ST4S Penetration Testing

Penva Security tests digital products used by Australian and New Zealand schools, focusing on student data, teacher and administrator access, tenant separation, registration flows, APIs and cloud services.

The engagement produces practical security evidence for your ST4S preparation, with tester credentials, clear remediation guidance and an updated report after fixes are verified.

Certified Testers
Security Compliance
Manual Pentesting

Secured 100+ organisations

4.9

Clutch

● PENTEST REPORT● COMPLETE

ST4S Security Evidence

scope: school digital product · CVSS 3.1

Critical3

High6

Medium9

✓ ST4S security evidence generated

Test the product before schools depend on it.

Get Instant Quote

Instant estimate in about 30 seconds

Definition

What Is ST4S Penetration Testing?

See how the testing scope and reporting support your organisation's security and assurance requirements.

ST4S penetration testing is an authorised security assessment of a digital product intended for use in schools. It checks whether students, teachers, school administrators or external attackers can access information or functions beyond what the product intends.The Safer Technologies 4 Schools initiative evaluates digital products against a nationally consistent security and privacy framework for Australian and New Zealand K-12 education. The current framework is version 2026.1 and includes updated cybersecurity, privacy and, where relevant, AI-related criteria.

Penetration testing supports the technical evidence behind an ST4S submission, but it does not replace the full ST4S assessment. The most useful test follows real school workflows, role boundaries, tenant design, integrations and the types of information the service handles.

Requirements

Security Areas ST4S Suppliers Need to Address

The framework considers the product as schools actually use it, including authentication, student privacy, administrative access, third parties and any AI-enabled functionality.

Access

Authentication and Account Security

Login, passwordless methods, one-time codes, recovery functions and multifactor options should protect student, staff and administrator accounts.

Roles

Authorisation and Tenant Isolation

Students and teachers should only access permitted information, classes and schools, with strong separation between users, roles and customer tenants.

Data

Privacy and Information Protection

The service should limit exposure of student and school information across APIs, exports, logs, storage, support tools and administrative interfaces.

Application

Secure Product Functionality

Web, mobile and API features should resist common vulnerabilities as well as workflow abuse specific to invitations, classroom codes and approvals.

Suppliers

Cloud and Third-Party Services

Hosting, subprocessors and integrations should not create unmanaged access paths or weaken the security commitments made to schools.

Safety, Privacy and Security Testing

Where AI features are in scope, testing should consider data leakage, prompt abuse, unsafe outputs and controls around interactive student use.

How Penva Delivers

Evidence Built Around Real School Workflows

Penva tests the product from the viewpoints that matter most: external users, students, teachers, school administrators and support or platform administrators.

`Student Access` Cross-User Data Testing

Testing that one student cannot access or alter another student's information, including direct-object references, exports, files and API responses.

`School Tenants` Isolation and Role Boundaries

Validation across schools, classes, teachers and administrator roles to identify privilege escalation and cross-tenant access paths.

`Registration` Invite and Approval Workflows

Testing of school-domain approvals, teacher invitations, classroom codes and account recovery for bypass and impersonation risks.

`Product Scope` Web, Mobile, API and Cloud

A joined-up assessment of the product's real architecture, including exposed APIs, mobile traffic, cloud configuration and third-party integrations.

`Submission Evidence` Report, Credentials and Retest

A professional report, tester credentials, attestation letter and one retest within 60 days to support remediation and ST4S preparation.

Instant Estimate Quote

Get an Instant Penetration Testing Estimate

Answer a few scoping questions to get a practical estimate for web, API, mobile, infrastructure, and cloud penetration testing.

What type of penetration testing do you need?

Choose the main service you want quoted.

FAQ

ST4S Penetration Testing - Common Questions

Questions commonly asked by software suppliers preparing products for school-sector review. Updated July 2026.

Does ST4S require a penetration test?

The evidence required depends on the product, assessment tier and applicable criteria. Security testing is particularly relevant for products that process student information, provide authenticated functions or expose internet-facing applications and APIs. The ST4S team determines final assessment requirements.

Which ST4S framework version is current?

ST4S version 2026.1 was released in July 2026 and is the latest framework version. Suppliers already in an assessment may be working under another active version, so the applicable version should be confirmed before finalising evidence.

What accounts are needed for testing?

A useful grey-box assessment usually needs representative student, teacher and administrator accounts. For multi-tenant services, accounts in at least two school tenants help verify that users cannot cross school boundaries.

Can you test invitation, classroom-code and approval flows?

Yes. These workflows are important because they often determine who can join a school, class or tenant. We test for code guessing, approval bypass, impersonation, privilege escalation and unintended account linking.

Do you test mobile apps, APIs and cloud services?

Yes. The scope can include web applications, iOS and Android apps, APIs, cloud configuration and third-party integrations so the report reflects the complete product rather than one interface.

Can AI features be included?

Yes, where they are eligible and in scope. Testing can cover prompt abuse, disclosure of personal information, unsafe output paths, access-control issues and the way AI sessions interact with student and school data.

Is remediation retesting included?

Yes. One retest within 60 days is included for fixed-price engagements. We repeat the original exploitation method and issue an updated report that can be used as evidence of closure.

Let's talk security

Get In Touch

Book a scoping call or share your systems, testing requirements and preferred timeline with our team.

Book a scoping call

Choose a time that works for you.

30 min

Tell us what you need

Share your scope, priorities and deadline.

A clear next step

We'll review your requirements with you and confirm the scope before testing begins.

Prefer to get in touch directly? [email protected]