> ## Content Index > Fetch the complete content index at: https://plaintext.block8.ai/llms.txt > Use this file to discover other available public pages before exploring further. # Who builds your penetration testing platform matters more than you think - URL: https://plaintext.block8.ai/blog/who-builds-your-penetration-testing-platform-matters-more-than-you-think/ - Published: 2026-10-14T07:00:53.000Z - Updated: 2026-10-14T07:00:58.000Z - Author: Aiselade Dionisio - Tags: AI-Powered Penetration Testing, Platform and Techniques, Remediation and Business Risk When you engage a penetration testing provider, you’re not just buying a report. You’re authorising someone to probe the systems that pay your staff, serve your customers and hold your most sensitive records. So it makes sense that the questions from security and procurement teams are getting sharper. Who owns this company? Where does our data go? Whose law applies? And when something needs explaining, can anyone actually explain how the platform works? For Block8.ai, those answers start at home. ### An Australian company, with Australian defaults Block8.ai Pty Ltd is an Australian company headquartered in Western Australia. Our standard terms are governed by Western Australian law. By default, engagement data on our Australian platform is stored in Australia (Sydney), and AI inference runs through Amazon Bedrock in Australia. Just as importantly, the Block8.ai platform was designed and built by the Block8.ai team. It’s our own product, not a third-party platform resold under our name. In practice, that means: • **Clear accountability.** Under our standard Australian terms, your contract is with Block8.ai Pty Ltd, under Western Australian law. • **Direct answers.** You deal with the people who built the platform, not a reseller passing questions to a head office in another time zone. • **Local by default.** Australian hosting is the starting point, not a special arrangement you have to negotiate. ### Building it ourselves means we can answer the hard questions Plenty of security products are assembled from components the vendor doesn’t fully control. That isn’t automatically a problem, but it makes some questions hard to answer. What leaves your environment? Which services process it? What happens if you need it to run somewhere else? Because we built Block8.ai ourselves, we can answer those questions from the design itself, not from a marketing sheet: • Every engagement starts with the AI testing engine loading the scope you authorised. • Every command the engine runs is logged, and every finding records how it was produced. • Every finding is reviewed by a council of AI agents, and anything marked as a false positive stays on the record, with the reasons. • The platform isn’t locked to one cloud provider or one AI model, so it can be deployed where your requirements are. When we change something, we know exactly what changed, and we can tell you. ### Being honest about dependencies Sovereignty claims get stretched in our industry, so here’s the plain version. Our Australian SaaS platform runs in the Sydney region of a global cloud provider (AWS), and our AI testing engine uses Anthropic’s Claude models by default, accessed through Amazon Bedrock. We don’t pretend those dependencies aren’t there. What we control is the platform: how it’s designed, where it’s deployed, what data moves where and which model it uses. If your policy calls for a different region, a different provider, a specific model family, or testing that runs on your own infrastructure, Block8.ai can be configured and deployed to fit. That’s the difference between depending on a supplier and being locked into one. ### Why this matters for Australian organisations Boards want to know who can see their systems. Government and regulated buyers increasingly treat ownership, jurisdiction and supply chain as procurement criteria, not afterthoughts. An Australian company, with Australian hosting by default and flexible deployment, gives your security and procurement teams clear answers, backed by our contract terms and ISO 27001 certification. It won’t make compliance automatic. No platform can. But it means the questions have straightforward answers. ### Independent assurance, from the same team Block8.ai is a CREST ANZ approved member company and is ISO 27001:2022 certified. Choose AI-only testing for evidence-backed results fast, or Human in the Loop for added review by CREST-aligned testers. Both run on the same platform, built and operated by the same team. ## What to do next Want to see what that looks like in practice? See How It Works. [Watch the demo videos](https://www.block8.ai/demo-videos-request?ref=plaintext.block8.ai) ![Bob Ledger](https://plaintext.block8.ai/assets/images/authors/bob-ledger.jpg) CEO & Co-founder ### Bob Ledger [Read Bob's bio →](https://plaintext.block8.ai/team/#bob-ledger)