Key takeaways
- Customer portals, apps, chat and contact centres hold the data attackers want most.
- The OAIC received 667 data breach notifications in the six months to June, and most Australians now rank breaches as their top privacy concern.
- Penetration testing services should be scheduled around CX changes, not only on a yearly calendar.
- Security belongs inside the customer journey map, not beside it.
Customer trust is hard to win and easy to lose. The Office of the Australian Information Commissioner received 667 notifiable data breach notifications in the six months to 30 June, and its latest community attitudes survey found 82% of Australians are concerned about data breaches. For organisations investing in digital service channels, that makes penetration testing services part of protecting the customer relationship.
Which Customer Channels Attackers Target
Attackers target the channels where customer data and account access meet. The table maps each channel to its main threat and the test that addresses it.
| Channel | Main threat | Test to request |
| Customer portal | Account takeover | Authentication and session testing |
| Mobile app | Insecure data storage | Mobile application testing |
| Web chat and chatbots | Data leakage through responses | Prompt and input manipulation tests |
| Contact centre platform | Social engineering of agents | Vishing and process testing |
| Partner APIs | Excessive data exposure | API authorisation testing |
Security as Part of Customer Experience Management
Good customer experience management already maps every step a customer takes. Adding a security view to that same map shows where a weakness would hurt most. A login flow that frustrates customers is a CX problem. A login flow that lets attackers in is a far bigger one.
Some providers now work across both disciplines. Nexon, for instance, delivers cyber security advisory and customer experience platforms, which helps testers understand how service channels are built and where they connect to back-end systems.
When to Schedule Tests
Annual testing misses most of the changes that create new risk. Book a test whenever one of these happens.
- A new customer portal, app release or payment flow goes live
- A chatbot or AI assistant is added to a service channel
- Contact centre platforms are migrated or integrated with a CRM
- A third party gains access to customer data through an API
What This Means for CX and Security Leaders
Customers judge an organisation by how safely it handles their information as much as by how quickly it answers. Bringing security testing into the CX roadmap is one of the most direct ways to protect the trust those channels were built to earn. Share test findings with CX owners as well as security teams, so fixes are prioritised by customer impact and not only by technical severity.
Common Questions
How often should customer-facing systems be tested?
At least once a year, and again after any major release, new integration or AI feature added to a service channel.
Does security testing slow down CX projects?
Not if it is planned early. Booking a test window into the release plan avoids last-minute delays.
References
- Office of the Australian Information Commissioner. Large-scale data breaches on the rise, latest OAIC statistics reveal. https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal
