Accreditation Standards

On Tuesday 16th November 2021, at its AGM, CREST ANZ announced the launch of its new Accredited Best of Breed Penetration Tester (ABPT) program — a multi-dimensional approach to accreditation which accredits individual penetration testers against Technical Competency, Professional Competency and Trust Standards.

The program has been developed to align with the 2020 National Cyber Security Strategy's call for a more holistic approach to accreditation; one based on skills, experience, qualifications, professionalism and trust.

The CREST ANZ Board reviewed the spectrum of vendors and qualifications in the sector, and identified significant gaps in the penetration testing industry's approach to certification.

Existing certifications vary significantly between vendors across technology coverage, degree of difficulty, format and delivery mechanisms, and quality of learning and testing. Current processes provide no insights into professionalism, on-the-job performance competency, or trustworthiness.

Historically, there has been no mechanism to assess the competency of penetration testers who have not pursued technical certification, despite having significant experience.

The ABPT program assesses applicants across three key dimensions:

Technical Competency — Evaluation of certifications, commercial experience, and a formal panel examination covering Web and API, Mobile app, Static code review, Infrastructure, Network, Exploitation, Wireless, SCADA and OT, IoT, Cloud, Social engineering, and Red teaming.

Professional Competency — Assessment of years of experience, psychometric evaluation, employer and client reference checks, and professionalism scoring during the examination.

Trust Standards — Valid national police check, internet and social media checks, and a cyber ethics examination. ABPT accreditations are valid for 18 months from time of completion.

Whether you have a question about our services, want to discuss a project, or just need more information we're here to help.