# Mr Cyber

> Mr Cyber is a Germany-based penetration testing consultancy for startups and mid-sized companies (Mittelstand) in Germany, Austria, Switzerland and the EU. Manual, expert-led penetration tests at fixed prices from €1,900, with audit-ready reports for NIS2, ISO 27001, SOC 2, TISAX and PCI DSS and a free retest. Businesses only (B2B).

Key facts:

- Company: Mr Cyber, Sole proprietor / freelancer, Germany. Website: https://mr-cyber.com
- Services (13 core tests): Applications: Web application pentest, API pentest, iOS app pentest, Android app pentest, Desktop app pentest, AI & LLM pentest and IoT & hardware pentest. Network & cloud: Cloud pentest, External network pentest, Internal network pentest and Active Directory pentest. Attack & code: Red teaming & assumed breach and Secure code review.
- Also tested inside a core test at no surcharge: Microsoft 365 (Cloud pentest), Kubernetes (Cloud pentest), CI/CD (Secure code review), Hardening review (Internal network pentest), Wireless (Internal network pentest), Phishing (Red teaming & assumed breach), OSINT (External network pentest), Hardware & firmware (IoT & hardware pentest). No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.
- Engagement models: Vulnerability assessment from €390; Assumed breach from €5,700; OT & ICS security assessment from €5,700; Smart contract audit from €4,700; Automotive security testing (on request). The vulnerability assessment is a lighter, scan-based check, not a penetration test.
- Continuous pentesting (a separate monthly service, manual): 1 manual test day per month, used for the client's releases, e.g. a web app tested by hand every month all year round. €590 per month, fixed. No minimum term, cancel monthly; 10% off for yearly prepayment (€6,372 per year). Included: 1 manual test day per month, used for your releases; Save unused days within a calendar quarter for a big release; Every release tested before or right after go-live; Free retest of every fix; Questions answered between releases; Findings tracked in one running report; Monthly check of your external attack surface. Unused test days carry over within the calendar quarter and expire at its end. Not the same as the monthly AI-assisted pentest: continuous pentesting is a manual test day every month; the monthly AI-assisted pentest is an AI-assisted run every 2 weeks.
- AI-assisted pentest (a separate option, NOT a manual pentest; all other services are manual): AI agents run agentic, automated testing and a senior tester steers the run and verifies every finding before delivery. 1 target = 1 web app, 1 API with up to 50 endpoints, 1 external range with up to 16 IP addresses, or 1 cloud account (1 AWS account, 1 Azure subscription or 1 Google Cloud project). Two options, flat prices per target (more targets = price × number of targets): One-time AI-assisted pentest €590 per target (every finding verified by the tester, report within 5 business days, one free re-check of fixes within 30 days); Monthly AI-assisted pentest €390 per target per month (a full run every 2 weeks, every finding verified by the tester, a short report after each run with all findings kept in one running list, fixes re-checked in the next run or on request; cancel monthly, 10% off for yearly prepayment). Runs on Mr Cyber's own EU infrastructure; client data does not go to third-party AI services. It complements a manual pentest and does not replace it.
- Pricing: fixed prices. Web application pentest from €2,900 (3 test days); API pentest from €2,400 (3 test days); iOS app pentest from €2,900 (3 test days); Android app pentest from €2,900 (3 test days); Desktop app pentest from €3,800 (4 test days); AI & LLM pentest from €2,900 (3 test days); IoT & hardware pentest from €4,700 (5 test days); Cloud pentest from €3,300 (4 test days); External network pentest from €1,900 (2 test days); Internal network pentest from €3,800 (4 test days); Active Directory pentest from €3,400 (4 test days); Red teaming & assumed breach from €9,500 (10 test days); Secure code review from €2,900 (3 test days). Retest always included. The quote form shows the binding fixed price for the entered scope instantly (a starting price where an answer is "Not sure"); for priced scopes the written offer (PDF) is sent by email right after the request.
- Founding clients: the first 5 fixed-price pentest projects signed by 31 Dec 2026 get 1 extra test day at no charge, worth about €950 (same price, more coverage); 4 of 5 places still available. Does not apply to the monthly plans.
- Process: binding fixed price online in the quote form → written authorisation & rules of engagement → manual testing (critical findings reported immediately) → report within 5 business days → free retest within 60 days.
- Report deliverables: PDF report, a retest confirmation, a one-page attestation letter (who tested what and when, scope, standards, finding status after the retest; a confirmation, not a certification), and a ticket import file (CSV, JSON and email) ready to import into Jira, ServiceNow, GitLab, Azure DevOps and GitHub; helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive them by email import. One finding = one ticket with title, severity and priority, affected asset, description, steps to reproduce, recommended fix, references; the client imports the CSV with the tool's own CSV importer, feeds the one-email-per-finding files (.eml, plain text, severity as X-Priority) into any email-to-ticket helpdesk, or uses the JSON file with their own tooling. Planned, not yet available: client portal with triage, status per finding and one-click ticket creation (in development; no direct API integration today).
- Standards: OWASP WSTG, OWASP API Security Top 10, OWASP MASVS/MASTG, PTES, BSI guidance; findings rated with CVSS 3.1 (CVSS 4.0 on request) plus business risk.
- Compliance evidence: NIS2 (Art. 21(2)(f) effectiveness assessment), ISO/IEC 27001:2022 A.8.8 and A.8.29, SOC 2, TISAX, PCI DSS 4.0 Req. 11.4, DORA regular testing (no TLPT), GDPR Art. 32(1)(d). Mr Cyber does not certify; it delivers audit-ready evidence.
- Delivery: remote-first from Germany; on-site in Germany, Austria and Switzerland on request, travel billed at cost. Hosted in Germany. Project data deleted 30 days after project close; NDA, data processing agreement and testing authorisation are sent with every written offer.
- Contact: contact@mr-cyber.com · quote form https://mr-cyber.com/quote · contact https://mr-cyber.com/contact

## Services

- [Web application penetration testing](https://mr-cyber.com/services/web-application-penetration-testing.md): A web application penetration test is a manual, expert-led attack on your web app to find vulnerabilities before criminals do. Mr Cyber tests authentication, access control, business logic and data isolation to the OWASP Web Security Testing Guide, and delivers a fixed-price, audit-ready report with a free retest.
- [API penetration testing (REST & GraphQL)](https://mr-cyber.com/services/api-penetration-testing.md): An API penetration test checks whether your REST or GraphQL API can be abused to read, change or delete data it should protect. Mr Cyber tests object- and function-level authorisation, authentication, mass assignment, rate limiting and business flows against the OWASP API Security Top 10, manually, at a fixed price, with a free retest.
- [iOS app penetration testing](https://mr-cyber.com/services/ios-app-penetration-testing.md): An iOS app penetration test checks whether your iPhone or iPad app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, the app's API and platform features against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest.
- [Android app penetration testing](https://mr-cyber.com/services/android-app-penetration-testing.md): An Android app penetration test checks whether your app protects user data on the device, in transit and in the backend it talks to. Mr Cyber tests storage, authentication, exported app components and the app's API against OWASP MASVS and MASTG, by hand, at a fixed price, with a free retest.
- [Desktop application penetration testing](https://mr-cyber.com/services/desktop-application-penetration-testing.md): A desktop application penetration test checks whether an installed program, such as a thick client, an agent or an Electron app, can be misused to reach data or rights it should protect. Mr Cyber tests the client, its local data, its updates and the server or API behind it, by hand, at a fixed price, with a free retest.
- [AI & LLM application penetration testing](https://mr-cyber.com/services/ai-llm-penetration-testing.md): An AI and LLM penetration test checks whether your chatbot, RAG assistant or AI agent can be pushed into leaking data, ignoring its rules or taking actions it should not. Mr Cyber tests the model integration, its data access and its tools against the OWASP Top 10 for LLM Applications, by hand, at a fixed price.
- [IoT & hardware penetration testing](https://mr-cyber.com/services/iot-hardware-penetration-testing.md): An IoT and hardware penetration test checks whether your connected product can be misused to reach user data, take over devices or attack the backend. Mr Cyber tests the device and its electronics, the firmware, the companion app and the cloud services together, with ETSI EN 303 645 and OWASP ISVS as checklists, at a fixed price, with a free retest.
- [Cloud penetration testing (AWS, Azure, GCP)](https://mr-cyber.com/services/cloud-penetration-testing.md): A cloud penetration test checks whether your AWS, Azure or Google Cloud environment can be misused to reach data or take over resources. Mr Cyber reviews identities, permissions, network exposure, storage and logging against the CIS Benchmarks, then tests the paths that matter by hand, at a fixed price, with a free retest.
- [External network penetration testing](https://mr-cyber.com/services/external-network-penetration-testing.md): An external network penetration test checks what an attacker on the internet can reach and exploit in your company, without any login. Mr Cyber maps your public IP addresses, domains and services, then tests remote access, mail, VPN and web servers by hand to PTES and NIST SP 800-115, at a fixed price, with a free retest.
- [Internal network penetration testing](https://mr-cyber.com/services/internal-network-penetration-testing.md): An internal network penetration test shows how far an attacker gets once inside your network, for example after a phishing email or through an infected laptop. Mr Cyber tests segmentation, servers, credentials and the paths to your critical systems by hand, following PTES and NIST SP 800-115, at a fixed price, with a free retest.
- [Active Directory penetration testing](https://mr-cyber.com/services/active-directory-penetration-testing.md): An Active Directory penetration test checks how easily a normal user account can be turned into control over your whole Windows domain. Mr Cyber reviews permissions, privileged accounts, policies and the hybrid link to Entra ID, then tests the real attack paths by hand, at a fixed price, with a free retest.
- [Red teaming & assumed breach](https://mr-cyber.com/services/red-teaming.md): Red teaming is an objective-based attack simulation over several weeks that tests whether your organisation detects and stops a determined attacker. Mr Cyber agrees goals, scope and rules of engagement with you in writing, then works towards them like a real adversary, following MITRE ATT&CK, with agreed limits and a stop at any time to keep the impact on operations minimal.
- [Secure code review](https://mr-cyber.com/services/secure-code-review.md): A secure code review is a manual security audit of your source code that finds vulnerabilities at their root, including issues a black-box test cannot reach. Mr Cyber reviews authentication, access control, input handling, cryptography, secrets and dependencies against OWASP ASVS, at a fixed price, with fix guidance your developers can apply line by line.
- [Continuous pentesting with one manual test day every month](https://mr-cyber.com/services/continuous-pentesting.md): Continuous pentesting is a manual pentest spread over the year. Every month, a tester spends one test day on your releases, for example on your web app, and retests every fix. Findings are tracked in one running report. It costs a fixed €590 per month, with no minimum term.
- [AI-assisted pentest with agentic, automated testing](https://mr-cyber.com/services/ai-assisted-pentest.md): An AI-assisted pentest is an agentic, automated security test. AI agents test your web app, API, external network or cloud account, and a senior tester steers the run and verifies every finding before you see it. It is a separate option next to our manual pentests and complements a manual pentest rather than replacing it.
- [Vulnerability assessment for your external IP addresses](https://mr-cyber.com/services/vulnerability-assessment.md): A vulnerability assessment checks up to 32 of your external IP addresses for known vulnerabilities. Recognised tools run an automated scan, then a tester checks the relevant results by hand and removes false positives. You get a short report with priorities and fixes, and a free re-scan of fixed findings, for a fixed €390. It is not a pentest.
- [NIS2 & compliance penetration testing](https://mr-cyber.com/nis2-penetration-testing.md): What NIS2 and other frameworks require and how a pentest report serves as evidence.
- [Pentest or vulnerability scan?](https://mr-cyber.com/pentest-vs-vulnerability-scan.md): Pentest or vulnerability scan: what each one finds, what it costs and when you need which. A fair comparison, with fixed prices for both.
- [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing.md): Does ISO 27001 require a pentest? Not literally. A pentest gives your auditor evidence for Annex A 8.8 and 8.29. Fixed price, retest included.
- [TISAX pentest](https://mr-cyber.com/tisax-penetration-testing.md): TISAX pentest for automotive suppliers: what the VDA ISA catalogue says about penetration tests at high protection needs. Fixed price, retest included.
- [Pentest for cyber insurance](https://mr-cyber.com/cyber-insurance-penetration-testing.md): Pentest for cyber insurance: what insurers’ questionnaires typically ask and how a pentest report and an attestation letter help you answer them.

## Company

- [Home](https://mr-cyber.com/index.md): Overview, at-a-glance facts and FAQ.
- [Pricing](https://mr-cyber.com/pricing.md): Fixed prices, what drives cost, what is always included.
- [Pentest cost calculator](https://mr-cyber.com/quote.md): The quote form doubles as the pentest cost calculator. Pick the services, answer up to three scope questions each, and see a binding fixed price for that scope (valid 30 days). "Not sure" answers get a starting price (not binding): the exact scope and the binding fixed price are then set with the client. For scopes too individual for the calculator, the exact price is set with the client. Tests run remotely by default; on-site travel is billed at cost and agreed beforehand.
- [How we work](https://mr-cyber.com/process.md): Authorisation, rules of engagement, data handling, communication.
- [About](https://mr-cyber.com/about.md): Background, certifications; vulnerabilities found and responsibly reported to SCHUFA, Adobe, Infomaniak, DANA Indonesia, Zabbix, Icinga, Pi-hole, Jenkins, Prometheus, BMW and Doctolib (not clients).
- [Report](https://mr-cyber.com/sample-report.md): Structure of a report, one finding and the same finding as an imported ticket.
- [Contact](https://mr-cyber.com/contact.md): Quote form, booking, email, phone, PGP.

- [Research & disclosure](https://mr-cyber.com/research.md): Security advisories published after coordinated disclosure, and the responsible-disclosure policy. Contact: security@mr-cyber.com

## Blog

- [Blog](https://mr-cyber.com/blog.md): All posts by category.
- [Refrigeration Attacks Across Europe: What Retailers and Cold-Chain Operators in Germany Should Check Now](https://mr-cyber.com/blog/refrigeration-controller-attacks-europe.md): First France, then Belgium, Ireland, Germany and more: attacks on refrigeration controllers in autumn 2026. What is known and what operators should check.
- [Pentest price upfront: how ScopeCheck works](https://mr-cyber.com/blog/penetration-test-cost-calculator.md): How ScopeCheck turns a few plain questions into a binding fixed pentest price, how the price is set, and what happens when the scope is different.
- [NIS2 penetration testing: what German companies actually need](https://mr-cyber.com/blog/nis2-penetration-testing-requirements.md): What NIS2 and Germany’s NIS2UmsuCG really require on security testing, who is affected, and how to plan a pentest that holds up as audit evidence.
- [What does a penetration test cost in Germany in 2026?](https://mr-cyber.com/blog/penetration-test-cost-germany.md): What drives the cost of a penetration test, fixed price vs. day rates, what must be included, and how to get the most security for your budget.

## Deutsch

- [Startseite](https://mr-cyber.com/de.md): Penetrationstests aus Deutschland – Überblick und FAQ.
- [Penetrationstest für Webanwendungen](https://mr-cyber.com/de/leistungen/webanwendung-penetrationstest.md)
- [API-Penetrationstest (REST & GraphQL)](https://mr-cyber.com/de/leistungen/api-penetrationstest.md)
- [Penetrationstest für iOS-Apps](https://mr-cyber.com/de/leistungen/ios-app-pentest.md)
- [Penetrationstest für Android-Apps](https://mr-cyber.com/de/leistungen/android-app-pentest.md)
- [Penetrationstest für Desktop-Anwendungen](https://mr-cyber.com/de/leistungen/desktop-anwendung-penetrationstest.md)
- [Penetrationstest für KI- und LLM-Anwendungen](https://mr-cyber.com/de/leistungen/ki-llm-penetrationstest.md)
- [Penetrationstest für IoT und Hardware](https://mr-cyber.com/de/leistungen/iot-hardware-penetrationstest.md)
- [Cloud-Penetrationstest (AWS, Azure, GCP)](https://mr-cyber.com/de/leistungen/cloud-penetrationstest.md)
- [Externer Penetrationstest](https://mr-cyber.com/de/leistungen/externer-penetrationstest.md)
- [Interner Penetrationstest](https://mr-cyber.com/de/leistungen/interner-penetrationstest.md)
- [Active-Directory-Pentest](https://mr-cyber.com/de/leistungen/active-directory-pentest.md)
- [Red Teaming & Assumed Breach](https://mr-cyber.com/de/leistungen/red-teaming.md)
- [Source-Code-Review (Secure Code Review)](https://mr-cyber.com/de/leistungen/source-code-review.md)
- [Kontinuierliches Pentesting mit einem manuellen Testtag pro Monat](https://mr-cyber.com/de/leistungen/kontinuierliches-pentesting.md)
- [KI-gestützter Pentest mit agentischen, automatisierten Tests](https://mr-cyber.com/de/leistungen/ki-gestuetzter-pentest.md)
- [Schwachstellenanalyse für Ihre externen IP-Adressen](https://mr-cyber.com/de/leistungen/schwachstellenanalyse.md)
- [NIS2-Penetrationstest](https://mr-cyber.com/de/nis2-penetrationstest.md)
- [Pentest oder Schwachstellenscan?](https://mr-cyber.com/de/pentest-oder-schwachstellenscan.md)
- [Pentest ISO 27001](https://mr-cyber.com/de/pentest-iso-27001.md)
- [TISAX Pentest](https://mr-cyber.com/de/tisax-pentest.md)
- [Pentest Cyberversicherung](https://mr-cyber.com/de/pentest-cyberversicherung.md)
- [Preise](https://mr-cyber.com/de/preise.md)
- [Pentest-Kostenrechner](https://mr-cyber.com/de/angebot.md)
- [Ratgeber](https://mr-cyber.com/de/ratgeber.md)
- [Kühlanlagen-Angriffe in Europa: Was deutsche Händler und Kühlketten-Betreiber jetzt prüfen sollten](https://mr-cyber.com/de/ratgeber/kuehlanlagen-angriffe-europa.md)
- [Pentest-Preis vorab: So funktioniert ScopeCheck](https://mr-cyber.com/de/ratgeber/pentest-preis-berechnen.md)
- [NIS2 und Penetrationstests: Was Unternehmen in Deutschland wirklich brauchen](https://mr-cyber.com/de/ratgeber/nis2-anforderungen-penetrationstest.md)
- [Was kostet ein Penetrationstest? Kosten und Preise 2026](https://mr-cyber.com/de/ratgeber/penetrationstest-kosten.md)

## Optional

- [Full site content in one file](https://mr-cyber.com/llms-full.txt)
- [Legal notice / Impressum](https://mr-cyber.com/legal-notice.md)
- [Privacy policy](https://mr-cyber.com/privacy.md)