Penetration testing after a breach

When an Australian organisation discovers it has been breached, the immediate question is rarely whether a firewall needed a patch months earlier. It is whether the intruder still has access, what they can reach from there, and whether the response process can stop the next stage of the attack. Penetration testing becomes especially valuable at this point because it turns incident evidence into a controlled examination of the environment that actually exists, rather than a theoretical checklist of known weaknesses.

The role of penetration testing in improving post-breach processes is not to recreate the intrusion for its own sake. It is to test whether the organisation can detect, contain, recover and sustain the improvements made after the incident. For teams in Sydney, Melbourne and Brisbane, that means working with a mixed estate of managed devices, cloud applications and staff-owned phones. It also means accounting for Australian requirements under the Privacy Act 1988 and the notifiable data breaches scheme administered by the Office of the Australian Information Commissioner, alongside significant cyber incident notification duties for entities regulated by the Australian Prudential Regulation Authority.

Redefining the test for a compromised environment

A conventional penetration test often begins with a broad scope and a list of target assets. A post-breach engagement should begin with the incident itself: affected accounts, malicious persistence, unusual protocols and observed access paths. The tester can then ask whether a similar attacker could regain a foothold, move between network segments or use trusted administration paths. That question is more useful than an indiscriminate scan of every internet-facing asset.

Authorisation needs to be equally precise. The agreement should define named systems, testing windows, permitted techniques, emergency contacts and stop conditions. Sensitive production data should not be copied into the test environment; synthetic data can reproduce business logic without exposing customer records. Tests that might disrupt payments, patient systems, customer support or essential services require explicit limits. A breach does not create permission to operate without safeguards.

Penetration testing also has a different purpose from several related activities. Vulnerability scanning identifies potential flaws, while an incident-led penetration test follows attacker behaviour through credentials, applications and infrastructure. A red-team exercise may pursue strategic objectives over an extended period, and a discussion-based simulation tests decisions and communications. These activities can complement one another, but mixing their aims can produce an unsafe or inconclusive engagement.

Strengthening identity and containment

The first post-breach priority is determining whether the attacker still possesses a usable identity. Testers should examine password resets, access tokens, session cookies, recovery accounts, privileged roles and dormant accounts associated with the incident. Conditional access policies should reflect risk rather than device ownership alone. For organisations whose staff check email during a train commute or a café break, phishing-resistant multifactor authentication and rapid session revocation matter as much as network segmentation.

Containment is a control system rather than a single action. Testing should establish whether security groups, identity boundaries and segmentation policies stop east-west movement. Compromised administrator credentials can bypass many defensive layers, so separate administrative journeys and controlled elevation should be assessed. Endpoint detection tools also need practical validation: installation alone does not prove that hostile activity will generate a timely, actionable alert.

The test should cover the routes an attacker commonly uses to bypass direct defences. Cloud administration portals, remote support software, software update mechanisms and supplier connections can all provide a path back into the environment. Third-party access should be included where the incident suggests supplier involvement. Testing only the internal perimeter risks overlooking the trusted relationships through which a breach can continue.

Validating detection and coordinated response

Detection is often where incident response reveals the largest gap. The evidence collected during the breach can support a purple-team exercise in which defenders and testers work through the attacker's observed techniques. This helps security teams determine whether identity, endpoint and network telemetry would expose the same activity, and whether existing alerts contain enough context for a responder to act. A quiet test may expose missing telemetry; a noisy test may expose an unwieldy triage process.

Coordinated response must be exercised alongside the technical controls. Playbooks should assign clear ownership for containment, forensic preservation, legal advice, executive communication and customer notification. Notification decisions deserve particular attention in Australia. The OAIC's notifiable data breaches guidance and APRA's incident notification requirements, where applicable, may require different evidence, decisions and timeframes. Technical containment and regulatory assessment should proceed in parallel rather than wait for a complete forensic picture.

Attackers frequently extend an intrusion into communication channels, impersonating executives, suppliers or service providers to amplify the damage. Teams can consult guidance on email sender trust to understand how BIMI fits with SPF and DMARC when preparing authentic notices. These controls reduce spoofing risk but do not replace a separate notification route. A secure portal, verified phone number and known domain give customers a reliable way to verify urgent messages when the mailbox itself may be suspect.

Rebuilding recovery around operational reality

Recovery is not complete when systems are visible again. Restored services must have trustworthy data, secure configurations and an identity environment disconnected from the attacker's access. Backups should be isolated from the compromised estate and tested under realistic conditions, while recovery objectives should reflect the time each business function can safely remain unavailable. For healthcare, financial and customer-service operations, a technically restored service may still be unusable if records are incomplete or access controls remain broken.

Penetration testing can validate the environment after restoration. Retesting should confirm that remediation has removed the original access paths and has not introduced weaker credentials, exposed administration tools, missing logging or unpatched services. Findings should also be checked against the original incident evidence, ensuring that restoration addresses the cause rather than merely the visible symptoms. This is where a coordinated technology ecosystem such as CARM Security, developed by Exclusive Networks, can help connect attack findings with response and remediation activity across multiple security capabilities.

The Australian market makes this particularly important for organisations with limited internal security capacity. Small and medium-sized businesses may depend heavily on managed service providers, while banks, health providers, government agencies and critical infrastructure operators face larger operational and compliance burdens. A shared service model can work when internal teams retain clear runbooks, escalation rights and visibility into testing results. Regional branches and remote teams also introduce dependencies that a central security office can overlook.

Turning lessons into repeatable assurance

Remediation is complete only when changes have owners, monitoring and verification. Every significant finding should produce an action, a deadline, a named owner and evidence that the action has worked. Priorities should reflect exploitability, business impact and the attacker's demonstrated behaviour rather than the raw number of findings. For Australian government entities, the Australian Signals Directorate's Scoped Cyber Security Assessments and Essential Eight framework provide useful baselines; regulated and critical-infrastructure organisations can apply similar discipline to their own obligations.

Assurance activity	Primary question	Evidence retained	Post-breach value
Vulnerability scan	Which known weaknesses are exposed on this system?	Scan results and remediation status	Prioritises patching without modelling attacker movement
Incident-led penetration test	Can an attacker reuse the compromised identity and move laterally?	Authorised attack paths and access evidence	Tests containment, privilege boundaries and recovery access
Purple-team exercise	Can defenders detect and disrupt the technique observed during the incident?	Alert timelines, tuned rules and unresolved gaps	Converts incident lessons into usable telemetry
Recovery simulation	Can essential services be restored within agreed tolerances?	Recovery timings, integrity checks and dependency failures	Reveals whether restoration introduces fresh exposure

Repeat testing should be proportionate and tied to meaningful triggers. Material architecture changes, new privileged accounts, significant supplier changes and recurring detection failures can justify a focused retest, while routine reviews can confirm that established controls remain effective. Service providers can coordinate testing across identity, endpoint, network and recovery technologies, reducing duplicated activity and conflicting findings. Each exercise should also measure how quickly the organisation can make decisions, revoke access and communicate under pressure.

The practical takeaway is straightforward: the most valuable post-breach penetration test is tied to known attacker behaviour, real operating constraints and evidence that controls still work after remediation. Its value is measured in verified reductions in attacker access and faster, safer recovery, not in the number of findings reported. Every result should leave behind a stronger detection rule, a tested response path or a confirmed recovery procedure that can be checked again.