Aurian is an Australian penetration testing and security assurance firm, founded in 2020, working with organisations across the country. Senior consultants perform every test, all of it onshore, and every report is written so your own engineers can close the findings.
Illustration: a map of a typical organisation's systems, on which attack paths are traced from the internet to customer data.
Services, three groups
Every engagement follows the Aurian engagement lifecycle: scope, test, report, retest. Choose the group that matches what you need to know.
Offensive, 8 services
Manual testing of your perimeter, applications, cloud and people by senior consultants, reported so your own team can close every path.
Assurance, 3 services
Independent assessment against the Essential Eight, CIS Benchmarks and vendor guidance, with evidence gathered by testing rather than questionnaires.
Managed, 4 services
Ongoing scanning and monitoring run by the same consultants who test, for organisations that need more than an annual engagement.
The Aurian engagement lifecycle
Four phases, whatever we are testing. You know what happens next before we start, and you know what you will hold at the end.
We agree what is in and out, the test windows, the credentials and contacts, and the rules of engagement, in writing.
A senior consultant tests by hand, using automated tooling for coverage. You hear about serious findings the day we confirm them.
An executive summary for the board and the insurer, and technical findings with evidence and a fix your engineers can apply.
Once you have remediated, we retest and update the report so the record shows what was found and what was closed.
The report
Every finding in an Aurian report looks like this: what we found, the evidence, what it means for your organisation, and what to change.
A published certificate template allows a standard domain user to request a certificate that authenticates as any account, including a domain administrator. This is the ESC1 misconfiguration: the template permits requesters to supply the subject name and enables client authentication.
PS> Certify.exe find /vulnerable
[!] Vulnerable Certificate Template : CorpComputer
Enrollment Rights : CORP\Domain Users
msPKI-Certificate-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT
pkiExtendedKeyUsage : Client Authentication
PS> Certify.exe request /template:CorpComputer /altname:CORP\Administrator
[*] Certificate issued for CORP\Administrator
A standard user account was able to request a certificate that authenticates as the domain Administrator.
Any user who can log in, including one an attacker has just phished, can become a domain administrator in minutes. From there the attacker controls every account, server and file share in the domain. There is no exploit code or missing patch here, only a misconfigured template, which is why it is so often missed.
Remove the ENROLLEE_SUPPLIES_SUBJECT flag from the template, or restrict enrolment to a small, trusted group and require manager approval. Audit every template for the same pattern, and enable the certificate authority logging that records these requests so future abuse is visible.
Sectors
Aurian works across every sector. These are the ones we work in most, with the audit and insurance drivers that shape each.
Why Aurian
Every engagement is performed by a senior Aurian consultant, onshore in Australia. Nothing is outsourced, offshored or crowdsourced.
Australian-owned, with consultants across the country. No vendor partnerships that shape what we recommend.
OWASP, PTES, NIST SP 800-115, CIS Benchmarks and the ASD Essential Eight, written up so your own engineers can act without calling us.
A fixed price agreed after scoping, so the cost is known before any testing starts.
Certifications
Aurian's consultants hold offensive-security certifications that are examined by compromising live systems under time pressure.
OSCE
OffSec Certified Expert
OSCP
OffSec Certified Professional
OSWP
OffSec Wireless Professional
Blog
Cybersecurity news and insights for Australian organisations, written by the people who do the testing.
What each section of a penetration test report is for, how severity ratings work, and how to turn the findings into a plan your team can actually run.
6 September 2026
Tell us what you need to know about your environment. We reply within one business day.
