How a Pentest Works
Typical duration: 2–4 weeks from kick-off to debrief
Scoping & Kick-off
We define goals, scope, and timeframe together.
Testing & Exploitation
Our specialists attack – manually and tool-assisted.
Reporting
You receive a detailed report with management summary and technical details.
Debrief
We discuss the results and measures together.
Our Methodology
Your Company Under the Microscope
We gather publicly available information about your company — exactly as an attacker would. This includes employee data, email addresses, technical details, and targeted phishing attempts.
You see which information about your company can be found publicly and how many employees fall for a targeted phishing email — with hard numbers instead of guesswork.
The First Break-In
We try to break into your systems from the outside — through your website, email server, VPN, or other services accessible from the internet.
You learn whether and how an attacker can get in from the outside — with traceable attack steps and prioritized remediation recommendations.
Exploiting Weak Points
We test your web applications and interfaces for weaknesses — can we access data we shouldn't see? Can we manipulate functionality?
You receive every vulnerability found with a proof of concept, risk rating, and concrete guidance on how your developers can fix it.
Spreading Through Your Network
From an initial foothold, we try to move through your internal network — just like a real attacker searching for your most important data.
You see how far an attacker gets in your internal network — up to full domain takeover — and which vulnerabilities to close first.
Attacking Your Cloud
We examine your cloud environment for misconfigurations and try to access data or services that aren't sufficiently protected.
You learn which cloud resources and data an attacker actually reaches — with documented attack paths and prioritized actions.
The Real Thing — Simulated
We simulate a complete, targeted attack on your organization — on request modeled on real hacker groups targeting your industry. From initial research to accessing critical systems, without prior knowledge of your infrastructure.
You learn whether a determined attacker reaches their objectives and how long they stay undetected — every step documented and mapped to the MITRE ATT&CK framework.