New Zealand Privacy Act 2020

Proof-of-exploit evidence of whether safeguards against unauthorised access, use, modification, or disclosure actually hold under real attack — the "reasonable in the circumstances" test.

IPP 5(a) is agnostic to where the exposure sits, and internet-facing assets are a primary attacker path to personal information — External pentesting maps the perimeter and chains paths to impact, with timestamped proof an attacker reached the asset.

Tests the agency's own web applications and portals for the exploitable access-control and authentication weaknesses that let one person reach another's information — evidence of the safeguard failing, distinct from the perimeter mapping External pentesting provides.

Most agencies hold personal information in AWS, Azure or M365 -- credentialed cloud pentesting proves IAM misconfiguration, privilege-escalation and lateral-movement paths to that data, including full Entra ID tenant compromise with no CVE. AWS, Azure/Entra ID and Kubernetes only -- no standalone GCP coverage.

Weak and reused credentials are the dominant path to unauthorised access — finds them before attackers do.

Phished credentials are a dominant route to unauthorised access — Phishing Impact consumes credentials captured by your own phishing tool and proves what each one can reach: admin, cloud pivot, domain compromise, or data.

Shows which categories of personal information an attacker could reach inside your own environment, so you can see the exposure before handing data to a service provider — processing happens locally on your Docker host, no data leaves your network. Note: NodeZero does not test the service provider's own controls.

Validates whether the boundaries around PII-storing systems actually contain an attacker's lateral movement.

Validates whether your detection stack would notice an attacker reaching PII-adjacent assets — Tripwires plant decoys during the test and any interaction with them is malicious by definition, so a missed alert exposes a monitoring gap.

One-click evidence-pack exports map findings from the tests below directly to the Privacy Act — evidence you can put in front of the OPC before an inquiry, or your board when reviewing IPP 5 safeguards. It packages the underlying Tier A/B evidence; it is not itself proof a safeguard works.

Every finding comes with proof of exploitation, giving you concrete evidence of what a weakness could actually reach — a firmer basis for the serious-harm assessment under s 112 and 113.

Shows the actual PII an attacker could reach on each path — concrete input to the s 113(b) sensitivity limb and the s 113(c) potential-harm limb of the serious-harm test.

Rapid Response tests your exposure to newly-disclosed CVEs — often within hours of disclosure — so you can remediate an exploitable path before it becomes a notifiable breach; preventive evidence if the OPC asks how a breach could have been prevented.

Audit-ready evidence that remedial action closed the path that caused the breach — concrete input to the s 113(a) "action taken to reduce risk of harm" factor.