Pentest, Audits, or IT Security Reviews

Our Offerings for Pentests

Hardly any pentest/audit is exactly like another upon closer inspection — which makes it always exciting.

In our grey- and blackbox tests, we typically briefly examine the environment to be reviewed. This results in our offering, which includes preliminary planning and an effort estimate, which usually proves to be accurate. This way, you know which work positions and which investigation depth you can expect — and are not lured in with a cheap offer that is later revised.
This offer is usually free of charge.

We offer pentests/audits/IT security reviews for the following contexts:

Any type of web applications or APIs
Container environments, with or without orchestration
Cloud environments
Comprehensive network scans (LAN, DMZ)
Intensive checks of individual or multiple Unix and Windows server systems
Mobile applications (Android)
Embedded Linux

Our Pentest/Audit is a Consulting Service

Fundamentally, for us a pentest / audit / IT security review is a consulting service. We leave nothing to a tool, but rely on our long-term experience, critical eye, expert knowledge, and creativity. Fully automated scans, with or without AI agents, should only be used for a broad mass of targets and understood as a baseline — automated tools find, for example, in the case of a web application depending on the tool and vulnerability only about 10-50%. Depending on the task, local or, by agreement, third-party-hosted language models are also used for support.
Verification of findings and risk assessment in context must always be performed by a human. We work with a range of tools. These are free tools, a few commercial programs, used as an extended arm, as well as many helpers written by ourselves over time, which either perform independent tasks (such as testssl.sh) or automate individual points of a test plan. We have contributed to many other open-source tools used, including several scanners and OWASP projects such as the OWASP Top 10 and the OWASP Docker Top 10. Our approach is oriented towards the OWASP Testing Guide (web applications) as well as the BSI Penetration Testing Execution Standard.

What does the report look like?

The report is the most important tool for communicating and remediating findings. Therefore, a clear structure of the report and a comprehensible presentation are crucial.

After completing the work, you receive from us an individual, manually prepared, appropriately structured for the task, comprehensive report in good German — or, if desired, in good English, which includes:

Comprehensible, reproducible findings, detailed for developers in the case of APIs/web apps
Analysis and evaluation of revealed technical vulnerabilities
Findings are ordered or prioritized by technical risk
No false-positive findings, as carefully verified and filtered
Optional: Recommendations for remediation or mitigation of findings
Optional: Management Summary: risks clearly formulated, usually presented in tables, graphical presentation.

The Technical Summary addresses technical staff. With the detailed explanations, it should enable them not only to get a complete picture but also to see that several findings often share the same root causes. The optional Management Summary also explains such underlying patterns to executive levels in more detail. Fundamentally, it summarizes the technical risks underlying the findings in as few technical terms as possible, using graphics and tables. Where apparent or necessary, tips for sustainably managing information security are included. As part of a results presentation, we are happy to discuss the findings together — online or on-site.

We are happy to answer any further questions — or simply contact us for a quote! Even if it does not lead to cooperation: It remains confidential.