CREST-accredited penetration testing, delivered as a service
Find the weaknesses an attacker would use before they do. Blacklock combines continuous automated scanning with manual testing by certified testers on one platform. OptimaTech scopes the work, sets it up and helps your team fix what matters, locally in Auckland and Hong Kong.
Quick answers
Last reviewed 20 October 2026 by OptimaTech Limited. Figures are quoted from the named source and year; see Sources.
Why unknown weaknesses are now a board-level risk
Most organisations do not lose data because they ignored security. They lose it through a weakness nobody knew was there: an unpatched server, a misconfigured cloud bucket, an API that trusts the wrong user. The latest official figures for New Zealand, Hong Kong and global breaches point the same way.
Up from NZ$21.6m the year before. 5,995 reports were received, 1 July 2024 to 30 June 2025. NCSC Cyber Threat Report 2025.1
A record high and up 27% year on year. Incidents involving vulnerable systems reached 2,328, more than 3.5 times the previous year. HKCERT, January 2026.2
Vulnerability exploitation is the top entry point for breaches, and 48% of breaches involved a third party. Verizon 2026 Data Breach Investigations Report.3
Based on breaches at 602 organisations between March 2025 and February 2026. IBM Cost of a Data Breach Report 2026.4
Financial exposure
Direct losses, incident response, legal advice and lost trading. Losses reported to New Zealand’s NCSC rose to NZ$26.9m in 2024/25.1
Regulatory exposure
A serious privacy breach must be notified to the Privacy Commissioner in New Zealand. In Hong Kong, designated critical infrastructure operators must report serious incidents within 12 hours.9
Customer and supply-chain exposure
Your customers now ask for evidence of testing in tenders and security questionnaires. With 48% of breaches involving a third party, they have reason to ask.3
What is a penetration test?
In plain terms, a qualified tester behaves like a real attacker, within an agreed scope and with your permission. They look for weaknesses, try to exploit them, and then show you what an attacker could reach and how to fix it.
A scan tells you a door might be unlocked. A penetration test checks whether it opens, what is behind it, and whether three small problems combine into one serious one.
The NCSC also cautions that a test only proves you were not vulnerable to known issues on the day of the test, and that a year or more often passes between tests.5 That is the gap PTaaS is designed to close.
Scan, pen test or PTaaS: what is the difference?
| Vulnerability scan | Traditional pen test | PTaaS (Blacklock) | |
|---|---|---|---|
| Who does it | Automated tools | Human tester | Automated tools plus certified human testers |
| How often | Continuous or scheduled | Usually once a year | Continuous scanning, manual tests on demand |
| Finds | Known vulnerabilities, misconfigurations | Exploitable paths, business-logic flaws, chained weaknesses | Both, tracked in one place |
| Output | List of findings | Static PDF report | Live dashboard, tickets to developers, three reports and a test certificate16 |
| Retesting | Next scan | Often a separate engagement | Fixes retested on the platform |
What is CREST, and why does accreditation matter?
Anyone can call a scan a “pen test”. CREST accreditation is how buyers, auditors and regulators tell the difference.
CREST (International) is a not-for-profit company registered in the UK that accredits cyber security companies and certifies the people who work for them.6 It works at two levels:
- The company. Before approval, CREST reviews the applicant’s policies and procedures. Accredited members then renew every year.6
- The tester. CREST-qualified individuals must pass rigorous professional examinations.6
CREST’s own buyer guide says it is “the combination of these” (accredited companies and qualified individuals) “that will provide you with the greatest assurance that the most effective tests will be conducted”.7
What a CREST member company commits to
According to CREST, using a CREST penetration testing member gives you reassurance that:7
Code of conduct
The supplier has agreed to an independent code of conduct.
Proven methodology
A proven testing methodology is used, and processes have been independently vetted.
Care with your data
Systems and data are handled carefully and professionally, and results are kept confidential.
Useful advice
You get advice on reducing the chance of similar vulnerabilities in future.
Independent complaints
If work quality is questioned, an independent body can investigate, and members who breach standards can lose membership.
Recognised by regulators
Hong Kong’s Cap. 653 Code of Practice lists CREST tester certifications among appropriate qualifications for penetration testers.8
Protecting the digital assets your business runs on
Your attack surface is wider than your website. Blacklock tests each layer an attacker could use, from internet-facing apps to the open-source code inside your software.16
Web application testing
Customer portals, booking systems and e-commerce sites, including authenticated areas. A browser plugin captures login sessions so protected pages are tested too.
Infrastructure testing
Internet-facing services, VPNs and internal networks: open services, weak SSL/TLS, exposed admin panels and missing patches.
Cloud testing
Cloud configuration and exposure checks, so a single misconfiguration does not become a public data leak.
Mobile app testing
The app and the APIs behind it, where customer data actually moves.
AI application testing
Applications built on large language models, where new risks such as prompt injection sit alongside traditional web flaws.
Continuous vulnerability assessment
Scheduled and on-demand scans between manual tests, with alerts when something new appears.
Static code scanning (SAST)
Finds flaws in source code before release, integrated with GitHub, GitLab, Bitbucket and Azure DevOps.
SBOM scanning
A full list of the open-source components in your software, checked against public vulnerability databases and exported in SPDX, CycloneDX or PDF.
From scoping to retest: the Blacklock PTaaS cycle
Instead of a once-a-year report that is out of date by the next release, testing becomes a cycle that keeps pace with change.
Scope with OptimaTech
We agree what to test (websites, APIs, networks, cloud, mobile, code), how often, and what “critical” means for your business.
Continuous automated scanning
The platform runs open-source and commercial tools for subdomains, breached email credentials, SSL issues, open services and common CMS attacks.16
Manual penetration testing
Certified testers follow a structured checklist based on OWASP, PTES and OSSTMM to find what tools miss: logic flaws and chained attacks.16
Reports and certificate
Results appear in the dashboard in real time. You receive Executive, Developer and Full Penetration Test reports and a penetration test certificate for customers and auditors.16
Fix, in your developers’ tools
One click turns a finding into a ticket in Jira or Azure DevOps, with remediation guidance for your technology stack.
Retest and repeat
Once a fix is deployed, request a retest on the platform. Scanning continues, so new issues are caught between manual tests.
How penetration testing supports your compliance obligations
Testing does not make you compliant on its own. It gives you evidence that you are finding and fixing weaknesses, which is what most frameworks ask you to show.
| Framework | Market | What it asks for | How testing helps |
|---|---|---|---|
| Privacy Act 2020, IPP 5 | NZ | Protect personal information with “security safeguards as are reasonable in the circumstances” against loss and unauthorised access.10 | Regular testing shows you are actively looking for and closing gaps. |
| NZISM §6.2 Vulnerability analysis | NZ | Agencies should implement a vulnerability analysis strategy and conduct vulnerability assessments, including after significant changes.12 | Scheduled scans and manual tests provide the assessment and the record. |
| Cap. 653 Code of Practice §6.3 | HK | Designated critical infrastructure operators’ security risk assessment should include a vulnerability assessment and a penetration test, by testers with appropriate professional qualifications. Assessments are due at least every 12 months.89 | The penetration test report forms an annex to the risk assessment report. CREST certifications are listed among qualifications.8 |
| PDPO, Data Protection Principle 4 | HK | All practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use.11 | Testing identifies the practical steps needed and evidences them. |
| ISO/IEC 27001:2022, Annex A 8.8 | NZHK | Management of technical vulnerabilities.18 | Scan and test results feed the vulnerability management records auditors review. |
| PCI DSS v4.0.1, Req. 11.4.2 and 11.4.3 | NZHK | Internal and external penetration testing at least once every 12 months and after any significant change, by a qualified, organisationally independent tester.13 | Manual tests and the test certificate support your annual evidence. |
This table is general information, not legal advice. Your obligations depend on your sector and designation. Working towards ISO/IEC 27001? See OptimaTech’s ISO/IEC 27001 and 42001 advisory service.
Global-standard testing, local accountability
Blacklock brings the platform and the certified testers. OptimaTech brings local scoping, onboarding and remediation support in New Zealand and Hong Kong. We commit. We deliver.
Independent accreditation
CREST accreditation for penetration testing services and ISO 27001:2022 certification.1415
Built in New Zealand
Blacklock is a New Zealand PTaaS company headquartered in Wellington and is a supplier on the New Zealand Government Marketplace.17 Blacklock reports more than 250 customers.14
Developer-friendly
Findings flow into Jira, Azure DevOps, GitHub, GitLab, Bitbucket and Vanta, with single sign-on through Microsoft Entra ID or Okta.
Local support in two markets
Our teams in Auckland and Hong Kong help you scope, onboard and turn findings into a practical remediation plan, in your time zone.
Evidence you can share
Executive reports for the board, developer reports for engineers, and a test certificate for customers, insurers and auditors.
Part of a wider plan
Testing fits alongside OptimaTech’s data security portfolio and ISO/IEC 27001 / 42001 advisory, so findings lead to lasting fixes.
How to choose a penetration testing provider
Use these questions in any tender or supplier review. They follow the advice in CREST’s guide and the UK NCSC’s penetration testing guidance.57
- Is the company accredited? Ask for CREST accreditation, not just certified individuals.
- Who will test? Ask which certifications the testers hold, for example CREST CRT, CPSA or OSCP.
- What methodology is used? Look for recognised methods such as OWASP, PTES and OSSTMM.
- Is the scope written down? The NCSC recommends a scoping document that defines the technical boundaries of the test.5
- Who reads the report? You need findings in both technical and business terms.7
- How does retesting work? Check whether fixes are retested and whether findings reach developers’ tools.
- What happens between tests? A year between tests is common, so ask how new issues are found in the meantime.5
Penetration testing questions, answered
What is penetration testing as a service (PTaaS)?
PTaaS delivers penetration testing through a platform rather than as a one-off project. Blacklock combines continuous automated scanning, manual testing by certified testers and one dashboard where findings are prioritised, sent to developers, fixed and retested.
What does CREST accreditation mean for a penetration testing provider?
CREST is an international not-for-profit body. To be accredited, a member company has its policies and procedures reviewed before approval and renews each year. CREST also certifies individual testers through professional examinations.6 CREST’s guide says the combination of accredited companies and qualified individuals gives the greatest assurance.7
Is Blacklock CREST accredited?
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and checks many systems for known weaknesses. A penetration test is led by a skilled tester who tries to exploit and chain weaknesses the way an attacker would, to show what could actually be reached. Blacklock uses both: continuous scanning between manual tests.
How often should we run a penetration test?
Test at least once a year and after any significant change, such as a major release or infrastructure migration. PCI DSS v4.0.1 requirements 11.4.2 and 11.4.3 set this expectation for internal and external testing,13 and Hong Kong’s Cap. 653 Code of Practice includes a penetration test in the annual security risk assessment for designated operators.89
Does New Zealand law require penetration testing?
The Privacy Act 2020 does not name penetration testing, but Information Privacy Principle 5 requires security safeguards that are reasonable in the circumstances.10 Regular testing is practical evidence that you are finding and fixing weaknesses.
Does Hong Kong require penetration testing?
For designated operators under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), Code of Practice section 6.3.4 says the security risk assessment should include a vulnerability assessment and a penetration test, by testers with appropriate professional qualifications. CREST certifications are among those listed.8 For other organisations, Data Protection Principle 4 of the PDPO requires all practicable steps to protect personal data.11
What reports will we receive?
Automated findings appear in the Blacklock dashboard. For manual tests you receive Executive, Developer and Full Penetration Test reports, plus a penetration test certificate.16
How do we get started?
Contact OptimaTech in Auckland or Hong Kong. We agree scope and testing frequency with you and set up the Blacklock platform. Blacklock also offers a 14-day free trial of the platform.14
Know your weaknesses before an attacker does
Tell us what you need to test. We will recommend the right mix of continuous scanning and CREST-accredited manual testing, and send a quote in NZ or HK dollars.
Book a scoping callTalk to OptimaTech
OptimaTech Limited is a Blacklock partner, led by an experienced team whose senior members bring more than 20 years of industry experience.
NZ New Zealand
H/43 Apollo Drive, Rosedale, Auckland 0632
Phone: +64 9 889 8890
Email: [email protected]
Web: optimatech.co.nz
HK Hong Kong
17/F, 80 Gloucester Road, Wan Chai, Hong Kong
Phone: +852 3560 4860
Email: [email protected]
Web: optimatech.com.hk
Sources
Statistics are quoted as published by the named organisation. Links checked 20 October 2026.
- National Cyber Security Centre (NZ), Cyber Threat Report 2025: incident reporting analysis (1 July 2024 – 30 June 2025).
- Hong Kong Productivity Council / HKCERT, Hong Kong Cybersecurity Outlook 2026, press release, 28 January 2026.
- Verizon, 2026 Data Breach Investigations Report news release, 19 May 2026; full report.
- IBM, Cost of a Data Breach Report 2026 news release, 29 July 2026; report page.
- National Cyber Security Centre (UK), Penetration testing guidance.
- CREST, What we do.
- CREST, A Guide to Penetration Testing (2022).
- Office of the Commissioner of Critical Infrastructure (Computer-system Security), Hong Kong, Code of Practice v1.0, sections 6.3.4, 6.3.6 and 6.3.7.
- OCCICS, Three categories of obligations for CI operators.
- Office of the Privacy Commissioner (NZ), Information Privacy Principle 5.
- Office of the Privacy Commissioner for Personal Data, Hong Kong, The Ordinance at a glance (DPP 4).
- GCSB, NZ Information Security Manual v3.9, section 6.2 Vulnerability analysis.
- PCI Security Standards Council, PCI DSS v4.0.1 document library; requirement text summarised by Microsoft Learn.
- Blacklock, About us.
- Blacklock, Blacklock Security achieves CREST accreditation, 9 May 2025.
- Blacklock, On-demand manual penetration testing and services and plans; OptimaTech, Blacklock product page.
- New Zealand Government Procurement, Marketplace approved suppliers.
- ISO, ISO/IEC 27001:2022 Information security management systems.