--- title: "Penetration Testing Germany | Mr Cyber – Verified security." url: https://mr-cyber.com/ language: en description: "Penetration testing for web apps, APIs, mobile apps, Active Directory and cloud. Straight from the tester: manual pentests from €1,900, instant fixed price." --- # The only hacker you invite in. We break in, with your written permission, so criminals can’t. Manual penetration tests for web apps, APIs, mobile apps, cloud, networks, Active Directory and IoT. Fixed price, audit-ready report, free retest. [See my fixed price](https://mr-cyber.com/quote) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) - Manual pentests from **€1,900** Founding clients: +1 test day free · 4 of 5 left [Get my fixed price](https://mr-cyber.com/quote) [See prices](https://mr-cyber.com/pricing) - [OWASP WSTG · PTES · BSI · CVSS 3.1](https://mr-cyber.com/process) - [Evidence for ISO 27001, SOC 2, NIS2](https://mr-cyber.com/nis2-penetration-testing) - Hosted & operated in Germany Vulnerabilities reported to - ![SCHUFA](/_a/Bvca6kXW.png) - Adobe - Infomaniak - DANA Indonesia - Zabbix - Icinga - Pi-hole - Jenkins - Prometheus - BMW - Doctolib - ![](/_a/Bvca6kXW.png) Critical vulnerabilities found, responsibly reported, fixed. ## At a glance Mr Cyber is a Germany-based penetration testing consultancy. We find vulnerabilities in applications and infrastructure before attackers do, and deliver audit-ready reports for NIS2, ISO 27001 and SOC 2. Who Mr Cyber, a Germany-based security consultancy specialising in penetration testing. What 13 manual core tests in three areas: Applications, Network & cloud and Attack & code. Also tested: Microsoft 365, Kubernetes, Wireless, OT/ICS and more. Plus continuous pentesting, the vulnerability assessment (not a pentest) and the AI-assisted pentest as separate options. For whom Startups and mid-sized companies in Germany, Austria, Switzerland and the EU. Businesses only. Price Manual pentests at a fixed price from €1,900, depending on scope, retest included. Continuous pentesting: €590 per month. AI-assisted pentest: €590 one-time or €390 per month, per target. Payment Invoice after the report, payable within 14 days. No deposits. Location Remote by default. On-site on request, travel billed at cost. Timeline You pick the start date yourself in the quote calendar, from the next free day. Report within 5 business days after testing ends. Standards OWASP WSTG, OWASP API Top 10, OWASP MASVS/MASTG, PTES, BSI guidance, CVSS 3.1. Evidence for NIS2, ISO 27001, SOC 2, TISAX, PCI DSS, BSI IT-Grundschutz and customer security reviews. ## Penetration tests for everything attackers can reach. Every test led by hand. - [### Web application pentest SaaS platforms, portals, shops and internal web apps, tested by hand against OWASP WSTG. from €2,900 · 3 test days](https://mr-cyber.com/services/web-application-penetration-testing) - [### API pentest REST and GraphQL APIs behind your apps, partners and integrations, tested against the OWASP API Top 10. from €2,400 · 3 test days](https://mr-cyber.com/services/api-penetration-testing) - [### iOS app pentest iPhone and iPad apps and the API behind them, tested by hand against OWASP MASVS. from €2,900 · 3 test days](https://mr-cyber.com/services/ios-app-penetration-testing) - [### Android app pentest Android apps and the API behind them, tested by hand against OWASP MASVS. from €2,900 · 3 test days](https://mr-cyber.com/services/android-app-penetration-testing) - [### Desktop app pentest Windows, macOS and Linux applications, thick clients and their servers, tested by hand. from €3,800 · 4 test days](https://mr-cyber.com/services/desktop-application-penetration-testing) - [### AI & LLM pentest Chatbots, RAG assistants, AI agents and LLM features in your product, tested against the OWASP LLM Top 10. from €2,900 · 3 test days](https://mr-cyber.com/services/ai-llm-penetration-testing) - [### IoT & hardware pentest Connected products end to end. Device, electronics, firmware, app and cloud, tested together. from €4,700 · 5 test days](https://mr-cyber.com/services/iot-hardware-penetration-testing) - [### Cloud pentest AWS, Azure and Google Cloud accounts, IAM and workloads, checked against CIS and tested by hand. from €3,300 · 4 test days](https://mr-cyber.com/services/cloud-penetration-testing) - [### External network pentest Public IPs, domains, VPN, mail and remote access, tested from an attacker's position on the internet. from €1,900 · 2 test days](https://mr-cyber.com/services/external-network-penetration-testing) - [### Internal network pentest Office and server networks, segmentation and critical systems, tested from an attacker's position inside. from €3,800 · 4 test days](https://mr-cyber.com/services/internal-network-penetration-testing) - [### Active Directory pentest On-premises Active Directory and hybrid Entra ID, checked for the paths from a normal user to domain admin. from €3,400 · 4 test days](https://mr-cyber.com/services/active-directory-penetration-testing) - [### Red teaming & assumed breach Multi-week, objective-based attack simulation that tests your detection and response, within agreed rules. from €9,500 · 10 test days](https://mr-cyber.com/services/red-teaming) - [### Secure code review Manual review of your source code for security flaws, against OWASP ASVS, with fixes per line. from €2,900 · 3 test days](https://mr-cyber.com/services/secure-code-review) - Also tested: [Microsoft 365](https://mr-cyber.com/services/cloud-penetration-testing#m365) [Kubernetes](https://mr-cyber.com/services/cloud-penetration-testing#kubernetes) [Wireless](https://mr-cyber.com/services/internal-network-penetration-testing#wireless) [OT/ICS](https://mr-cyber.com/services/internal-network-penetration-testing#ot) [OSINT](https://mr-cyber.com/services/external-network-penetration-testing#osint) [CI/CD](https://mr-cyber.com/services/secure-code-review#cicd) [Smart contracts](https://mr-cyber.com/services/secure-code-review#web3) [Automotive](https://mr-cyber.com/services/iot-hardware-penetration-testing#automotive) [All services](https://mr-cyber.com/services) Not sure which test you need? [Book a scoping call](https://mr-cyber.com/contact#book) ### Separate options - [Continuous pentesting One manual test day every month, used for your releases. Fixed monthly price, cancel monthly. €590 per month · 1 manual test day per month](https://mr-cyber.com/services/continuous-pentesting) - [Vulnerability assessment Not a pentest An automated scan of up to 32 external IP addresses, checked by hand. Not a pentest. €390 · up to 32 IP addresses](https://mr-cyber.com/services/vulnerability-assessment) - [AI-assisted pentest AI agents run the test, a senior tester steers it and verifies every finding. One-time or monthly. €590 one-time · €390 per month · per target](https://mr-cyber.com/services/ai-assisted-pentest) ## Straight to the tester. You talk to the person who tests your system. At large consultancies a partner sells the project and rotating teams do the testing. At Mr Cyber the same person handles your project from your request to the retest. [See my fixed price](https://mr-cyber.com/quote) The person you brief also tests, writes the report and checks your fixes. - ### Direct access to the tester Your questions go to the person who found the issue, and they answer them. Nothing gets lost between sales and testing. - ### Manual, not a scanner No scanner finds broken business logic, privilege escalation or tenant isolation flaws. That’s where the critical findings are. - ### Start when you want Pick your start date right in the calendar, from the next free day, in time for audit deadlines and release plans. - ### Fixed price, agreed upfront You know the cost before we start. Retesting fixed findings is included. ## Someone will test your security. Better it’s us. Attackers scan around the clock for exactly the weaknesses a penetration test finds. The only question is who finds them first. According to IBM, a data breach costs German companies €4.25 million on average, more than 1,000 times the price of a pentest from €1,900. 119 new vulnerabilities in IT systems became known per day on average, around 24% more than in the previous period. Germany, 1 July 2024 to 30 June 2025. Source: BSI State of IT Security 2025, p. 3. - €289.2 bn damage to the German economy from theft, espionage and sabotage, around 70% of it caused by cyberattacks. Bitkom 2025 - 87% of surveyed German companies were hit in the past 12 months, or suspect they were. Bitkom 2025 - ~80% of reported attacks, for example with ransomware, targeted small and medium-sized companies. BSI State of IT Security 2025, p. 3 - 29,500 entities in Germany are estimated to fall under NIS2 and must prove their security measures work. BSI, NIS-2 Annual figures from public reports. Source: [Bitkom, “Wirtschaftsschutz 2025” study](https://www.bitkom.org/sites/main/files/2025-12/bitkom-studienbericht-wirtschaftsschutz-2025.pdf) (1,002 companies surveyed) · [BSI, “The State of IT Security in Germany 2025”](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2025_Achtseiter.pdf?__blob=publicationFile&v=7) (PDF, p. 3) · [BSI: NIS-2 regulated entities](https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html) ### NIS2 has applied in Germany since 6 December 2025. The German NIS2 implementation act requires in-scope companies to take risk-management measures and to assess whether they are effective. A penetration test is exactly that evidence for management, auditors and the BSI. ## From quote to passed retest. 1. Day 0 ### Quote Your binding fixed price appears instantly in the price calculator, valid for 30 days for the scope you entered; the written offer (PDF) with NDA, DPA and testing authorisation is sent by email right after your request. Want to talk it through first? A free call is always possible. 2. Before testing ### Kickoff & authorisation NDA, signed scope and rules of engagement, test accounts, contacts for emergencies. Nothing is touched before this is signed. 3. From 2 test days ### Testing Manual, expert-led testing against the agreed scope. Critical findings are reported to you immediately, not at the end. 4. +5 business days ### Report & debrief Audit-ready report within 5 business days, with an executive summary, CVSS 3.1 ratings and fix guidance. Walk-through call with your team. 5. Within 60 days ### Free retest Once you have fixed the findings, we retest them free of charge within 60 days and confirm in an updated report. ## Attackers don’t send a report. We do. Every finding is reproducible, rated with CVSS 3.1 (4.0 on request) and comes with a concrete fix. The executive summary answers management’s question: how big is the risk, and what do we do now? - One-page executive summary - Findings with reproduction, evidence and fix - CVSS 3.1 ratings and prioritisation - Mapped to OWASP, CWE and compliance controls - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 - Retest confirmation and attestation letter for your auditor Client portal with triage, status per finding and one-click ticket creationIn development Pentest report · Admin & Söhne GmbH · MC-2026-014 Risk: High CVSS 3.1 · 8.2 Open · retest included ### Admin area reachable without login app.admin-soehne.example · /admin CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N #### Description The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice. #### Steps to reproduce 1. Open a private browser window, without logging in. 2. Go to https://app.admin-soehne.example/admin. 3. The admin dashboard loads, showing all customers and edit buttons. ``` GET /admin HTTP/2 Host: app.admin-soehne.example HTTP/2 200 Admin Dashboard … ``` #### Business impact Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days. #### Remediation Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login. OWASP Top 10 2021: A01 Broken Access Control · CWE-306 (Missing Authentication for Critical Function) ## Built for your auditors. Proof you can pass on. Five documents from one engagement: the report for your team, the letter for everyone who asks. - **Pentest report** · findings with evidence, fix and CVSS 3.1 - **Management summary** · the risk picture on one page - **Retest confirmation** · fixed findings tested again, at no charge - **Ticket import file (CSV, JSON and email)** · one ticket per finding - **Attestation letter** · one page for auditors, customers and insurers [See the report](https://mr-cyber.com/sample-report) ## From the field [All posts](https://mr-cyber.com/blog) - - Analysis ### [Refrigeration Attacks Across Europe: What Retailers and Cold-Chain Operators in Germany Should Check Now](https://mr-cyber.com/blog/refrigeration-controller-attacks-europe) First France, then Belgium, Ireland, Germany and more: attacks on refrigeration controllers in autumn 2026. What is known and what operators should check. 4 November 2026 · 8 min read - - Guides - Pricing ### [Pentest price upfront: how ScopeCheck works](https://mr-cyber.com/blog/penetration-test-cost-calculator) How ScopeCheck turns a few plain questions into a binding fixed pentest price, how the price is set, and what happens when the scope is different. 19 October 2026 · 2 min read - - Guides - Compliance ### [NIS2 penetration testing: what German companies actually need](https://mr-cyber.com/blog/nis2-penetration-testing-requirements) What NIS2 and Germany’s NIS2UmsuCG really require on security testing, who is affected, and how to plan a pentest that holds up as audit evidence. 17 October 2026 · 3 min read ## Frequently asked questions How much does a penetration test cost? Our fixed prices start at €1,900 for an external network pentest; a web application pentest starts at €2,900. The exact price depends on scope. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. See [pricing](https://mr-cyber.com/pricing). How long does a pentest take? Depending on the service, our manual pentests start at 2 to 10 test days; larger scopes take longer. The report follows within 5 business days of testing ending; critical findings are reported immediately. What do we get at the end? A report with an executive summary, findings with reproduction and fix, and CVSS ratings. Plus a ticket import file (CSV, JSON and email): every finding becomes its own ticket, ready to import into Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive them by email import. After you fix, a retest confirms it, and you get a one-page attestation letter for auditors and customers. [See the report](https://mr-cyber.com/sample-report). Will testing disrupt our production systems? Test windows, intensity and forbidden actions are agreed upfront in the rules of engagement. Destructive tests only happen with explicit approval; we can also test against staging. Are we too small for a pentest? No. Startups in particular need pentest reports to win enterprise customers, satisfy investors or pass ISO 27001 / SOC 2 audits. We scope the test so the budget goes where the risk is highest. We already run a vulnerability scanner. Isn’t that enough? A scanner finds known technical issues. A penetration test also finds logic flaws, missing authorisation checks and chained attacks, which is what attackers actually exploit. The two complement each other. How is our data handled? NDA, DPA and testing authorisation come with the offer. Test data and results are stored encrypted on our servers in Germany, only ever sent encrypted, and deleted 30 days after the project closes. Is penetration testing legal? Yes, with your written authorisation defining targets, timeframe and methods. This authorisation is standard and protects both sides. We never test without it.