Cyber Penetration Testing Services

This Tender is invited by the Issuer. Overview The Australian Securities and Investments Commission (ASIC) is seeking to engage a suitably qualified and experienced seller or sellers to be available to provide Cyber Security Penetration Testing Consultancy Services. Scope The scope includes: External network penetration testing to identify and explain the exploitability of network and host-based security vulnerabilities Web-application and API penetration testing of ASIC internet-facing web-applications through unauthenticated and automated web application scanning Internal penetration testing to identify vulnerabilities in infrastructure and applications inside ASIC's perimeter defences Cloud penetration testing for ASIC's AWS and Azure environments, designed to identify vulnerabilities in ASIC's cloud-hosted infrastructure Security configuration reviews, including examining configuration settings and/or code of systems, applications, networks, and devices to identify potential security weaknesses, misconfigurations, or vulnerabilities White-box (structural) testing and grey-box testing incorporating understanding of system architecture and business logic Red teaming services, including mapping and planning an attack, executing the attack and penetration, and reporting and documentation Business as-usual and ad-hoc penetration testing of new or modified applications or services, and periodic security assessment and security testing of business-as-usual applications already in service AI security assessment services to identify vulnerabilities, misconfigurations, and security risks within AI-enabled applications, chatbots, AI agents, and supporting AI services