Questions
Questions, answered plainly
Do you use AI?
Yes, openly. AI agents give us breadth and speed across the whole attack surface. A human analyst reproduces every finding and decides what goes into the report. No finding reaches you unverified. AI-assisted analysis is processed by a third-party model provider under contractual data protection terms; all subprocessors are listed in the data processing agreement, available on request.
Will testing affect production?
Testing is designed not to. There is no denial of service and no destructive testing, we work inside the windows you set, and your emergency stop contact can halt the test at any moment. A system that behaves unexpectedly under ordinary requests is itself a finding, and we report it instead of pushing further.
Do you test internal networks?
Our standard service is external: domains, web applications, APIs and exposed services. We can also test internal networks and Active Directory, but that is not part of our packaged offering yet, so ask us if you need it. Social engineering, phishing and physical testing stay out of scope.
What do you need from us?
A list of the domains or applications to test, the exclusions, a contact on your side for the testing window, the signature of someone who may authorize testing of these systems, the consent of your hoster or cloud provider where their terms require it, and test accounts if you want authenticated testing.
How long does a test take?
From signed authorization to the closing call, an engagement typically takes two to four weeks for a perimeter of a handful of hosts and one or two applications. Testing itself takes five to ten working days. Larger perimeters are scoped in phases. The scoping call gives you a date.
Do you retest?
On request. After you have fixed the findings we test each of them again and update the report with the result. A retest covers the findings from the report, not a new full test.
Who sees our findings?
The analyst working on your engagement, and you. Reports are delivered as an encrypted archive with the password sent through a separate channel. Working data is deleted 90 days after the closing call, or after the retest; the report and the signed agreement are kept for three years and then deleted.
Can we stop a test at any time?
Yes. The agreement names an emergency stop contact on both sides. One phone call halts the test with immediate effect, no questions asked. You can resume later or end the engagement.
Do you need our hoster’s permission?
Sometimes. Several hosters and cloud providers require notice or consent before penetration tests of systems in their infrastructure. We check their terms with you during scoping and help you obtain what they ask for. Without it, the affected systems stay out of scope.
How is the report delivered?
As an encrypted archive, with the password sent through a separate channel agreed at scoping, by phone by default. PGP-encrypted email is available on request. The report contains an executive summary, the attack surface inventory, every finding with severity, evidence, reproduction steps and remediation guidance, and the coverage record per asset.
Do you sign an NDA and a data processing agreement?
Yes. A mutual NDA can be signed before scoping details are exchanged. The testing agreement contains confidentiality terms, and a data processing agreement under Art. 28 GDPR is part of the contract set whenever personal data may be processed, which is the case for authenticated testing and for most web applications.
Does a penetration test help with NIS2?
NIS2 requires affected companies to assess the effectiveness of their security measures and to manage the risk of their network and information systems. An external penetration test is evidence for both, limited to what the internet can reach. It does not replace a risk management process; it tests one part of it.
What does it cost?
Every engagement is scoped individually, by the number of hosts and applications and the depth of testing. The scoping call ends with a written proposal and a fixed price. There is no price list on this site because a price without a scope would be a guess.
Where are you based, and do you work outside Germany?
In Ulm, Germany. We work with customers in Germany, Austria, Switzerland and the rest of the EU, in English or German. Testing is remote by nature; the closing call is a video call unless you are nearby.
How to start
Tell us which domains and applications you want tested. We reply within two business days with a proposed scope and a time for the call.
[email protected] +49 162 1320798 Replies in English or German.