Tyvar, home
Request a scoping call

AI-assisted offensive security, Ulm, Germany

Real attacks. Signed rules.

Tyvar tests what your organization exposes to the internet, with the techniques real attackers use, inside rules you sign first. AI agents cover the breadth. A human analyst verifies every finding before it reaches you.

Request a scoping call What we offer
Plan view of a perimeter An irregular red outline marks the tested surface: web application, API, TLS, mail records, DNS, exposed services, admin panel. Two inner outlines, the internal network and on-site systems, are marked out of scope. tested surface internal network: out of scope on-site, VPN: out of scope admin panel web application API TLS mail records DNS exposed services perimeter survey scope: external only not to scale
Plan view of a perimeter. The red line is the tested surface; the inner outlines stay out of scope.

Services

What we offer

Two services today, both tested from the outside and both under written authorization. We offer only what we deliver now. A new service means a new page here, not a change of direction.

Point in time

External penetration testing

A full engagement against your domains, web applications and APIs. OWASP baseline plus the modern attack classes, coverage tracked per asset, every finding reproduced by an analyst.

Offered now

How the test works

Recurring

Attack surface monitoring

Your internet-facing surface changes every week. We re-map it on an agreed schedule, report what is new since the last run and re-test the exposed assets, so a forgotten subdomain does not become the way in.

Offered now

How monitoring works

Rules

Authorization first

The same rules hold for every Tyvar engagement. The boundary is not fine print. It is what separates a security test from an offense under German law.

  • Written authorizationA signed testing agreement from the system owner, plus the consent of your hoster or cloud provider where their terms require it.
  • Fixed source IPsEvery test comes from the addresses named in the agreement, so your team can tell our traffic from everything else.
  • Emergency stopOne contact on each side can stop the test at any time, by phone, with immediate effect.
  • Agreed testing windowsWe test when you say, and we stay inside the targets and exclusions you listed.
  • No destructive testingNo denial of service, no data destruction, no changes to production data beyond what a finding needs as evidence.

Unauthorized access to systems is an offense under German criminal law, sections 202a and following of the StGB. That is why the signature comes before the first packet. How we handle authorization and your data

Deliverables

What you receive

Whichever service you book, the report has two readers. Management gets an executive summary with the risk picture on one page. Your engineers get every finding with severity, evidence, reproduction steps and remediation guidance, plus the attack surface inventory.

  • Executive summary for management
  • Attack surface inventory: subdomains, services, certificates, technologies
  • Findings with severity, evidence, reproduction steps and remediation
  • Coverage per asset, including what was tested and found clean
  • A closing call, and a retest on request

Reports are delivered as an encrypted archive. The password reaches you through a separate channel. This card is a real finding from the template, on an example domain.

Sample from our report templateTYV-2026-0000 / 03

Broken object level authorization on the invoice endpoint

Severity
High. CVSS 3.1 base 6.5, raised one step: every customer invoice is readable.
Asset
api.example.com, GET /v1/invoices/{id}
Status
Verified by analyst on the live system

Evidence, excerpt

GET /v1/invoices/1041 HTTP/1.1
Host: api.example.com
Authorization: Bearer <token of test account A>

HTTP/1.1 200 OK
{"invoice":"1041","customer":"test account B","total":"[redacted]"}

Reproduction

  1. Log in as test account A and note the bearer token.
  2. Request an invoice that belongs to test account B with that token.
  3. The API returns the invoice instead of 403 Forbidden.

Remediation

Enforce the ownership check in the service layer for every object access, not only in the listing. Use non-sequential identifiers as a second line. Add an authorization test per endpoint to the pipeline.

Retest: open. Reference: OWASP API Security Top 10, API1.

The name

Where the name comes from

Tyr
the Norse god of war and law
varr
Old Norse, watchful

That pairing is the whole job: real attack techniques, used only inside the rules a customer signs.

TEE-var  /ˈtiːvɑːr/  ·  built in Ulm by NxtGenIT

Questions

What customers ask first

Do you use AI?

Yes, openly. AI agents give us breadth and speed across the whole attack surface. A human analyst reproduces every finding and decides what goes into the report. No finding reaches you unverified. AI-assisted analysis is processed by a third-party model provider under contractual data protection terms; all subprocessors are listed in the data processing agreement, available on request.

Will testing affect production?

Testing is designed not to. There is no denial of service and no destructive testing, we work inside the windows you set, and your emergency stop contact can halt the test at any moment. A system that behaves unexpectedly under ordinary requests is itself a finding, and we report it instead of pushing further.

Do you test internal networks?

Our standard service is external: domains, web applications, APIs and exposed services. We can also test internal networks and Active Directory, but that is not part of our packaged offering yet, so ask us if you need it. Social engineering, phishing and physical testing stay out of scope.

All questions and answers

How to start

Tell us which domains and applications you want tested. We reply within two business days with a proposed scope and a time for the call.

Request a scoping call

kontakt@nxtgenit.de +49 162 1320798 Replies in English or German.