Have Your Company Tested by Professional Hackers

Industry:
Banking / Finance

Position:
Project Manager for the Expansion and Standardization of Penetration Testing

Responsibilities:

• Analysis of legal and regulatory requirements
• Risk analysis in accordance with KWG/MaRisk/BAIT
• Collaboration with internal risk control departments (data protection, compliance, legal, etc.)
• Coordination, including a works agreement with the works council
• GAP analysis
• Definition of standards and guidelines for penetration testing
• Reconciliation process between known and unknown assets
• Penetration testing report template in accordance with BaFin requirements
• Review of penetration testing reports for quality and alignment with BaFin requirements
• Coordination of penetration tests
• Escalation management
• Definition and implementation of end-to-end processes
• Proper handover to operational teams

Industry:
Banking / Finance

Position:
Project Manager for Penetration Testing Governance

Areas of Responsibility:

• Adaptation of guidelines
• Development of current, target, interim, and final states
• Developing a concept for external service providers
• Defining and coordinating reporting, KRIs, and KPIs

Industry:
Banking / Finance

Position:
Project Manager

Areas of Responsibility:

• Initiation, planning, and execution of various penetration testing projects
• Infrastructure penetration tests: perimeter, network gateways/segmentation, Windows and Linux servers
• Physical security of the institutions themselves and self-service areas: access control systems, video surveillance, network access security (especially in self-service and reception areas)
• Client security: Privilege escalation, antivirus evasion, lateral movement within internal networks
• Applications: Testing of internal and external web applications according to the complete OWASP WSTG
• Awareness: Social engineering and phishing attacks
• Preparation of detailed test reports documenting technical details and customer-specific recommendations for corrective actions

Industry:
Energy Provider

Position:
Project Manager

Areas of Responsibility:

• Audit Preparation & Planning
• In-depth corporate network penetration test to technically evaluate the office and control center infrastructure
• Conducting regular penetration tests and providing support in implementing cost-effective measures to significantly reduce the risk of a successful attack, as well as to demonstrably meet relevant regulatory requirements such as due diligence obligations and compliance measures

Industry:
Pharmaceuticals

Position:
Project Manager

Responsibilities:

• Planning, execution, and highly successful completion of a global penetration test
• Evaluation of the existing, globally networked infrastructure and assessment of the attack potential posed by both external and potential internal attackers
• Development of a comprehensive security strategy, including a prioritized roadmap for the initial remediation of critical security vulnerabilities and for monitoring via managed services
• Preparation of a detailed test report

Industry:
Sports equipment manufacturer

Role:
Project Manager

Areas of Responsibility:

• Identification and assessment of critical security vulnerabilities, as well as development of measures to address them
• Audit based on the complete OWASP WSTG v4
• Detailed report for management and IT
• Verification of resolved vulnerabilities as part of a follow-up audit
• Globally operated online stores for product sales, as well as employee portals for various business processes
• Creation of prioritized catalogs of organizational measures for management and technical measures for IT
• Identification of shortcomings in development and definition of measures to address them in a sustainable manner

Industry:
Medical device manufacturer

Position:
Project Manager

Areas of Responsibility:

• Analysis of legal and regulatory requirements
• FDA Draft Guidance and 510(k) submission scope
• UL 2900 Cybersecurity Standard for Medical Devices
• NIST 800 Series for security, data protection, and risk management
• ISO 62304 and 14971 via AAMI TIR-57 for medical devices
• Analysis of both development and residual risks
• Review and penetration testing of software, interfaces, and hardware
• Reverse engineering of hardware and firmware
• Supporting the client in establishing a “security-by-design” strategy

Industry:
Banking / Finance
Public Sector / Healthcare

Role:
Penetration Tester

Responsibilities:

• Planning the scope of penetration tests and the rules of engagement
• Penetration testing of web applications, infrastructure, and mobile applications (e.g., in accordance with OWASP or NIST 800-115) using white-box, gray-box, and black-box approaches
• Identifying security vulnerabilities through manual vulnerability analysis
• Supporting security assessments using common vulnerability scanners (e.g., BurpSuite, Nessus, OWASP ZAP, Nikto, Skipfish, nmap, etc.)
• Coordination and management of penetration testing programs and quality assurance for conducted penetration tests
• Creation and refinement of documentation and checklists to ensure the success of penetration tests
• Information gathering using manual and automated tools within the agreed scope (including Shodan, public databases such as RIPE)
• Exploitation of identified vulnerabilities within the agreed-upon Rules of Engagement using common tools (e.g., Metasploit, proof-of-concept exploit code) and proprietary attack vectors
• Documentation of the procedure and results based on the identified risk (risk analysis) and using indicators such as exploitability and probability of occurrence (based on CVSS)
• Developing recommendations for addressing identified vulnerabilities in targeted reports tailored to the intended audience
• Conducting retests to verify that vulnerabilities have been resolved and subsequently communicating the results

Industry:
SMEs / Manufacturing / Utilities / Retail

Role:
Pentester

Responsibilities:

• Planning the scope (scoping / test scope) of penetration tests and vulnerability assessments, as well as the Rules of Engagement
• Penetration testing and vulnerability assessments of iOS and web applications as well as infrastructure (e.g., with a focus on the OWASP Top 10 or NIST 800-115) using white-box, gray-box, and black-box approaches
• Automated and manual vulnerability assessments to detect accessible network services (“enumeration,” e.g., via nmap, Nessus, Dirbuster, or Nikto)
• Coordination and management of penetration testing programs and quality assurance for conducted penetration tests
• Creation and refinement of documentation and checklists to ensure the success of penetration tests
• Information gathering using manual and automated tools within the agreed scope (including Shodan, public databases such as RIPE)
• Exploitation of identified vulnerabilities within the agreed-upon Rules of Engagement using common tools (e.g., Metasploit, POC exploit code) and proprietary attack vectors
• Documentation of the methodology and results based on the assessed risk (risk analysis) and using indicators such as exploitability or probability of occurrence (based on CVSS)
• Developing recommendations for addressing identified vulnerabilities in a targeted report tailored to the intended audience
• Conducting retests to verify that vulnerabilities have been resolved and subsequently communicating the results

A penetration test checks a defined system for as many vulnerabilities as possible. Red Teaming simulates a real, covert attack using techniques, people, and processes, and assesses whether your team can detect and defend against it. A penetration test evaluates security, while Red Teaming evaluates detection and response capabilities.

The price depends primarily on the scope and depth of the work. It depends on how many and which systems are tested, how thoroughly they are examined, and whether a follow-up test is required. We work with a clearly defined scope rather than vague, arbitrary fixed prices. Give us a call, and we’ll work with you to determine the scope of the work.

Common types include external and internal network penetration tests, web application and API penetration tests, mobile app tests, Wi-Fi/wireless tests, IoT tests, and social engineering. The best combination depends on your infrastructure and compliance requirements.

A focused test usually takes a few days, while extensive network or red-teaming projects can take several weeks. We determine the specific duration during the scoping phase to ensure that the effort and value align with your goals.

We recommend performing this at least once a year, as well as after significant changes to systems or applications. Regulated companies (e.g., under DORA or §44 KWG) may have stricter requirements, which we take into account during the planning process.

Look for recognized industry certifications such as OSCP, OSEP, and OSWE, as well as standardized methodologies (OWASP, PTES, BSI). Our testers are certified accordingly and maintain comprehensive documentation. Suitable for internal audits and regulatory authorities.

Yes. Our tests and reports are designed to meet regulatory requirements—from ISO 27001 to DORA (including threat-based testing according to TIBER-DE) to BaFin’s §44 KWG special audit. You’ll receive audit-ready documentation.

A vulnerability scan is automated and identifies potential vulnerabilities. A penetration test is conducted manually by experts, verifies whether vulnerabilities can be exploited, and assesses the actual risk—including prioritized recommendations for action.

We conduct testing for small and medium-sized businesses, mid-market companies, and large corporations—with particular expertise in banking, insurance, critical infrastructure/energy, healthcare, pharmaceuticals, and manufacturing. We tailor the scope and approach to your specific systems and compliance requirements.