EUR 4.9M
Average cost of a data breach in Germany
IBM Cost of a Data Breach Report 2024. Including business interruption, regulatory fines, reputational damage, and customer churn.
Penetration Testing
Your Pentest Provider. 500+ Tests. Every finding verified.
The average data breach costs organizations EUR 4.9 million. A penetration test from AWARE7 finds the gaps that scanners miss - with OSCP-certified experts and a fixed-price quote in 24h.
ISO 27001 certified 500+ pentests completed
Trusted by organizations across industries
- Pentests Completed
- 500+
- Years of Experience
- 8+
- to Fixed-Price Quote
- 24h
- manually verified findings
- 100%
The underestimated risk
Why your organization is more vulnerable than you think
Most organizations rely on firewalls and antivirus software. What they don't see: the vulnerabilities that no automated scan ever finds.
60%
of critical vulnerabilities remain undetected by scanners
Business logic flaws, chained attack paths, and misconfigurations can only be found by a manual penetration test.
NIS-2
Penetration tests are now mandatory for affected organizations
The NIS-2 Directive requires technical security measures including penetration testing for essential and important entities.
What we find - in almost every organization:
Critical CVSS 9.8 Remote Code Execution via insecure deserialization
High CVSS 8.6 SQL Injection enabling complete data exfiltration
Medium CVSS 5.3 Outdated TLS configuration allowing downgrade attack
On average, we find 3 critical, 5 high, and 12 medium severity vulnerabilities per engagement.
The Solution
Penetration Test Process: 5 Phases Following Industry Standards
Our methodology follows the OWASP Testing Guide, PTES standard, and MITRE ATT&CK Framework. Transparent, reproducible, and usable as compliance evidence.
Pentest-Prozess: 5 Phasen, 1 Preis
- Vorbereitung - Scoping & Vertragsgestaltung: Prüfobjekt und Prüfumfang gemeinsam festlegen. Testmethodik definieren: Black-, Grey- oder White-Box. Rules of Engagement und Zeitfenster vereinbaren. Verbindliches Festpreisangebot in 24 Stunden.
- Einarbeitung - Reconnaissance & Analyse: Dokumentation und Architektur sichten (gem. BSI). Prüfumgebung einrichten und Zugänge validieren. OSINT und passive Informationsgewinnung. Angriffsfläche kartieren und priorisieren.
- Testphase - Praktische Prüfung: Modul 1: Konzeptionelle Schwächen identifizieren. Modul 2: Härtungsmaßnahmen und Konfiguration prüfen. Modul 3: Bekannte Schwachstellen scannen und verifizieren. Modul 4: Kontrollierte Exploitation und Angriffsketten.
- Bericht - Dokumentation & Debrief: CVSS-Bewertung und Kritikalitätseinstufung. Management Summary für die Geschäftsführung. Technische PoCs und Handlungsempfehlungen. Persönliches Debrief mit Ihrem Team.
- Nachtest - Behebung & Validierung: Behebung der Schwachstellen durch Ihr Team. Re-Test aller kritischen Findings. Aktualisierter Bericht mit Behebungsstatus. Erst wenn Kritisches geschlossen → Abschluss.
01
VorbereitungScoping & Vertragsgestaltung
- Prüfobjekt und Prüfumfang gemeinsam festlegen
- Testmethodik definieren: Black-, Grey- oder White-Box
- Rules of Engagement und Zeitfenster vereinbaren
- Verbindliches Festpreisangebot in 24 Stunden
Ablauf nach BSI-Praxis-Leitfaden · Festpreisangebot in 24h
A
Management Summary
1-2 pages for executives
B
Technical Findings
CVSS + Proof-of-Concept
C
Prioritized Roadmap
Actionable remediation steps
References
Client references
These case studies are available in German.
Services
Pentest Services: From Web Apps to Cloud
We cover every attack vector - with the same methodology, the same OSCP-certified experts, and the same report quality.
# Area Focus
Web Applications
OWASP Top 10, API Security, Business Logic Flaws, Authentication Bypass.
DetailsNetwork & Infrastructure
Active Directory, Firewall Bypass, Lateral Movement, Privilege Escalation.
DetailsMobile Apps
iOS and Android. OWASP Mobile Top 10, API communication, reverse engineering.
DetailsCloud Security
AWS, Azure, GCP. IAM Review, Container Security, Serverless Functions.
DetailsIoT & OT Security
Industrial control systems, SCADA, hardware analysis, firmware reverse engineering.
DetailsRed Teaming & Social Engineering
Phishing, physical access, hybrid attacks - simulating the real-world threat scenario.
Discuss scopeMethodology
Pentest Methods: Black Box, Grey Box & White Box
The depth and realism of a security test varies depending on the level of knowledge provided to the tester.
Black-Box Pentest
The tester receives no prior knowledge - only the scope. Simulates an external attacker. Ideal for realistic threat scenarios and perimeter testing.
Typical: External network tests, web applications
Grey-Box Pentest
RecommendedLimited information provided - e.g. credentials or documentation. Best balance of depth and realism. Our standard approach.
Typical: Web apps, APIs, internal networks
White-Box Pentest
Full access to source code, architecture, and documentation. Maximum testing depth, including hidden business logic vulnerabilities.
Typical: Security-critical applications, code review
Why choose AWARE7 as your penetration testing provider
What sets us apart from other providers
Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.
Research and teaching as our foundation
20 %Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.
Digital sovereignty: no compromises
100 %From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.
More on digital sovereigntyFixed price within 24h: predictable project timelines
24 hWithin 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.
Your dedicated contact
1:1A personal project manager accompanies you from the first meeting to the retest. You book appointments directly with your contact person and keep the same contact throughout the project.
Peer-reviewed publications
Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations
ACM AsiaCCS 2025
Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
A Platform for Physiological and Behavioral Security
NSPW 2025
Jan Hörnemann
Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem
IEEE/IFIP DSN 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Understanding Regional Filter Lists: Efficacy and Impact
PoPETS 2025
Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann
Who is AWARE7 the right partner for?
Mid-sized companies with 50-2,000 employees
Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.
IT managers & CISOs
Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.
Regulated industries
Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.
Pentest Box
AWARE7 ProprietaryInternal Penetration Test. Remote, not on-site.
Our Pentest Box is installed on your network once - then our experts take over remotely. No VPN access or open firewall ports required. Same quality, significantly lower cost.
No Travel or Accommodation Costs
Full-quality internal pentests at a significantly lower price point - making them accessible to SMEs.
Encrypted Mobile Connection
No VPN, no open firewall ports. The device communicates back exclusively over encrypted mobile data.
Equivalent Analysis Quality
Same methodology, same tools, same OSCP-certified experts - just remotely operated.
Penetration Testing Cost: Transparent & Predictable
What does a pentest cost? No hidden fees - a binding fixed-price quote within 24 hours.
Pentest Investment
from EUR 5,400
one-time, fixed price, net
vs.
Average Breach Cost
EUR 4.9M
IBM CODB Report 2024
A pentest costs less than 0.1% of the average security incident - and helps prevent it.
Web Application
from 6,750 EUR
from EUR 8,032.50 incl. VAT
from 5 business days
Network (external)
from 5,400 EUR
from EUR 6,426.00 incl. VAT
from 4 business days
Network (internal)
from 8,100 EUR
from EUR 9,639.00 incl. VAT
from 6 business days
Custom
On Request
Mobile, Cloud, IoT, Red Team
All packages include Management Summary and CVSS ratings.
Pentest Retainer - Plannable, Regular, Cost-Effective
Quarterly tests at reduced rates. Ideal for NIS-2 compliance and continuous security assurance.
View Pentest Pricing
Free pentest configurator - fixed-price quote in under 5 minutes
Legally Sound Penetration Testing
Pentests operate at the intersection of cybersecurity and law. We ensure a solid legal foundation for every engagement.
Legally Authorized
Pentests are authorized as technical and organizational security measures under GDPR Article 32, NIS-2, and applicable national regulations.
Contractually Fixed
Written consent, authorization declarations, and Rules of Engagement - all agreed and documented before testing begins.
NIS-2 & DORA Compliant
NIS-2 and DORA Article 26/27 require penetration testing. Our reports are structured as compliance evidence for regulators and auditors.
Certified Penetration Testing Provider from Germany
Independently audited - at both the organizational and individual tester level.
Organization
AWARE7 GmbH
ISO 27001:2022
Information security - audited annually
ISO 9001:2015
Quality management - standardized processes
BSI Alliance for Cyber Security
Member of Germany's federal cybersecurity alliance
Static IP Addresses
RIPE-registered - 250 Mbit/s synchronous fiber connection
Individuals
Our Pentesters
Offensive Security Certified Professional
OSCP
Offensive Security Web Assessor
OSWA
Offensive Security Wireless Professional
OSWP
All pentesters are full-time employees of AWARE7. No freelancers, no subcontractors. View all certifications
Sample Document
Pentest Report
See how we document vulnerabilities in an anonymized sample report.
01 Management Summary
02 Technical Findings with CVSS
03 Proof-of-Concept & Screenshots
04 Remediation Recommendations & Roadmap
Request Sample Report
See our report quality for yourself - anonymized, with CVSS ratings and remediation recommendations. Free and no obligation.
By submitting you agree to our Privacy Policy. No spam - just the requested report.
Frequently Asked Questions About Penetration Testing
What is a penetration test?
A penetration test (pentest) is an authorized, controlled security assessment in which certified IT security experts simulate the behavior of real-world attackers. The goal is to identify and verify vulnerabilities in IT systems, networks, and applications - before cybercriminals can exploit them. Unlike automated vulnerability scans, manual pentests deliver validated results with zero false positives, realistic attack paths, and prioritized remediation guidance.
What is the AWARE7 Pentest Box?
The AWARE7 Pentest Box is a physical device that we connect to your network on-site one time. After that, our experts conduct the internal penetration test entirely remotely. The device communicates back to us exclusively over encrypted mobile data - no VPN access or firewall changes required on your side. The result is the same depth of internal analysis as a traditional on-site engagement, but without travel and accommodation costs.
How does a pentest differ from a vulnerability scan?
A vulnerability scan is an automated tool that lists known weaknesses - often with 30-70% false positives. A penetration test goes significantly further: our experts manually verify every finding, chain vulnerabilities into attack paths, test for business logic flaws, and discover issues no scanner can detect. You receive verified, reproducible findings with concrete remediation recommendations.
How long does a penetration test take?
Duration depends on scope and complexity. A web application test typically takes 5-10 business days; a comprehensive infrastructure test 10-20 business days. We clarify the exact timeline in a free initial consultation and you receive a fixed-price quote within 24 hours.
Can our systems be damaged during the test?
No. We follow recognized standards (OWASP, PTES, OSSTMM) and coordinate all tests in advance. Destructive tests such as DoS are only conducted in isolated test environments. Before testing in production environments, a current backup is created. Our testers hold ISO 27001 Lead Auditor certifications and adhere to contractually defined Rules of Engagement.
What types of pentests do you offer?
We cover all areas: web applications (OWASP Top 10, API Security), network infrastructure (internal/external, Active Directory), mobile apps (iOS/Android), cloud environments (AWS, Azure, GCP), and IoT/OT systems. Both black-box (no prior knowledge), grey-box (with credentials), and white-box (with source code) testing.
Is a pentest required for NIS-2 compliance?
Yes. The NIS-2 Directive requires "essential" and "important" entities to implement technical security measures to prevent disruptions to availability, integrity, and confidentiality. Penetration tests are explicitly listed as a required security measure. The DORA regulation has also required "threat-led penetration testing" for financial entities since January 17, 2025 (Articles 26 and 27 DORA). Our reports are designed to serve as compliance evidence for auditors and regulators.
What does a penetration test cost?
Costs depend on scope and complexity. A focused web application test starts at approx. EUR 5,000, a comprehensive infrastructure test at approx. EUR 8,000. You receive a binding fixed-price quote within 24 hours - no hourly rates, no hidden costs, no surprises.
How often should a pentest be conducted?
At minimum annually, more frequently for critical systems or after major changes (new releases, infrastructure overhauls, M&A activity). NIS-2-affected organizations should test quarterly. Many of our clients use our retainer model for regular, plannable tests at reduced rates.
What does the pentest report look like?
Our report includes: Management Summary for executives (1-2 pages), detailed technical findings with CVSS score, screenshots, reproducible proof-of-concepts and concrete remediation recommendations, a risk matrix, and a prioritized roadmap. A sample report is available on request.
Is a penetration test legal?
Yes - when conducted professionally. Penetration tests are legally authorized as technical and organizational security measures under GDPR Article 32, NIS-2, and other applicable regulations. Decisive is the contractual framework: before testing begins, we document consent, authorization declarations, and the exact scope in writing. This ensures no criminal liability arises and that our testers act with full authorization.
Do you work with freelancers or subcontractors?
No, as a matter of principle. All pentesters are full-time employees of AWARE7 and are bound by strict confidentiality agreements. No freelancer, no subcontractor has access to your systems or results. Using consistent in-house teams throughout the engagement also reduces legal risk. All data is processed in Germany - on our own infrastructure, not in the cloud.
What is the difference between black-box, grey-box, and white-box pentest?
In a black-box pentest, we simulate an external attacker with no prior knowledge - we receive only the scope (e.g., a domain or IP range). In a grey-box test, we work with limited prior knowledge, such as credentials or architecture documentation. The white-box pentest (also known as code review) is the most comprehensive: we receive full source code access and architecture details. The choice depends on your protection requirements - for maximum coverage, we recommend grey-box as the standard.
What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment uses automated scanners to list known weaknesses - often with 30-70% false positives. A penetration test goes significantly further: our OSCP-certified experts manually verify every vulnerability, chain them into realistic attack paths, and assess the actual business risk. The result: zero false positives, reproducible proof-of-concepts, and concrete remediation guidance with CVSS ratings.
What distinguishes a penetration test from red teaming?
A penetration test has a defined scope (e.g., a web app or network segment) with the goal of finding as many vulnerabilities as possible. Red teaming simulates a real attacker across all vectors - technical, phishing, social engineering, physical access - with the objective of achieving a specific goal (e.g., domain admin or access to customer data). Red teaming primarily tests your detection and response capabilities (blue team), while a pentest maps your technical attack surface.
What standards and methodologies does AWARE7 use?
We follow the BSI Penetration Testing Guidelines, the OWASP Testing Guide (for web applications and APIs), PTES (Penetration Testing Execution Standard), and the MITRE ATT&CK Framework (for red teaming). Our approach follows a 5-phase model: preparation, reconnaissance, analysis and assessment, active exploitation, and post-engagement reporting. All tests are documented according to recognized information security standards and can be used as compliance evidence.
ISO 27001:2022
ISO 9001:2015
BSI Alliance for Cyber Security
OSCP · OSWA · OSWP
100% Germany
Aus dem Blog
Weiterführende Artikel
Offensive Security
Active Directory Red Team: Kerberoasting, Golden Ticket und DCSync
AD-Angriffe aus Pentester-Sicht: Kerberoasting, Golden Ticket, DCSync und BloodHound - mit Schutzmaßnahmen für jeden Angriffsvektor.
Vincent Heinen Weiterlesen
Threat Intelligence
LLM Security: Prompt Injection, Jailbreaking und KI-Red-Teaming
LLM Red Teaming: Prompt Injection, Jailbreaking, Training-Data-Poisoning und OWASP Top 10 for LLM Applications - mit Defense-Strategien.
Jan Hörnemann Weiterlesen
Threat Intelligence
Lateral Movement erkennen und stoppen: Angreifer im Netzwerk abfangen
Lateral Movement erkennen: Pass-the-Hash, Kerberoasting, PsExec und WMI - SIEM-Erkennungsregeln und Präventionsmaßnahmen nach dem Initial Access.
Vincent Heinen Weiterlesen
NIS-2 Implementation Deadline Active
Every week without a pentest is a week
where attackers hold the advantage.
NIS-2 requires affected organizations to conduct penetration testing. Don't wait for an incident - or an auditor.
1
Free Consultation
30 min., no obligation
2
Fixed-Price Quote in 24h
Binding, transparent
3
Pentest Begins
Report + debrief included
Schedule Free Consultation
No risk. No spam. Just a 30-minute call with your penetration testing expert.
