# phew

> phew is a specialist penetration testing firm based in Auckland, New Zealand, serving SaaS and enterprise organisations across New Zealand and Australia since 2017. We are CREST ANZ accredited and deliver rigorous, standards-based security assurance with testing methodologies grounded in standards like OWASP ASVS and MASVS, producing audit-ready findings suitable for ISO 27001 and SOC 2 compliance programmes.

## Services
- [Penetration Testing](https://phew.co.nz/pen-testing/): Web application, API, mobile app, network, and e-commerce penetration testing grounded in standards like OWASP ASVS and MASVS. Engagements produce audit-ready reporting suitable for ISO 27001, SOC 2, and other enterprise compliance requirements.
- [AI Testing](https://phew.co.nz/ai-testing/): Overview of how phew's testing and consulting services address the security risks introduced by AI across an organisation.
- [Red Team](https://phew.co.nz/red-team/): Realistic adversarial simulations testing whether your defences detect and withstand a targeted attack, mapped to MITRE ATT&CK.
- [Cyber Health Report](https://phew.co.nz/cyber-health-report/): SaaS-based security posture assessment platform supporting ASD Essential Eight, SOC 2, ISO 27001, and other compliance frameworks.
- [Secure Architecture Consulting](https://phew.co.nz/secure-architecture/): Security design and review for AWS, Azure, and application development teams.

## About
- [About phew](https://phew.co.nz/about/): Team bios, company history, and credentials. Founded 2017 by Jason Nguyen and Paul Bryant.
- [phew's Story](https://phew.co.nz/foundations-first-phews-story/): Company philosophy — evidence-backed assurance over box-ticking compliance.

## Research and Insights
- [AI-Assisted Security Testing: What's Real, What's Hype](https://phew.co.nz/ai-assisted-security-testing-whats-real-whats-hype-and-what-it-means-for-your-saas/): Honest assessment of where AI security tooling adds value and where structured, standards-based pen testing remains essential.
- [AI Vulnerability Risks for SaaS Teams](https://phew.co.nz/the-ai-vulnerability-storm-is-coming-heres-what-saas-teams-need-to-know/): Briefing on AI-accelerated vulnerability discovery and recommended SaaS hardening steps.
- [Web App Pen Test Walkthrough](https://phew.co.nz/what-happens-during-a-web-application-penetration-test-a-plain-english-walkthrough/): Plain-English guide to the penetration testing process from scoping to re-testing.
- [Pen Testing Provider Selection](https://phew.co.nz/how-to-choose-a-penetration-testing-provider-in-new-zealand/): A decision-making document to help buyers in their vendor selection process.

## Optional
- [News](https://phew.co.nz/news/): Company announcements and industry commentary.
- [Contact](https://phew.co.nz/contact/): Enquiries for NZ (+64 9 884 0969) and Australia (+61 2 4058 4515).
- [Join Us](https://phew.co.nz/join-us/): Career opportunities for pen testers.