Pentesting ยท IT security
We attack before others do.
A penetration test examines your website, customer portal or software the way an attacker would. With your written permission, within a clear framework and with a report that shows what to do.
Why test
Whoever builds software knows where mistakes happen. That is exactly where we look.
Outdated plugins, open admin access, customer data another customer can see, misconfigured cloud services: often a single gap is enough. A pentest finds it before someone exploits it.
Under the new Data Protection Act, companies must protect personal data with appropriate technical and organisational measures. A pentest shows where you stand and gives you a clear plan.
- Basiswritten order
- Methodologyfor example OWASP
- Resultreport with measures
- Afterwardsretest
- On requestfixing by us
What we test
Websites and web shops
Content management, plugins, forms, encryption and security headers.
Web apps and customer portals
Sign-in, roles and permissions, access to other people's data, file uploads and sessions.
Interfaces
APIs: authentication, permissions, data leaks and abuse of functions.
Reachable from the internet
What of your business is visible from outside: servers, remote access, open services and certificates.
Email and domain
Protection against forged senders with SPF, DKIM and DMARC, and what your domain reveals about you.
Source code
Review of your own applications for typical vulnerabilities, directly in the code.
How a pentest works
Initial conversation
Goals, systems and time window. We clarify what is tested and what is not.
Written order
Scope, contacts, test period and emergency contact. Without your signature we test nothing.
Test
Following recognised methodology, for example the OWASP guides. Carefully, risky steps are agreed in advance.
Report
Every vulnerability with risk, evidence and a concrete measure. Plus a summary for management.
Retest
After the fix we check whether the gaps are really closed.
Our principles
Only with permission
We only test systems for which we hold written permission.
Confidential
Results go to you only. We delete test data when the project ends.
As little as necessary
We prove a gap without looking at more data than needed.
Understandable
The report explains risks so that management can decide.
We close gaps too
As developers we don't just find the gap, on request we fix it as well.
Honest
No test finds everything. We state clearly what was tested and what was not.
Frequently asked questions
Is a pentest legal?
Yes, with the written permission of the company that owns the systems. If systems are hosted or in the cloud, we first clarify what the provider's rules allow. Without permission we test nothing.
Can something break?
We test carefully and agree risky steps in advance. A disruption can never be ruled out completely, so we plan a test window and an emergency contact.
Why does an SME need a pentest?
Attacks don't only hit large companies, often a single gap is enough. The Data Protection Act also requires personal data to be protected with appropriate measures. A pentest shows where you stand.
How often should we test?
After major changes to website or software, and otherwise regularly, for example once a year.
What does a pentest cost?
It depends on the scope. After the initial conversation you receive a quote with a clearly defined scope.