Australian Privacy Act 1988 — Australian Privacy Principles

Proof-of-exploit evidence of whether the "reasonable steps" against unauthorised access, modification or disclosure actually hold — the test OAIC applies when investigating a breach.

Where personal information sits behind a customer portal, WebApp Pentesting tests the portal itself — broken access control, IDOR and authentication weaknesses that expose one individual's records to another — and covers the development limb of OAIC's testing recommendation by testing before release as well as after. Whether steps are reasonable in the circumstances remains a risk-assessment judgement.

Credential audit is a technical measure — weak and reused credentials are among the leading entry points in OAIC-notified cyber breaches, and APP 11.3 explicitly includes technical measures within the scope of "reasonable steps".

Auto-classifies the PII an attacker could exfiltrate — surfaces whether APP 11-covered personal information is reachable. Processing happens locally on your Docker host; no data leaves your network.

Proves that boundaries around PII systems actually contain an attacker's lateral movement — the core of "reasonable steps".

Decoys planted on high-risk assets fire a high-fidelity alert the moment an attacker touches them — validating whether your monitoring would notice an intruder near personal information. This tests detection; it is not a substitute for the ongoing access monitoring OAIC recommends.

Starts from an authenticated user's own credentials and proves the reach of over-provisioned or stale access — direct evidence of whether the "need to know" restriction actually holds, distinct from AD Password Audit's credential-strength focus above.

Where personal information sits in AWS or Azure/Entra ID, credentialed cloud pentesting is exactly this independent testing and validation — proving whether IAM misconfiguration, privilege escalation, or on-prem/cloud pivots expose that data. AWS, Azure/Entra ID and Kubernetes only — no standalone GCP coverage.

Every NodeZero finding comes with proof of exploitation — removes ambiguity about whether a weakness could cause unauthorised access that meets the s 26WE(2)(a) threshold.

Emulates stealthy exfiltration — slow transfer, impersonated-user access — to test whether your defences would notice data leaving at all. Speaks directly to whether the "unauthorised access or disclosure" that triggers s 26WE(2)(a) would even be detected — distinct from the data-reach classification ADP provides for the s 26WG limbs below.

Rapid Response validates, often within hours of disclosure, whether a newly disclosed CVE is actually exploitable in your environment — preventive evidence that lowers the chance of a breach in the first place. It does not perform the breach assessment s 26WH(2) requires.

Evidence you can put in front of an assessor that remedial action closed the exploitation path — the factual basis for the s 26WF(1) remediation exception.

Tests whether an attacker can cross the network boundary between your Australian and offshore-connected systems. This is a thin technical slice only — APP 8 is chiefly about accountability for authorised disclosures to overseas recipients, which sits outside autonomous testing.