Pentest Configurator & Quote Generator

Our penetration tests follow established standards such as the OWASP Testing Guidelines, ASVS (Application Security Verification Standard) as well as PTES (Penetration Testing Execution Standard). This ensures that both technical vulnerabilities and typical attack vectors (e.g. authentication, access control, API abuse) are covered. Additionally, we rely on manual testing by experienced security experts - not pure scanner reports.

We offer these configuration options because every web application is unique. Through parameterization, we can assess the effort and risk landscape more precisely - and you only pay for what actually needs to be tested. For customers who don't know all the details, we also offer consulting for configuration as well as pre-configured "typical scenarios" (e.g. SaaS, e-commerce, internal business application).

In many cases, simple fixes are sufficient - in other cases, a complete re-test is necessary. Therefore, we offer the re-test as optional quality assurance - we explicitly recommend it especially for security-critical applications.

Yes, you can consciously skip a formatted PDF report if you have, for example, an internal security team or prefer technical exports. In this case, we deliver the results in structured format (Excel / Markdown / JSON) - functionally equivalent, but without visual formatting. Important: The management summary is independent of this and can be booked separately.

Mini-Pentest: Focus on critical vulnerabilities, 1 business day, compact email report
Standard-Pentest: Comprehensive OWASP Top10 review, 5 business days, detailed PDF report with results discussion
Extended Pentest: Full-scope testing including external attack surface, 9 business days, management summary

The OWASP Top10 is a list of the ten most common and critical security risks for web applications, updated annually by the Open Web Application Security Project (OWASP). It serves as an international standard for web security testing.

The Common Vulnerability Scoring System (CVSS) is an international standard for rating the severity of security vulnerabilities. Values above 7.0 are considered critical and require immediate attention.

Yes, you can add any number of services to your cart. For example, you can simultaneously commission a web application, an API, and a phishing test.

CMS systems like WordPress or Drupal have known structures and common vulnerabilities, making the test more efficient. Custom developments require more analysis and individual testing approaches.

A test environment is a copy of your production application where testing can be performed safely. Tests on production systems are riskier and require more caution, leading to higher costs.

These are all systems of your company accessible from outside (Internet): websites, email servers, VPN access, etc. An analysis helps identify forgotten or unknown systems.

After fixing identified vulnerabilities, we verify that the fixes have been correctly implemented and no new problems have emerged. This also includes tests for bypass possibilities.

External Attack Surface Monitoring (EASM) continuously monitors your external attack surface and notifies you of new systems or vulnerabilities. Argos is our proprietary tool for this.

A management summary summarizes technical findings in understandable language for executives and shows business risks as well as recommended actions.

Yes, all displayed prices are fixed prices including all services. Additional costs only occur if you commission additional services or the test object differs significantly from your specifications.

Certain features significantly increase the testing effort.

With fixed prices, we take on the risk. Should unforeseen complexities occur, we discuss possible adjustments with you before additional costs arise. This usually happens before the pentest starts.

1. Preliminary discussion: Clarification of details and access
2. Test execution: Analysis and tests according to defined methods
3. Report creation: Documentation of all findings
4. Results discussion: Explanation of findings and recommendations
5. Optional: Retest after implementation of fixes

Yes, for authenticated tests we need valid access credentials for various user roles. These are handled securely and deleted after the test.

Yes, this is possible and often sensible to avoid disrupting ongoing operations. We arrange this individually.

Yes, regular penetration tests are required or recommended in many standards like ISO 27001, PCI DSS, or GDPR. Our reports can serve as evidence.

You receive a detailed test report. With the extended pentest, a confirmation letter for customers/suppliers is additionally included.

Not directly, but GDPR and other laws require "appropriate technical measures". Penetration tests are considered best practice for demonstrating due diligence.

We explain all findings thoroughly and provide concrete recommendations for action. The implementation is usually handled by your internal teams or service providers.

Our methods are continuously adapted to new threats. We use current tools and techniques according to international standards.

Our prices are maximum prices - if it turns out that the pentest will be finished faster, you naturally pay a lower price.