Phew

What Phew does

Phew is a privately held, New Zealand–headquartered cybersecurity consultancy founded in 2017 by Paul Bryant and Jason Nguyen, operating from Auckland with a regional office in Sydney. The firm is a CREST ANZ accredited specialist practice targeting organisations running high-consequence applications, navigating compliance requirements, and seeking audit-grade security assurance. The core proposition is standards-based, source-code-supported penetration testing that produces auditor- and board-defensible reports rather than checkbox compliance, addressing web applications, APIs, mobile apps, networks (including Active Directory, Wi-Fi, and hybrid cloud estates), e-commerce platforms, IoT, and OT systems.

The technical methodology is anchored to globally recognised standards — OWASP ASVS, OWASP MASVS, OSSTMM, NIST 800-115, and PTES — with a differentiating white-box/grey-box testing approach that uses source code access to identify entire vulnerability classes. Beyond traditional engagements (Standards-based and Essentials testing tiers), Phew has extended its surface in 2025 with three additional offerings: an AI Testing service (covering prompt injection, agent architecture, RAG pipelines, and AI-generated code), a subscription-based Cyber Health Reports SaaS platform for continuous posture and framework compliance tracking (ASD Essential Eight, SOC 2, ISO 27001, NIST CSF), and Secure Architecture Consulting for SSDLC and cloud security across AWS, Azure, and GCP. Recurring service models include Pen Testing as a Service (PTaaS) and managed Bug Bounty programs.

Commercially, Phew operates a sales-led B2B professional services model: pricing is quote-based (valid 14 days, excluding GST, 14-day payment terms), with subscription tiers for PTaaS and Cyber Health Reports billed annually. Go-to-market is primarily direct via the company website, phone, and Calendly-scheduled discovery calls, augmented by SEO and content marketing (thought-leadership articles on security topics). Customers span SaaS, fintech, healthcare, e-commerce, insurance, real estate, media tech, and government — with 50+ logos on display and more than 50% of pen testing conducted for organisations outside New Zealand. The firm has no disclosed external funding, no parent company, and remains founder-/majority-operator-owned.

Name

Phew

Legal name

phew Limited

Website

https://phew.co.nz

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

11–50 employees

Short description

Phew is a CREST ANZ accredited, Auckland-based cybersecurity consultancy delivering standards-based penetration testing, AI security testing, red team engagements, secure architecture consulting, and a Cyber Health Reports SaaS platform to organisations across New Zealand, Australia, and internationally.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting & Penetration Testing Services

NAICS

Computer Systems Design and Related Services (5415)

SIC

Services-Testing Laboratories (8734)

akta.pro primary industry

Penetration Testing, Red Team & Ethical Hacking (EDAOAIAH)

akta.pro secondary industry

Breach & Attack Simulation (BAS) (HDADAHAD)

Keywords

• Penetration testing services
• Cybersecurity consulting
• Application security testing
• Red team assessments
• Security posture reporting

Headquarters

HQ city

Auckland

HQ country

New Zealand

HQ region

Oceania

Offices2 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. Penetration Testing Services: Traditional penetration testing engagements for web applications, APIs, mobile apps, networks, and infrastructure. Delivered as standards-based testing or budget-friendly essentials testing.
2. Pen Testing as a Service (PTaaS): Subscription-style continuous testing service allowing organizations to spread pen testing over time with access to vetted testers at nominated budget and frequency.
3. Bug Bounty Services: Managed bug bounty programs where phew triages reports and intermediates with participants, providing structure around crowd-sourced vulnerability discovery.
4. Cyber Health Reports: SaaS subscription platform for ongoing security posture assessment and reporting against security frameworks.
5. Secure Architecture Consulting: Consulting engagements for secure architecture design, SSDLC implementation, and cloud security (AWS, Azure, GCP) advisory services.
6. Red Team Engagements: Advanced adversarial simulation engagements targeting networks, endpoints, web applications, and APIs with full-spectrum adversary emulation.

Pricing tiers

Go-to-market motion1 record

Distribution channels3 records

Marketing channels4 records

Core offering

Phew is a CREST ANZ accredited cybersecurity consultancy providing standards-based penetration testing and security assurance services for web applications, APIs, mobile apps, networks, and infrastructure. Its offerings include specialized AI security testing, red team adversarial simulations, Pen Testing as a Service (PTaaS), managed bug bounty programs, secure architecture consulting, and the Cyber Health Reports SaaS platform for ongoing security posture analysis and compliance tracking.

Product overview

Phew is a cybersecurity consultancy offering penetration testing and security assurance services. The core offerings include penetration testing of web applications, APIs, mobile apps, and networks (web app & API specialists, network pen testing), supplemented by specialized services such as AI security testing, red team engagements, and secure architecture consulting. Phew also offers the Cyber Health Report as a SaaS platform for continuous security posture monitoring and compliance tracking. Service delivery models include traditional structured engagements, PTaaS (Pen Testing as a Service) subscription-style testing, and bug bounty program management. All testing adheres to globally recognized standards including OWASP ASVS, MASVS, OSSTMM, and NIST 800-115.

Differentiator

Problem solved

Functional benefit

Brands

• Cyber Health Reports: A platform-enabled, multi-user, multi-organisation solution for holistic analysis and reporting across an organisation's total security posture using globally recognised cyber security frameworks and assessments.

Quantifiable outcome

• Source code supported testing produces more findings within the same budget through pattern identification across entire codebase rather than individual instance discovery
• +1 more outcomes

Named customers12 records

Segments6 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

One partnership is on record.

• New Zealand Government MarketplacecoreGTM or Marketing Partner · 6 September 2022Phew was recognised as an approved supplier of security services on the New Zealand Government's Marketplace through a Collaborative Marketplace Agreement. Joined the Information Security Professional Services Panel under the 'Source Code, Application Review and Technical Testing' category. As an approved supplier, phew has completed the open primary procurement process, enabling direct engagement with government agencies without negotiating contract terms or pricing.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Cobalt: Cobalt is a leading Pen Testing as a Service (PTaaS) platform offering on-demand access to vetted testers via a subscription model. Direct overlap with Phew's PTaaS offering and target SaaS / tech customer base.
• Bishop Fox: Bishop Fox is a US-based offensive security firm specializing in penetration testing, red teaming, and security assessments with COSO-style methodologies. Highly comparable in service mix and standards-based delivery to enterprise clients.
• NetSPI: NetSPI delivers penetration testing as a service alongside vulnerability management and attack surface management. Strong methodological and customer-segment overlap with Phew's enterprise SaaS and regulated-industry clients.
• HackerOne: HackerOne operates a leading bug bounty and vulnerability disclosure platform, directly competing with Phew's Bug Bounty Services offering and targeting similar SaaS and enterprise customers.
• Bugcrowd: Bugcrowd runs a crowdsourced cybersecurity platform combining bug bounty, pen testing as a service, and attack surface management. Direct overlap with Phew's bug bounty and PTaaS revenue streams.

Broad incumbents

• NCC Group: Global cybersecurity consultancy with a major penetration testing and assurance practice serving enterprise and government clients. Competitor in the ANZ and global markets with much broader portfolio.
• Trustwave: Global cybersecurity firm offering penetration testing, managed security services, and consulting to enterprise and government clients. Overlaps with Phew on standards-based testing and CREST-style assurance positioning.
• CyberCX: Australia and New Zealand's largest cybersecurity services firm, offering penetration testing, red teaming, and managed security. Competes with Phew across the trans-Tasman enterprise and government market with much greater scale.

Regional players

• Pentest Limited: New Zealand-based penetration testing specialist serving the same domestic market as Phew, with comparable focus on NZ/AU enterprise and government clients.
• Insomnia Security: New Zealand-originated cybersecurity consultancy offering penetration testing, red teaming, and security advisory to enterprise and government clients. Most directly comparable regional competitor.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

Compliance10 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles7 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Phew