How we work

A penetration test should reduce risk, not create new risk. That’s why every step is agreed upfront, documented and transparent to you.

Prefer to talk first? Book a call

The process in five steps

Day 0

Quote

Your binding fixed price appears instantly in the price calculator, valid for 30 days for the scope you entered; the written offer (PDF) with NDA, DPA and testing authorisation is sent by email right after your request. Want to talk it through first? A free call is always possible.
Before testing

Kickoff & authorisation

NDA, signed scope and rules of engagement, test accounts, contacts for emergencies. Nothing is touched before this is signed.
From 2 test days

Testing

Manual, expert-led testing against the agreed scope. Critical findings are reported to you immediately, not at the end.
+5 business days

Report & debrief

Audit-ready report within 5 business days, with an executive summary, CVSS 3.1 ratings and fix guidance. Walk-through call with your team.
Within 60 days

Free retest

Once you have fixed the findings, we retest them free of charge within 60 days and confirm in an updated report.

Written authorisation

Before any test you sign an engagement letter defining scope, timeframe, methods and contacts. This is standard and protects both sides. We never test without it.
Rules of engagement

Together we define what is allowed and what isn’t: test windows, intensity, excluded systems, and actions that need separate approval.
Confidential data handling

Project data is stored encrypted on our servers in Germany, only ever sent encrypted, and deleted 30 days after the project closes. NDA, DPA and testing authorisation come with the offer.
Clear communication

One contact for the whole project. Critical findings are reported the same day through the agreed channel, not just in the report. On your call, we stop testing at any time, immediately.
Reproducible results

Every finding is documented so it can be reproduced, rated with CVSS 3.1 and comes with a concrete recommendation.
Retest included

We retest fixed findings free of charge within 60 days. Your auditor gets an updated confirmation.

Prefer to talk first? Book a call

We work to recognised, publicly documented standards, so results are comparable and traceable for auditors.

How soon can testing start?

As soon as you like: in the quote form you pick your start date in the calendar, from the next free day. We confirm it in our reply.

Do you test remotely or on-site?

Remote-first: most tests run over the internet or via VPN / jump host. On-site in DACH on request.

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

Prefer to talk first? Book a call