Totara Penetration Testing
Totara decides who sees whose training records through job assignments, dynamic audiences and Report Builder permissions rather than a single access setting. We test whether those boundaries actually match your organisation’s structure. CREST-certified testers, fixed price from £2,290 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Totara’s job assignments decide who is whose manager, and audiences decide which courses and content a learner can see. We test whether either was ever built wide enough to leak data across teams that should stay separate.
Why Totara access follows your org chart, not a single setting
Totara links each learner to a manager, position and organisation through their job assignments, and Totara’s own reporting documentation confirms manager relationships, positions and organisation structure are all drawn from these assignments. We test whether a user with more than one job assignment, or a manager relationship that changed after a reorganisation, still sees only the team they are meant to.
Audiences group users by a fixed list or a dynamic rule set, and Totara uses them to control which courses, programmes and content a learner can reach. Totara’s own reporting documentation distinguishes fixed site reports, which only a Site Administrator can open, from reports built with Report Builder, which follow whatever capability the report’s own permissions grant. We test whether a dynamic audience rule pulls in users it should not, and whether a Report Builder report built for one team is reachable by a user outside it.
HR Import keeps Totara’s users, positions and organisation structure synchronised from an external HR system on a schedule you control, and a field it is allowed to update can just as easily overwrite a manual change made inside Totara. Where an instance uses multitenancy to separate tenants on one platform, or runs third-party plugins alongside Totara’s own code, we test whether a tenant boundary or a plugin’s own permissions ever let one tenant or role reach data that belongs to another.
SCOPE
What we pen test on a Totara instance
Job Assignment and Manager Access
Every learner’s manager, position and organisation in Totara come from their job assignments, and a user can hold more than one at once. We test whether a manager only ever sees the team their current job assignments actually grant, including after a reorganisation moves people between teams.
Audience-Based Course Visibility
Totara uses audiences, fixed lists or dynamic rule sets, to decide which courses, programmes and certifications a learner can see and enrol in. We test whether audience membership actually restricts course visibility everywhere it is checked, not only on the learner’s dashboard.
Dynamic Audience Rule Scope
A dynamic audience is built from a rule set that Totara evaluates automatically, and a rule written too broadly can pull in users from teams, or tenants, it was never meant to include. We test the rule logic behind every dynamic audience that gates sensitive content.
Report Builder Data Exposure
Report Builder lets an administrator, and any role granted the capability, build custom reports pulling data from across the platform, including personal fields a user would not otherwise browse directly. We test who can create, run or share a report, and what data a report a lower-privilege role built can actually reach.
Site Reports vs Report Builder Access
Totara separates fixed site reports, which only a Site Administrator can open, from reports built with Report Builder, which follow whatever capability the report’s own permissions grant. We test whether a Report Builder report ever exposes data a site report deliberately restricts.
HR Import Data Synchronisation
HR Import synchronises users, positions and organisation structure from an external HR system on a schedule, creating and updating records without anyone using the Totara interface directly. We test what an import field is allowed to overwrite, and whether a manual change made inside Totara survives the next scheduled sync.
Multitenancy Boundary Testing
Where an instance uses multitenancy to run several business units or client organisations on one Totara platform, tenant isolation depends on audience rules and tenant-scoped roles being configured correctly. We test whether a user, report or audience in one tenant can reach content that belongs to another.
Third-Party Plugin Permissions
Totara inherits a plugin architecture from its Moodle core, and a third-party or custom plugin runs with the same access to the database and user data as Totara’s own code. We test what a plugin in scope actually does with the permissions it was installed with, rather than assuming the listing description is accurate.
Learning Platform Surface Shared with Moodle
Totara Learn is built on a Moodle-derived core, so many of the platform-level checks in our Moodle LMS penetration testing, course and activity permissions in particular, apply directly to a Totara instance too. We flag where Totara’s own job assignments, audiences and Report Builder diverge from stock Moodle behaviour.
Multi-LMS Estate Beyond Totara
Where your organisation runs Totara alongside another learning platform such as Canvas, for a different audience or business unit, our Canvas LMS penetration testing covers that platform on its own terms rather than assuming the same permission model applies.
OUR PROCESS
Totara Penetration Testing: From Scope to Attestation
Scope and Access
We agree which tenant, audiences and environments are in scope, provide accounts across learner, manager and Site Administrator roles, and confirm whether HR Import or a specific plugin needs testing too.
Job Assignment and Permission Mapping
We map job assignments, audiences and Report Builder capabilities against your organisation’s actual reporting lines and content structure.
Manual Testing
A CREST-certified tester manually tests manager boundaries, audience rules, report access and multitenancy or plugin permissions, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Totara pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Totara Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Totara For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Totara Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Totara instance?
We need at least one account for every distinct role, learner, manager, and Site Administrator or delegated report-builder access, plus a test feed if HR Import is in scope. Where multitenancy is in use, we need accounts in more than one tenant to test the boundary between them.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as HR Import runs and outbound notification emails, and we do not run destructive tests against real learner records without that agreement in writing.
How long does a Totara penetration test take?
A single Totara instance sits in our 2-day single-platform scope, with a report typically landing around 5 working days after kickoff. An instance using multitenancy, several connected HR systems or a large custom plugin set moves into a wider scope with more testing days.
Do you test a Totara-hosted deployment as well as self-hosted?
Yes. Totara offers a Totara-hosted deployment option alongside self-hosting on your own infrastructure, and we test either the same way. The accounts and environment access we need to arrange differ slightly between the two, which we agree during scoping.
What is out of scope for a single-platform Totara test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope for this test and covered by our cloud penetration testing service instead. A separate external HR system feeding HR Import is scoped and quoted separately if it needs its own test.
Do you need our source code?
No. Testing is black-box against the running instance by default. A grey-box option, where we review the relevant audience rules, job assignment structure and Report Builder configuration alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Totara have a customer penetration-testing policy we need to follow?
Yes, for a Totara Cloud instance. Totara’s own Cloud Acceptable Use Policy prohibits attempts to probe, scan or test the vulnerability of a system without agreed authorisation, so we confirm Totara’s current terms and secure any necessary sign-off with you before testing begins. A self-hosted Totara instance you run and patch yourself carries no equivalent vendor restriction.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Totara instance
Totara decides who sees whose training records through job assignments, dynamic audiences and Report Builder permissions rather than a single access setting. We test whether those boundaries actually match your organisation’s structure. CREST-certified testers, fixed price from £2,290 for a 2-day single-platform scope, quoted within 24 hours.
