Process
How an engagement works
The seven steps
Step by step
-
Scoping call
We agree on targets, exclusions, the testing window and the contacts on both sides.
A 30 to 45 minute call. You describe what you expose to the internet and what matters most to you; we ask about exclusions, fragile systems, hosting and whether authenticated testing makes sense.
- You get
- A written scope proposal within two business days, with targets, exclusions, the proposed testing window and the price.
- We need
- A list of domains or applications, one per line, and the name of the person who can sign for them.
-
Written authorization
You sign a testing agreement that lists our fixed source IP addresses, the testing windows and an emergency stop contact for each side. Nothing is tested before it is signed.
The agreement names the system owner, the exact targets and exclusions, our fixed source IP addresses, the testing windows, the emergency stop contact on both sides and the data handling terms. We check that the listed targets belong to the signatory before testing starts. Where your hoster or cloud provider requires notice or consent for penetration tests, we help you obtain it.
- You get
- A signed agreement your legal and operations teams can keep, and the source addresses your monitoring team can allow-list or watch.
- We need
- The signature of someone authorized to permit testing of these systems, and the hoster consent if their terms require it.
-
Attack surface mapping
We enumerate subdomains, exposed services, certificates and technologies. This inventory is part of your report.
Passive and active discovery of everything the internet can see of the targets: subdomains, open services, certificates, technology fingerprints, email security records. Assets outside the signed scope are listed but not tested.
- You get
- An inventory of your external attack surface, including assets you may not have known about.
- We need
- Nothing beyond the agreement. If the inventory shows assets you want added, we extend the scope in writing.
-
Testing
The OWASP Web Security Testing Guide is the baseline. On top of it we go after the modern attack classes most scanners miss: HTTP request smuggling, web cache poisoning, GraphQL and JWT handling, OAuth flows, and more. Coverage is tracked per asset, so gaps are visible instead of hidden.
Every asset is tested against the same checklist, and every check is recorded as done, not applicable or blocked. AI agents work through the breadth of the surface; the analyst directs them, follows up on what they find and tests the logic a checklist cannot capture.
- You get
- Coverage per asset in the report: what was tested, what was found clean and what could not be tested and why.
- We need
- Test accounts for authenticated testing, if agreed, and a reachable contact during the testing window.
-
Verification
A human analyst reproduces every finding before it enters the report. No unverified scanner output.
Each finding is reproduced by hand on the live target, rated for severity in your context and written up with evidence. Anything that cannot be reproduced is dropped or listed as an observation, clearly marked.
- You get
- Findings you can trust and hand straight to the engineer who owns the asset.
- We need
- Nothing. We may ask a question if a finding depends on something only you know.
-
Report and debrief
An executive summary for management. Technical findings with severity, evidence, reproduction steps and remediation guidance. A closing call to walk through both.
The report is delivered as an encrypted archive; the password reaches you through a separate channel. In the closing call we go through the risk picture with management and through each finding with your engineers.
- You get
- The report, the attack surface inventory, the coverage record and a closing call.
- We need
- A date for the closing call and the people who should be in it.
-
Retest
On request, we verify your fixes and update the report with the result.
After you have fixed the findings, we test each of them again and record the result in an updated report. A retest covers the findings, not a new full test.
- You get
- An updated report with the status of every finding, suitable as evidence for auditors and customers.
- We need
- A note which findings are fixed and ready for retest.
From you
What we need from you
Targets and exclusions
The domains and applications to test, one per line, and anything inside them that must stay untouched.
An authorized signature
The signature of someone who may permit testing of these systems, on the testing agreement.
A contact for the window
One reachable person on your side during the testing window, and the emergency stop contact.
Hoster consent
Where your hoster or cloud provider requires notice or consent for penetration tests, obtained before testing starts. We help you with it.
Test accounts
For authenticated testing, accounts with the roles you want covered. We treat them as live credentials and delete them after.
Timing
How long it takes
From signed authorization to the closing call, an engagement typically takes two to four weeks for a perimeter of a handful of hosts and one or two applications. The testing itself takes five to ten working days. Larger perimeters are split into phases so coverage stays complete.
There are no prices on this site. Every engagement is scoped individually by the number of hosts and applications and the depth of testing, and the scoping call ends with a written proposal and a fixed price. A price without a scope would be a guess, and this is not a business that guesses.
How to start
Tell us which domains and applications you want tested. We reply within two business days with a proposed scope and a time for the call.
[email protected] +49 162 1320798 Replies in English or German.