth actually uses. We do the hands-on technical work, finding the attack paths, proving the impact, and giving your team an auditor-ready path to close them. - Essential Eight uplift and validation. Testing against the Essential Eight maturity model, and against the broader ASD "Essentials" series as it emerges. - ISM and PSPF-aligned penetration testing. Testing scoped and reported against the Information Security Manual and Protective Security Policy Framework controls your assessors reference. - IRAP-readiness and pre-assessment penetration testing. Find and fix the issues before the formal IRAP assessment, so the assessment isn't where you discover them. - Supply-chain and third-party risk. Assessment of the vendors and integrations that extend your attack surface. ### What about AI assurance for agencies? The same offensive-first approach, applied to AI. As agencies adopt AI, the AI Technical Standard and the DTA policy set clear expectations, and Ironbark Cyber helps you meet them with evidence rather than assertions. - Alignment to the Australian Government AI Technical Standard for AI systems in government use. - AI Impact Assessments to the standard the DTA Policy for responsible use of AI in government expects. - AI transparency statements for public-facing AI use. - Technical testing to back it all. LLM penetration testing and red teaming ground every assurance claim in what an attacker can actually do. See AI governance & assurance for the full picture. ### What about state government? We work to the state frameworks as fluently as the Commonwealth ones. - New South Wales. Testing and assurance aligned to the NSW Cyber Security Policy, and support for Directive DCS-2025-04 third-party risk inventories. AI work aligned to the NSW AI Assessment Framework. - Queensland. Alignment with the IS18 information security policy, and AI risk work using Queensland's FAIRA (Foundational Artificial Intelligence Risk Assessment). ### How do you engage us? Ironbark Cyber is built to be easy for government to buy from. - SME direct engagement. As an Australian-owned SME, we can often be engaged directly under the Commonwealth Procurement Rules SME provisions (up to $500,000) and the equivalent Queensland and NSW SME direct-engagement rules. No full tender required. - Insurance. We hold professional indemnity and public liability cover; certificates of currency and levels are available on request. - Sovereign delivery. Australian owned and operated, with all work delivered by senior Australian-based consultants. - Clearance-ready. Tell us the clearance level your engagement requires on the scoping call and we'll confirm what we can staff for it. - Prime subcontracting. Where a panel position is required that we don't hold, we deliver as a subcontractor to a prime that does (see below). ### Partner with us as a prime If you're a large consultancy or systems integrator bidding Commonwealth and state work, and you need sovereign Australian offensive security or AI assurance capability on the team, Ironbark Cyber subcontracts. We bring senior, named consultants (led by a founder featured by HackerOne on AI red teaming), fixed pricing you can build into a bid, and delivery that reflects well on your name. We've supported delivery for primes and government suppliers already; talk to us early in a pursuit and we'll help you scope the security or AI assurance component. ### Why Ironbark Cyber for government? Ironbark Cyber is Australian owned and operated (ABN 18 692 781 561), senior-only in delivery, and offensive-first in method. The people who scope your work are the people who do it. For agencies that need testing that stands up to an assessor and AI assurance that stands up to scrutiny, that combination is the point. FAQ ### Frequently asked questions Can a government agency engage Ironbark Cyber directly without going to tender? + Often, yes. Ironbark Cyber is an Australian-owned SME, and under the Commonwealth Procurement Rules agencies can engage SMEs directly for procurements up to $500,000 (the SME direct-engagement provisions), with similar direct-engagement thresholds under state rules in Queensland and NSW. We can walk your procurement team through the pathway on a scoping call. Can you help with IRAP? + Yes. Ironbark Cyber provides IRAP-readiness and pre-assessment penetration testing. The technical testing that finds and fixes issues before a formal IRAP assessment, so the assessment goes smoothly. We work alongside IRAP assessors rather than replacing them. What if a procurement needs a panel we are not on? + Where we are not on a given panel, we can often be engaged directly under the SME direct-engagement provisions, or deliver as a subcontractor to a prime that holds the panel position. Tell us the procurement pathway on a scoping call and we will work out the cleanest route. Do you hold security clearances? + Tell us the clearance level your engagement requires on the scoping call and we will confirm what we can staff for it. All work is delivered by senior, Australian-based consultants. Can you subcontract to us as a prime? + Yes. Ironbark Cyber regularly delivers as a sovereign Australian subcontractor to larger primes and systems integrators that need senior offensive security or AI assurance capability on a bid or engagement. See the "Partner with us as a prime" section below. What is happening with the Essential Eight and the ASD "Essentials" series? + The ASD is evolving its cyber security advice, with a broader "Essentials" series expected to build on and eventually succeed the Essential Eight. Ironbark Cyber tracks these changes and tests against both the current Essential Eight maturity model and the emerging guidance, so your uplift work stays current. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## About Ironbark Cyber | AI Security & Pentest Firm https://ironbarkcyber.com/about About Ironbark Cyber An Australian AI security and penetration testing firm, built by people who'd rather find your problems before someone less friendly does. ### Who is Ironbark Cyber? Ironbark Cyber is an Australian consultancy specialising in two things: AI security and assurance, and offensive security. We test the systems organisations are betting on, LLM applications and agents, web and cloud infrastructure, the people around them, and we help boards, auditors and government prove the risk is managed. Headquartered in Queensland, Australia, we work with security-conscious organisations across the country and the world. We're deliberately senior-only. The consultant who scopes your engagement is the consultant who does it. No junior bench, no rebadged scanner output, no 200-page report nobody reads. ### Who founded it? Ironbark Cyber was founded by Luke Stephens, better known as hakluke. Luke is a widely recognised bug bounty hunter and security researcher, the author of open-source offensive tooling used across the industry (including hakrawler), and has been featured by HackerOne on AI red teaming. He owns the Haksec group of cybersecurity companies, of which Ironbark Cyber is the offensive security and AI arm, alongside sister brand Triagers (vulnerability disclosure triage). You can find more of Luke's work at hakluke.com, on LinkedIn, X and GitHub. ### Who does the work? Everyone at Ironbark Cyber is a senior practitioner with years in cybersecurity. There is no junior bench and no rebadged scanner output. The consultant who scopes your engagement is the one who does it, led personally by founder Luke Stephens. It's a deliberately small, senior team, and it's the whole point: you get the people who have spent careers breaking things for a living, not the people who read a report they didn't write. ### Why "Ironbark"? The Ironbark is one of Australia's toughest native trees: deeply rooted, fire-resistant, and built to outlast the storm. That's the kind of security posture we want for our clients. Not flashy, not theatrical, just resilient. ### Company facts - Legal name Ironbark Cyber - ABN 18 692 781 561 - Founded 2025 - Location Queensland, Australia - Address Suite 214, 10 Albert Ave, Broadbeach QLD 4218 - Group Part of the Haksec group - Ownership Australian owned & operated ### Press & talks Luke's work and writing turn up across the offensive security community. A selection: - Featured by HackerOne on AI red teaming. - Profiled by Detectify Labs on building bug bounty automation. - Interviewed on the Cybr podcast on breaking into bug bounty hunting. - Featured on HackerNoon for hakrawler, his open-source recon crawler. - Author of widely read offensive-security writing at hakluke.com and on Medium, and creator of open-source tooling used across the industry, including hakrawler, hakrevdns and hakoriginfinder. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Contact Ironbark Cyber | Book a Scoping Call https://ironbarkcyber.com/contact Contact us Tell us what you're trying to protect, secure or build. A senior consultant reads every enquiry and comes back within one business day, with a plan, not a sales sequence. Book a call Grab a 30-minute scoping call at a time that suits you.Open the calendar → Send an enquiry Use the form below. It goes straight to a senior consultant, and we reply within one business day.Go to the form → Office Suite 214, 10 Albert Ave Broadbeach QLD 4218 ABN 18 692 781 561 Scoping ### Request a fixed quote Give us the shape of what you need and we'll come back within one business day with a fixed price. No obligation, no drip campaign. #### What a scoping call covers - What you want tested or assured, and what "done" looks like for you. - The right engagement type, and whether you need us yet. - Rules of engagement, timing and how we handle critical findings. - A fixed price, delivered within one business day. No scope creep later. #### Why teams pick Ironbark - The people who scope your work are the people who do it. No shadow teams. - Findings ranked by real-world impact rather than CVSS scores. - Australian owned and operated; clients worldwide. - We build the tooling we wish other consultancies used. --- ## AI Red Teaming vs Penetration Testing | Ironbark Cyber https://ironbarkcyber.com/compare/ai-red-teaming-vs-penetration-testing AI Red Teaming vs Penetration Testing Two different questions, two different price tags. Here's the honest version of when each one earns its fee. Last updated 21 August 2026 ### What's the difference between AI red teaming and penetration testing? A penetration test asks "what vulnerabilities exist in this system?" and enumerates them within an agreed scope. An AI red team asks "can a motivated adversary achieve this specific objective against our organisation?" and pursues it across the whole deployed stack. Model, application, guardrails, monitoring and the people operating them. Pentests are broad within a boundary; red teams are deep along attack paths, and they test whether anyone notices. ### How do they compare side by side? Dimension | Penetration test | AI red team | Question answered | What exploitable weaknesses exist in this application or system? | Can an adversary achieve a real-world objective. And would we detect them? | Scope | Asset-defined: one application, API or environment | Objective-defined: whatever path reaches the goal, within agreed rules | Coverage | Broad. Aims to find as many issues as possible in the scope | Narrow but deep. Chains a few issues into complete attack paths | Tests detection & response | No. Defenders usually know it's happening | Yes. Your monitoring and operators are part of the test | Typical duration | 5–10 testing days | 2–6 weeks, phased | Typical cost | Lower. E.g. AU$8,000–18,000 for a web application | Higher. A multiple of a pentest, quoted per phase | Output | Impact-ranked findings with reproduction steps | Campaign narrative: what worked, what was caught, what it means | Best timed | Before launch, after major changes, annually | After controls are mature and pentest findings are fixed | ### When should you choose which? The short version: pentest first, red team once there's something worth evading. #### Choose a penetration test when… - Your AI feature or application hasn't had adversarial testing before. The first pass always pays for itself. - You need coverage for a launch, a customer security review, or a certification like ISO 27001 or SOC 2. - You want the most findings per dollar. A pentest surfaces the broad list; a red team proves one path expensively. #### Choose an AI red team when… - You've fixed the known issues and want to know whether a determined adversary still gets through. - You need to test guardrails, monitoring and human oversight as a system, not just application code. - A specific bad outcome keeps the board up at night. Data theft through an agent, model manipulation, fraud. And you want a demonstrated answer, not an opinion. ### How does Ironbark Cyber fit? Ironbark Cyber delivers both: LLM application penetration testing for the broad, asset-scoped pass, and AI red teaming for objective-driven campaigns against systems that have earned one. Both are senior-only and fixed-fee, quoted within one business day of a scoping call, and the honest recommendation is the one above: most teams should pentest first. If you book a red team you're not ready for, we'll say so on the call. Charging you to rediscover your pentest backlog the slow way isn't a service. FAQ ### Frequently asked questions Should we do a penetration test or a red team first? + A penetration test, almost always. A red team assumes your controls are mature enough to be worth evading; if a pentest would find ten exploitable issues in a week, a red team will just find one of them the expensive way. Ironbark Cyber will tell you on the scoping call if you are not ready for a red team. It happens often, and it saves you money. Can one engagement combine both? + Yes. A common pattern is a scoped penetration test of the AI application first, followed by an objective-driven red team phase against the hardened system. Ironbark Cyber quotes each phase fixed-fee so you can stop after the pentest if that is where the value is. Is AI red teaming just jailbreaking the model? + No. Jailbreak resistance is one control among many. An AI red team pursues objectives. Exfiltrate data, hijack an agent, defraud a workflow. Against the whole deployed system: the model, the application around it, the guardrails, the monitoring and the humans in the loop. What does each cost? + Penetration tests are asset-scoped and cheaper: Ironbark Cyber's published web application range is AU$8,000–18,000, and LLM application tests are quoted fixed-fee on the same model. Red teams are objective-scoped and run longer, so they cost more. Typically a multiple of a pentest, quoted per phase within one business day of a scoping call. Do compliance frameworks ask for a pentest or a red team? + Most certifications (ISO 27001, SOC 2) expect penetration testing. AI-specific frameworks. ISO/IEC 42001, the NIST AI RMF and the Australian Government AI Technical Standard. Increasingly expect adversarial testing appropriate to the risk, which for high-impact AI systems points toward red teaming. Ironbark Cyber maps findings to whichever framework your auditors cite. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## ISO 42001 vs NIST AI RMF | Ironbark Cyber https://ironbarkcyber.com/compare/iso-42001-vs-nist-ai-rmf ISO 42001 vs NIST AI RMF One earns you a certificate, the other earns you a vocabulary. Most organisations end up wanting both. Here's how to sequence them. Last updated 21 August 2026 ### What's the difference between ISO 42001 and the NIST AI RMF? ISO/IEC 42001 is a certifiable international standard: it defines an AI management system your organisation builds and an accredited auditor certifies. The NIST AI RMF is a voluntary risk management framework: guidance for governing, mapping, measuring and managing AI risk, with no certification attached. One is a bar you clear; the other is a map you use. ### How do they compare side by side? Dimension | ISO/IEC 42001 | NIST AI RMF | What it is | Certifiable management system standard for AI (published 2023) | Voluntary risk management framework (published 2023) | Certification | Yes. Audited by accredited certification bodies | No. Self-adopted, no formal attestation | Structure | Management-system clauses plus Annex A controls, same skeleton as ISO 27001 | Four functions: Govern, Map, Measure, Manage | Commercial pull | Strong. Answers "are you certified?" in enterprise and government due diligence | Moderate. Expected vocabulary with US customers and regulators | Effort to adopt | Months. Gap assessment, remediation, audit | Days to start. Adopt incrementally at your own pace | Cost | Readiness consulting plus certification body fees | Internal effort only, unless you want help | Best fit | Organisations that must prove AI governance to buyers, boards or regulators | Teams that want a working risk practice without an audit deadline | ### When should you choose which? Sequence by who's asking the questions. #### Choose ISO/IEC 42001 when… - Enterprise or government customers are asking how you govern AI, and "here's our certificate" is worth more than a slide deck. - You're already certified to ISO 27001. The shared management-system skeleton means much of the machinery already exists. - You sell into markets (including the EU) where demonstrable AI governance is becoming a condition of doing business. #### Choose the NIST AI RMF when… - You want to start managing AI risk this quarter, not after an audit cycle. - Your customers and partners are primarily US-based and speak NIST natively. - You need a shared internal vocabulary for AI risk before committing to a certification programme. They're complementary, not rivals: the RMF's risk thinking slots into a 42001 management system, and organisations that start with the RMF usually find the move to 42001 shorter for it. ### How does Ironbark Cyber fit? Ironbark Cyber runs ISO/IEC 42001 readiness. Scoping, gap assessment, remediation roadmap. And maps the same controls across the NIST AI RMF and the Australian Government AI Technical Standard as part of AI governance and assurance, so one programme of work satisfies every audience that asks. And because we're an offensive security firm first, the risk assessments are grounded in real adversarial testing rather than assertion: where a control claims your AI is secure, we can prove it or disprove it. The honest recommendation: if a customer contract or tender is waiting on evidence, go 42001; if not, adopt the RMF now and let it pay down the 42001 work later. FAQ ### Frequently asked questions Can you be certified against the NIST AI RMF? + No. The NIST AI RMF is a voluntary framework with no certification scheme. You adopt it, you don't pass it. ISO/IEC 42001 is the certifiable option: an accredited certification body audits your AI management system and issues a certificate customers can verify. Do we need both ISO 42001 and the NIST AI RMF? + Usually you need one as the backbone and the other as a reference. Australian organisations selling to enterprise or government typically anchor on ISO/IEC 42001 because a certificate answers due-diligence questionnaires, then borrow the NIST AI RMF's risk vocabulary where US customers or partners expect it. The controls overlap heavily, so one body of work serves both. Which do Australian government buyers care about? + Neither is mandated directly. Australian agencies work to the Government AI Technical Standard, the DTA policy on responsible AI use and state frameworks like the NSW AI Assessment Framework and Queensland FAIRA. But ISO/IEC 42001 maps cleanly onto those expectations, and Ironbark Cyber maps the crosswalk as part of readiness work. How long does ISO 42001 certification take compared with adopting the NIST AI RMF? + Adopting the NIST AI RMF can start immediately. It is guidance, so you move at your own pace. ISO/IEC 42001 runs on audit timelines: a gap assessment of two to four weeks, a remediation period of a few months, then the certification audit. The certificate is the reward for the slower road. Does either framework require penetration testing of AI systems? + Neither says "penetration test" outright, but both require you to assess and treat AI risks, and demonstrating that credibly for a high-impact system usually means adversarial testing. Ironbark Cyber delivers the testing and the readiness work together, so the evidence and the paperwork agree. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Big Four vs Specialist AI Security Firm | Ironbark Cyber https://ironbarkcyber.com/compare/big-four-vs-specialist-ai-security-firm Big Four vs Specialist AI Security Firm Both will happily take the engagement. The question is who turns up to do it. And what you're actually paying for. Last updated 21 August 2026 ### Should you hire a Big Four firm or a specialist for AI security? Hire a large consultancy when you need an enterprise-wide programme with board-level reporting and an army to run it; hire a specialist when you need your AI systems actually attacked by people who do that for a living. The deciding factor is delivery: at large firms the expertise that wins the work and the staff who perform it are different people, while at a specialist firm like Ironbark Cyber they are the same person. ### How do they compare side by side? Dimension | Big Four / large consultancy | Specialist AI security firm | Who does the work | Partner sells, team of mixed seniority delivers | The senior consultant who scoped it. No junior bench | Depth of offensive AI expertise | Variable. Genuine experts exist but are spread thin | The whole firm; it's the entire business | Breadth of service | Everything from strategy to tax. One throat to choke | Narrow by design: testing, red teaming, AI assurance | Pricing | Day-rate estimates, change requests, brand premium | Fixed fee quoted up front. Ironbark quotes in 1 business day | Procurement fit | Panel positions everywhere, painless for large enterprises | SME pathways; direct engagement or subcontract via a prime | Brand cover for the board | High. Nobody gets fired for the logo | Rests on named practitioners and their public track record | Typical cost per senior hour | High. Pyramid staffing means you fund the pyramid | Lower. You pay for seniors and get seniors | ### When should you choose which? It's a genuine fork, not a trick question. #### Choose a Big Four or large consultancy when… - The engagement is an organisation-wide transformation. Hundreds of stakeholders, multi-year, heavy programme management. - Your procurement or board requires a firm of that scale and insurance posture, full stop. - You need many disciplines (legal, risk, change, technology) under one engagement letter. #### Choose a specialist firm when… - The deliverable is adversarial: an LLM pentest, an AI red team, an agent security assessment. Work where the tester's personal skill is the product. - You want fixed pricing and a named senior consultant rather than an estimate and a resourcing pool. - You already have a governance programme and need the technical evidence underneath it to be real. ### How does Ironbark Cyber fit? Ironbark Cyber is the specialist side of this comparison, and deliberately so: an Australian firm doing AI security and assurance and penetration testing with senior-only delivery, fixed quotes within one business day, findings ranked by real-world impact and a free 90-day retest. Founder Luke Stephens (hakluke) is a widely known security researcher featured by HackerOne on AI red teaming. The track record is public, which is the specialist's answer to brand cover. And this isn't an either/or pitch: on large programmes we regularly work alongside big firms, and on government engagements we subcontract to primes that need sovereign Australian specialists. If your problem genuinely needs two hundred consultants, hire the firm that has them. And bring us in for the part where someone has to break the AI. FAQ ### Frequently asked questions Are Big Four AI security services bad? + No. They're built for a different job. Large consultancies excel at enterprise-wide transformation, board reporting and programmes that need two hundred people. The trade-off is delivery: the partner who wins the work is rarely the person who does it, and deep offensive AI expertise is scarce at any size of firm. For hands-on adversarial testing, a specialist is usually the sharper tool. Is a specialist firm riskier for a large enterprise to engage? + The practical risks are continuity and capacity, and both are manageable: fixed-price scoping, named consultants in the contract, and staged engagements. What you get back is the senior people actually doing the work. Ironbark Cyber puts the consultant who scopes your engagement on the engagement. That's a contractual habit, not a marketing line. Can a specialist work alongside our Big Four provider? + Yes, and it's common. A typical split: the large firm owns the governance programme and board reporting, while a specialist like Ironbark Cyber delivers the adversarial testing. LLM pentests, AI red teams. That the programme cites as evidence. Specialists also subcontract to primes on government work. How do the costs compare? + Specialist engagements are usually cheaper in absolute terms and much cheaper per senior hour. Large firms carry brand premium and pyramid staffing. You fund the juniors learning on your engagement. Ironbark Cyber publishes indicative ranges (web application pentests AU$8,000–18,000, for example) and quotes fixed fees within one business day, which large firms rarely do. What should we ask any firm before hiring them for AI security testing? + Four questions sort the field quickly: Who exactly will do the testing, and what have they personally published or found? Is the price fixed before we sign? What happens when you find something critical mid-engagement? And do you retest fixes? If the answers are vague, the delivery will be too. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Penetration Test vs Vulnerability Scan | Ironbark Cyber https://ironbarkcyber.com/compare/penetration-test-vs-vulnerability-scan Penetration Test vs Vulnerability Scan One is hygiene, the other is proof. Plenty of invoices confuse the two. Here's how not to. Last updated 21 August 2026 ### What's the difference between a penetration test and a vulnerability scan? A vulnerability scan is an automated tool matching your systems against a database of known issues. Fast, cheap, shallow, and noisy with false positives. A penetration test is a skilled human actively attacking your systems: chaining weaknesses, abusing business logic and proving real-world impact. Scans tell you what a tool can see; a pentest tells you what an attacker can do. ### How do they compare side by side? Dimension | Vulnerability scan | Penetration test | Performed by | Software | A senior human tester (with tooling for breadth) | Finds | Known vulnerability classes with signatures | Business logic flaws, chained attacks, authorisation failures | False positives | Common. Someone must triage the output | Rare. Every finding is validated and reproduced | Proves impact | No. Flags possibilities | Yes. Demonstrates what an attacker achieves | Cost | Low. Tooling from free to a few hundred dollars monthly | AU$6,000–18,000+ depending on scope, fixed-fee | Cadence | Continuous or monthly | Annually and after major changes | Satisfies auditors & enterprise customers | Rarely on its own | Yes. The expected evidence for ISO 27001, SOC 2 and security reviews | ### When should you choose which? This one isn't either/or. Mature teams run both, on different clocks. #### Use vulnerability scanning when… - You want continuous coverage of known issues across a large estate. Patch drift, misconfigurations, expired certificates. - You need cheap, frequent hygiene between deeper engagements. - You're feeding a patching programme, not answering "are we actually exploitable?" #### Use a penetration test when… - An auditor, certification or enterprise customer requires evidence of testing. ISO 27001, SOC 2, PCI DSS, security questionnaires. - You're launching or materially changing an application, API or AI feature. - You want to know what a real attacker could do with your business logic, not what a database of CVEs says about your versions. ### How does Ironbark Cyber fit? Ironbark Cyber does the human half of this comparison: manual, scope-tailored penetration testing across web applications, APIs, networks, cloud and LLM applications. Senior-only, fixed-fee, with critical findings escalated the day we find them and a free 90-day retest of fixes. We use scanners the way a builder uses a spirit level: for breadth, never as the deliverable. The honest recommendation: keep (or start) scanning continuously. It's cheap and useful. And bring in a pentest when you need to know what's actually exploitable, or when someone with a clipboard needs proof. FAQ ### Frequently asked questions Is a vulnerability scan good enough for compliance? + Sometimes on paper, rarely in substance. ISO 27001, SOC 2 and most enterprise customer reviews expect penetration testing, not scanning. And auditors increasingly know the difference. If a report you paid for reads like scanner output with a logo on it, you bought a scan. How much does each cost? + Scans are cheap or free: open-source tools, or commercial platforms from a few hundred dollars a month. Penetration tests are senior human time: Ironbark Cyber's published ranges are AU$8,000–18,000 for a web application, AU$8,000–15,000 for an API and AU$6,000–12,000 for an external network, fixed-fee. How often should we do each? + Scan continuously or at least monthly. It's automated hygiene, so there's no reason not to. Penetration test at least annually, plus after major changes: a new product, a re-architecture, an acquisition, or a significant new AI feature. Can a scanner find business logic flaws? + No. Scanners match patterns of known vulnerability classes. Business logic abuse. Paying $0 for a $500 order, accessing another tenant's records, skipping an approval step. Has no signature to match. These are the findings that lead to breaches, and they are found by humans. We already run a scanner. Will a pentest just repeat what it says? + A good one won't. Ironbark Cyber testers use tooling for breadth and then spend the engagement where scanners can't go: authentication and authorisation logic, chained findings, business logic. If a pentest quote is suspiciously cheap, ask who is doing the work and how much of it is a scanner. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement. --- ## Bug Bounty vs Penetration Test | Ironbark Cyber https://ironbarkcyber.com/compare/bug-bounty-vs-penetration-test Bug Bounty vs Penetration Test Written by people who've earned money on both sides of this comparison. They solve different problems. Sequence them right and they compound. Last updated 21 August 2026 ### What's the difference between a bug bounty and a penetration test? A penetration test is a time-boxed engagement where named senior testers methodically cover an agreed scope and hand you a report. A bug bounty is a standing invitation to a global crowd of researchers to find what they can, paid per valid bug. A pentest buys coverage and evidence; a bounty buys continuous opportunistic discovery. Mature programmes use both, in that order. ### How do they compare side by side? Dimension | Bug bounty | Penetration test | Who tests | Anonymous global crowd, self-selecting | Named senior consultants under contract and NDA | Coverage | Unpredictable. Hunters go where the payouts are | Methodical. The agreed scope gets covered | Timing | Continuous, always on | Time-boxed: days to weeks, then a report | Cost model | Platform fees + per-bug rewards + internal triage effort | Fixed fee. E.g. AU$8,000–18,000 for a web application | Output | A stream of individual reports of wildly varying quality | Impact-ranked report, executive summary, attestation letter | Compliance value | Low. Auditors want a scoped test | High. The standard evidence for ISO 27001, SOC 2 and reviews | Operational load | High. Every submission needs triage | Low. Findings arrive validated and reproduced | ### When should you choose which? Sequence matters more than preference here. #### Choose a penetration test when… - The asset has never had professional adversarial testing. A bounty crowd will just invoice you for the obvious findings one duplicate at a time. - You need an auditor-ready report for ISO 27001, SOC 2, PCI DSS or an enterprise customer review. - You need guaranteed coverage of something specific: a new product, a major release, an AI feature. #### Choose a bug bounty when… - Your assets are already tested and hardened, and you want continuous eyes on what changes between engagements. - You have (or can outsource) the triage capacity to handle the submission stream. - Your attack surface is broad and public enough that crowd economics work in your favour. ### How does Ironbark Cyber fit? Ironbark Cyber sits on both sides of this fence with unusual credibility: founder Luke Stephens (hakluke) is a widely known bug bounty hunter, and the firm delivers senior-only penetration testing. Fixed quotes within one business day, findings ranked by real-world impact, free 90-day retest. So the recommendation is unconflicted: pentest first, always; add a bounty programme once the easy findings are gone and you can handle the stream. And if the stream is already drowning your engineers, our sister service Triagers.com does the deduplication, validation and researcher comms so they can get back to shipping fixes. FAQ ### Frequently asked questions Is a bug bounty cheaper than a penetration test? + Not reliably. A pentest is a known, fixed cost. Ironbark Cyber publishes ranges like AU$8,000–18,000 for a web application. A bounty programme has platform fees, unpredictable reward payouts, and the ongoing internal cost of triaging every submission, valid or not. Bounties reward outcomes; pentests buy coverage. The budgets behave completely differently. Does a bug bounty satisfy compliance requirements? + Usually not. ISO 27001, SOC 2 and enterprise security reviews expect a scoped, methodical penetration test with a report and attestation. A bounty programme is continuous and opportunistic. Valuable, but not the document your auditor is asking for. Should we run a bug bounty before our first penetration test? + No. Launching a bounty on untested software is paying retail for bugs a pentest would have found wholesale. And your team will drown in duplicate reports. Test first, fix, then open a programme to catch what emerges over time. Who does the testing in each model? + A pentest gives you named senior consultants under contract and NDA, with agreed scope and rules of engagement. A bounty crowd is anonymous, global and self-selecting. Enormous collective talent, no guarantee any of it looks at your asset this month. Ironbark Cyber's founder has spent years on both sides, as a bug bounty hunter and as a consultant. Our VDP inbox is overflowing. Is that a pentest problem? + No. That's a triage problem, and it's common enough that Ironbark Cyber's sister service Triagers.com exists to solve it: deduplication, validation, severity rating and researcher comms, so your engineers only see real, actionable reports. Contact ### Talk to us Tell us what you're trying to protect, secure or build. We'll come back with a plan. #### Why teams pick Ironbark - The consultant who scopes your work is the one who does it. No shadow teams. - Findings ranked by real-world impact rather than raw CVSS scores. - Australian owned, with clients around the world. - We build our own tooling and bring it to your engagement.