Tyvar, home
Request a scoping call

Service · point in time

Penetration testing for everything the internet can reach.

We test the domains, web applications and APIs your organization exposes, the way an attacker would reach them, and hand you a report your engineers can act on. One engagement, a fixed scope, a fixed price.

Scope

What we test

External testing covers the systems reachable from the internet and owned by you. The boundary keeps the test lawful, predictable and useful.

In scope

  • Domains and subdomains
  • Web applications
  • APIs, REST and GraphQL
  • Authentication flows, including OAuth
  • Exposed services and admin panels
  • TLS and certificate configuration
  • Email security records: SPF, DKIM, DMARC
  • Authenticated testing of a web applicationOptional, with test accounts you provide

Out of scope

  • Internal networks
  • VPN or on-site access
  • Social engineering
  • Phishing campaigns
  • Denial of service
  • Physical testing

If it needs more than an internet connection and your written authorization, we do not test it. Scope in detail

Method

AI-assisted, analyst-verified

AI agents give us breadth and speed across the whole attack surface. They enumerate, fingerprint and probe faster than a person can, and they do not get bored on asset two hundred. The analyst directs that work, follows the leads that matter and tests the logic a checklist cannot capture.

Then the separation that makes the report trustworthy: a human analyst reproduces every finding on the live target before it is written up. Anything that cannot be reproduced is dropped or marked as an observation. No scanner output reaches you unread. We do not name the AI vendor; the data protection terms are in the agreement.

Process

How an engagement works

Seven steps, in this order, every time. The full detail, including what we need from you and typical durations.

  1. Scoping call

    We agree on targets, exclusions, the testing window and the contacts on both sides.

  2. Written authorization

    You sign a testing agreement that lists our fixed source IP addresses, the testing windows and an emergency stop contact for each side. Nothing is tested before it is signed.

  3. Attack surface mapping

    We enumerate subdomains, exposed services, certificates and technologies. This inventory is part of your report.

  4. Testing

    The OWASP Web Security Testing Guide is the baseline. On top of it we go after the modern attack classes most scanners miss: HTTP request smuggling, web cache poisoning, GraphQL and JWT handling, OAuth flows, and more. Coverage is tracked per asset, so gaps are visible instead of hidden.

  5. Verification

    A human analyst reproduces every finding before it enters the report. No unverified scanner output.

  6. Report and debrief

    An executive summary for management. Technical findings with severity, evidence, reproduction steps and remediation guidance. A closing call to walk through both.

  7. Retest

    On request, we verify your fixes and update the report with the result.

Deliverables

What you receive

The report has two readers and serves both. It is also evidence: for customers who ask for a test, for insurers, and for the effectiveness assessment NIS2 expects of the companies it covers.

  • Executive summary for management
  • Attack surface inventory from the mapping step
  • Findings with severity, evidence, reproduction steps and remediation
  • Coverage per asset, including what was found clean
  • A closing call, and a retest on request
Sample from our report templateTYV-2026-0000 / 03

Broken object level authorization on the invoice endpoint

Severity
High. CVSS 3.1 base 6.5, raised one step: every customer invoice is readable.
Asset
api.example.com, GET /v1/invoices/{id}
Status
Verified by analyst on the live system

Evidence, excerpt

GET /v1/invoices/1041 HTTP/1.1
Host: api.example.com
Authorization: Bearer <token of test account A>

HTTP/1.1 200 OK
{"invoice":"1041","customer":"test account B","total":"[redacted]"}

Reproduction

  1. Log in as test account A and note the bearer token.
  2. Request an invoice that belongs to test account B with that token.
  3. The API returns the invoice instead of 403 Forbidden.

Remediation

Enforce the ownership check in the service layer for every object access, not only in the listing. Use non-sequential identifiers as a second line. Add an authorization test per endpoint to the pipeline.

Retest: open. Reference: OWASP API Security Top 10, API1.

Request a scoping call

Send the domains and applications you want tested. We reply within two business days with a proposed scope and a fixed price, and a time for the call.

Request a scoping call

[email protected] +49 162 1320798 Replies in English or German.