NZBIO.ORG.NZ //
Division Zero tests corporate systems by hand from Wellington and sells the results through its own platform, so findings keep arriving between annual audits.
One credit is NZ$1,500 and covers one day of testing. That is the unit Division Zero uses for its PTaaS+ (penetration testing as a service) platform, where customers buy testing in advance and apply it to web applications, APIs, external and internal networks, or Active Directory. Customers enter scope into the platform, see a price before placing the order, and can start testing the next business day.
Division Zero is a Wellington-based cybersecurity consultancy. It runs four core services: penetration testing, vulnerability assessments, configuration reviews, and a Virtual CISO service that gives an organisation access to a senior security consultant for a flat monthly fee, cancellable at any time.
The testing work is manual. Consultants attempt to exploit weaknesses in web applications, Android and iOS mobile apps, external perimeters, and internal networks, and document what they find with risk ratings and remediation advice. Methodologies include OWASP’s web and mobile testing guides, the Penetration Testing Execution Standard (PTES), and the Open Source Security Testing Methodology Manual (OSSTMM). Configuration reviews compare settings against CIS, NZISM and SANS benchmarks, and map the results to NIST, NZISM, CIS and PCI for auditors.
Vulnerability assessments are the faster, cheaper end of the range. An external network assessment takes a few hours and produces a software-generated report that a consultant reviews. Division Zero makes it clear this is not a substitute for a penetration test, which adds manual exploitation and consultant judgement.
PTaaS+ is the newer half of the business and what distinguishes it from a conventional testing shop. It pairs manual testing with a platform that continuously monitors the attack surface between engagements, publishes each validated finding to a live dashboard with a severity rating and remediation steps, and lets the customer request a retest once a fix is deployed.
The practical difference is timing. A traditional test delivers a report after the engagement ends; on the platform, findings appear as they are confirmed, and retesting is built into the same workflow. Credentials sit in an encrypted vault with an audit trail of consultant access. Results push to Jira, Slack or Teams, and the platform supports SAML and OIDC single sign-on, SCIM provisioning and a read-only API. Partners and managed security service providers can run it under their own brand with their own customers.
Compliance is a large part of why customers buy testing at all, and the platform is built around that: engagements are positioned to support NZISM, ISO 27001, SOC 2, PCI DSS and the NIST Cybersecurity Framework, with the report and attestation feeding an assessor’s programme.
Chris Berry founded the company in 2018 and is its director, leading engagement delivery. He has worked in security consulting since 2004, with clients in New Zealand, Australia, Canada, the United States, Southern Africa and the United Kingdom. The consulting team holds CISSP, CISA, CISM and CEH certifications, and its testers hold CREST, OSCP and OSWE credentials.
Division Zero is independent and New Zealand-owned, and sells no vendor products. That independence is the pitch: the advice is not tied to a licence the company earns from. In its own words, its rates are among the most competitive in the industry, a position it attributes to a small-business cost base rather than junior staff.
The customer list runs across healthcare and insurance, financial services, software and SaaS, startups, retail, transport, construction, debt collection, and health and safety. These are organisations with systems exposed to the internet and an auditor or board asking for evidence that an independent party has tried to break in.
The Virtual CISO service targets a narrower group: organisations that need senior security leadership and an extra pair of hands but aren’t large enough to employ a full-time chief information security officer. It covers policy and standards development, system security audits, firewall rule reviews, risk assessments and compliance work against PCI, NZISM, CIS and OWASP.
Most security testing in New Zealand is bought as a project: scope, quote, wait for a slot, receive a PDF weeks later, fix what you can before the next budget cycle. The gap between tests is where the risk accumulates, because applications and infrastructure change continuously and new vulnerabilities are disclosed continuously.
Division Zero’s answer is to keep testing running and findings visible. Automated scanning covers the ground between manual engagements and picks up new assets as they appear; the consultants find the business logic flaws, chained exploits and access control failures that scanners miss. The consultants validate every finding by hand before it reaches the dashboard, keeping false positives out of the queue the customer’s engineers have to work through.
The platform has its own site and product identity, and the direction of travel is clear: more engagement moving out of email and documents and into software the customer logs into. Ordering, scoping, credential handling, findings, remediation, and retesting now sit in one place, with consultants reachable directly through it.
For a small Wellington business, that is an unusual position. The testing market rewards reputation and individual expertise, which are hard to scale. A platform turns some of that expertise into a product that can be sold repeatedly to partners and directly, without adding consultants at the same rate as revenue.
NZBIO Website: Empowering New Zealand Businesses
The NZBIO website is a valuable platform that showcases success stories from New Zealand businesses across diverse industries, offering inspiration and promoting entrepreneurship. The website provides essential resources and information to help aspiring entrepreneurs navigate the intricacies of establishing and growing a business. It also helps you connect with potential partners, investors, and collaborators, supporting the growth and success of New Zealand’s business landscape.
To promote your business with NZBio.org.nz contact us now.