Security testing · BugXHunter with SCX.ai
Find the way in. Keep it onshore.
BugXHunter's certified testers find the weaknesses in your applications, networks and AI systems before someone else does. The AI that works alongside them runs on open-weight models hosted in Australia by SCX.ai, so the map of how to break into your business stays in the country.
Engagement stackOnshore
People lead every engagement. The model assists.
The gap
A penetration test produces the most sensitive file you own.
The working notes of a test are your source code, the credentials that turned up, and the exact steps that got in. Testers now use AI to work through that material faster. Where that AI runs has become part of the test.
Where
Offshore AI, offshore data
Most AI-assisted testing sends its prompts to a model hosted overseas. Your weaknesses then sit on infrastructure governed by another country's laws.
What
A model you cannot inspect
A closed model is a service you rent. You cannot see it, pin it to a version, or choose where it runs. Open weights are published, so all three are possible.
Who
Scanners are not testers
A tool reports what it was built to look for. The flaws that end up in breach notices are found by a person who thinks about how your business actually works.
How it works
Four steps, one fixed price.
People lead every engagement. The model does the reading, cross-referencing and drafting that used to take up a tester's day, and it does it on Australian infrastructure.
Step 01
Scope
We agree what is in, what is out, and when testing can run. You get a scope, a timeline and a fixed price.
No surprises on the invoice
Step 02
Test
Certified testers attack the target by hand, the way a real intruder would, with a sovereign model working through the volume beside them.
People lead, AI assists
Step 03
Report
Every finding is triaged, rated, and written up with the evidence and the fix, in the format your own standards ask for.
Findings you can act on
Step 04
Retest
Once you have fixed what we found, we test it again. A finding is closed when we can no longer get in, not when a ticket says so.
Fixes confirmed closed
Services
What we test.
Six kinds of engagement, each scoped to your environment.
Web
Web applications
Authentication, access control, injection and business logic, tested against the OWASP standards.
Network
Network and infrastructure
What an intruder can reach from outside, and how far they can travel once they are inside.
API
APIs
REST, GraphQL and gRPC interfaces, including the ones your mobile apps and partners depend on.
Cloud
Cloud environments
Configuration, identity and exposure across AWS, Azure and Google Cloud.
Red team
Red team operations
A realistic attack on a goal you choose, to measure how well your people and tools detect and respond.
AI
AI and LLM systems
Prompt injection, data leakage and agent misuse in the AI you have built, aligned to the OWASP LLM Top 10.
Sovereign AI
Built elsewhere. Run here. Working for Australia.
BugXHunter partners with SCX.ai, an Australian provider of sovereign AI inference, for the models behind its security research. SCX.ai runs open-weight models such as GLM-5.3 on infrastructure hosted in Australia.
Open weights mean the model itself is published. Nobody has to take a vendor's word for what it is, and it can be run wherever its operator chooses. For this work, that place is onshore.
If you answer to the Privacy Act, APRA CPS 234 or the SOCI Act, where your testing data goes is a question you will be asked. This gives you a short answer.
GLM-5.3 is an open-weight model published by Z AI. SCX.ai states that it does not train on customer data and that its controls are IRAP-aligned. Details are at scx.ai.
Know how you would be breached, before you are.
Tell us what you need tested. We will come back with a scope, a timeline and a fixed price.
Get in touch
Request a scope.
Tell us what needs testing and any date you are working to. We will reply within one business day.
- Email[email protected]
- Phone1300 786 040
- Testingbugxhunter.com
- Breach now?Incident response