Blackbox, Greybox, Whitebox
Penetration Testing
We identify vulnerabilities in your IT infrastructure before real attackers can exploit them. Through targeted, controlled attacks, we show you where your defenses truly stands. In a realistic, real-world setting and without any risk to your ongoing operations.
Request a penetration testAll services
Offensive Security
Penetration
Testing
Testing
Security analysis
Procedure
Variants
Tailored to your needs
Standards
OWASP, PTES, BSI-Durchführungskonzept (Implementation Plan)
Result
Report with Risk Classification
When a test is scheduled
It’s rare for a request to come out of the blue. Most of the time, there’s a specific trigger:
- A customer requests a current penetration test report before signing a contract.
- A new application or portal is going live and needs to be tested beforehand.
- The infrastructure has been redesigned, migrated, or expanded to include cloud services.
- An audit or cyber insurance policy requires a regular test as proof.
- The last test was conducted more than a year ago, and the environment has changed since then.
- Following a security incident, it must be demonstrated that the attack vector has indeed been closed.
- There is a general assumption within the organization that everything is secure, but no one has ever verified it.
If any of these points apply, we’ll discuss during the initial consultation which type of test will be most beneficial.
What's Included in the Test
- Technical Vulnerability Analysis – Identification of potential attack vectors in systems, networks, and applications.
- Simulation of Real Attacks – We act like real attackers and use the latest methods and tools.
- Compliance Check – Support with regulatory requirements such as ISO 27001 or the GDPR.
How Much We Know in Advance
Das Verfahren entscheidet, wie realistisch und wie tief ein Test wird. Wir wählen es gemeinsam mit Ihnen, passend zum Ziel.
Blackbox
We start with no prior knowledge, just like an external attacker. This shows what is actually accessible from the outside.
Greybox
We work with limited information or a standard user account. This simulates the scenario of an attacker who already has a foothold.
Whitebox
We gain full insight into the architecture, configuration, and, in some cases, the source code. This provides the highest coverage per day spent.
Methodology
We conduct testing based on established standards rather than gut feelings: OWASP WSTG and ASVS for web applications, and PTES and the BSI Penetration Testing Implementation Concept for the overall process. This ensures that results are transparent and comparable across multiple tests.
Which Test Is Right for You?
Five variants examine different areas of vulnerability. More often than not, the question is not so much ‘which test’ as ‘in what order’.
During the initial consultation, we’ll sort this out together, even if several points apply at the same time.
Our Penetration Testing Services
What Determines the Scope
Two tests with the same name can vary greatly in size. The effort required depends primarily on:
- Number of systems: Applications, or locations included in the scope of the test.
- Testing Methods: Black-box testing takes longer than white-box testing because information must first be gathered, whereas in white-box testing, that information is available from the start.
- The complexity of the permissions and role logic, especially in web and AD tests involving many user roles.
- Number of test accounts if multiple authorization levels are to be tested.
- Level of preparedness: clearly documented systems can be assessed more quickly than environments that have evolved over time without a current overview.
We’ll provide an initial assessment after a brief scoping discussion—usually without requiring you to prepare anything in advance.
How Often Testing Should Be Done
A penetration test is a snapshot. It reflects the state of the system at the time of the test, and nothing beyond that. As a general guideline:
- Annually for critical systems and environments subject to compliance requirements, such as those covered by ISO 27001 or BSI Basic Protection.
- Additionally, following significant changes—such as a new release, a migration, a new cloud connection, or a new location.
- After a security incident, to confirm that the exploited pathway has indeed been closed.
Für Umgebungen mit häufigen Releases ist ein einzelner Jahrestest oft zu grobmaschig. Dafür bietet sich Schwachstellen Scanning und Management als kontinuierliche Ergänzung an, der Pentest bleibt die tiefere, manuelle Prüfung in regelmäßigem Abstand.
What You'll End Up Holding in Your Hands
✓
Final Report: The procedure, scope, and results are documented in a manner that is verifiable even by an auditor.
✓
Executive Summary: The information is presented on two pages and is easy to understand even without prior technical knowledge.
✓
Findings with supporting evidence: Each vulnerability, along with its CVSS risk rating and the steps required to reproduce it.
✓
Recommended Action for Each Finding: Specific enough that your developers or admins can get started right away.
✓
Prioritized List of Actions: Sorted by risk and effort, so you know where to start.
Risk classification is based on <strong>CVSS</strong>, the internationally recognized standard for assessing vulnerabilities. This makes results comparable across different tests and vendors, rather than relying on an internal, non-transparent scale.
A penetration test is not the same as a vulnerability scan
An automated scan checks systems against a database of known vulnerabilities and quickly provides a broad but superficial overview. A penetration test goes a step further: findings are manually verified, linked into realistic attack paths, and evaluated in the context of your environment.
The two are not mutually exclusive. Many customers use vulnerability scanning and management for ongoing monitoring and supplement it with an annual, in-depth penetration test.
Why a Penetration Test Is Worth It
Attackers often exploit vulnerabilities that can be easily patched as soon as they are detected. A penetration test provides precisely this kind of transparency: It reveals real risks rather than theoretical threats and provides concrete evidence to back it up.
“A penetration test is not an attack; it is a planned wake-up call.”
Here's how a test works
1
Scoping
We clarify the objective, scope, testing procedures, and timeframe. You will receive a quote with a clear scope of services, with no hidden charges.
2
Implementation
We conduct testing within the agreed-upon timeframe. We report critical findings immediately, rather than waiting until the report is issued.
3
Report and Closing Discussion
We'll provide the documentation and go over it with your team, both from a technical and a management perspective.
4
Follow-up Test
Upon request, we will review the measures that have been implemented and confirm in writing that the issue has been resolved.
Not a run-of-the-mill report
Automated scans find what scanners find. We manually verify each finding, link individual vulnerabilities into realistic attack paths, and evaluate them in the context of your environment. That’s why our reports list what can actually be exploited—not what a tool deems suspicious.
What You Need to Provide
- An overview of the systems, applications, or locations to be tested.
- A point of contact for technical questions during the test.
- Test accounts for each authorization level, if gray-box or white-box testing has been agreed upon.
- A time window, if the test is to take place outside of normal operating hours.
- For hosted or cloud-based systems, confirmation of whether your provider requires notification or approval for penetration tests.
That’s usually all it takes. We’ll work out the details together during the scoping meeting.
Penetration Testing
Tell us what needs to be put to the test. During the initial consultation, we select the appropriate test type and define the scope and methodology.
- Five test types for every attack surface
- Black box, grey box, or white box
- Based on OWASP, PTES, and BSI standards
- Findings include CVSS scores and reproduction steps
Frequently Asked Questions
What customers want to know before a penetration test is conducted.
Could the test cause any problems?
The risk is low. Destructive methods and availability attacks are prohibited unless expressly agreed otherwise. You may identify sensitive systems in advance so that we will only monitor them passively.
Isn't an automated scan enough?
A scan identifies known vulnerabilities, but does not reveal whether they can actually be exploited or how they can be chained together. A scan is useful for ongoing monitoring, but manual testing is required to draw reliable conclusions.
How long does a test take?
That depends heavily on the scope, see the section on effort. You will receive an estimate after the scoping meeting.
Will we need to provide you with a written permission?
Yes. Before each test, the scope and time frame are set out in writing so that both parties are clear on what has been agreed upon.
What happens if a critical issue is found during the test?
We’ll report it right away, not just in the final report, so you can take action without having to wait for the test to end.
How do we know if a fix actually worked?
For information on the optional follow-up test, see Step 04 in the procedure.
