Vulnerability Scanning

Vulnerability scanning with expert validation.

Automated detection. Manual validation. Zero false positives. Results you can act on immediately.

Request a Scan What we scan

ISO 27001 NIS-2 compliant 100% Germany

Trusted by organisations across industries

70+
new CVEs published daily: 0
false positives: 24h
to fixed-price quote: 100%
data processed in Germany

The Risk

Why organisations need to act now

New vulnerabilities are published every day. Without regular scans, your attack surface grows unnoticed.

No.Key figureSignificance

NIS-2 obligation since 2025

Approximately 30,000 organisations in Germany are affected. Article 21 NIS-2 mandates demonstrable vulnerability detection measures - fines of up to EUR 10 million apply for non-compliance.

70 new CVEs per day

Over 25,000 new vulnerabilities were published in 2025. What was secure yesterday may be exploitable today. Only regular scans keep you current.

USD 4.88M average breach cost

The global average cost of a data breach (IBM Cost of a Data Breach Report 2024). In Germany the figure is even higher at USD 5.31M. Proactive scanning costs a fraction of that.

Our approach

Scanner power + expert validation

Anyone can run a scanner. The difference lies in the interpretation: our certified experts validate every finding, eliminate false positives, and prioritise by real business risk.

Scroll to compare

	DIY Tool	SaaS Scanner	Recommended AWARE7 Managed
Expert validation
False positive rate	30-70%	20-50%	0%
Remediation guidance	Generic	Template	Tailored
Risk prioritisation	CVSS only	CVSS only	CVSS + business risk
Compliance report		Limited
Dedicated point of contact
Data processing	Local	US/Cloud	Germany

Scan areas

What we scan

From a single web application to your entire cloud infrastructure - we assess what you need to protect.

External infrastructure

Internet-facing systems: web servers, mail servers, VPN gateways, cloud resources, DNS configuration, exposed services.

Port scan & service identification
SSL/TLS configuration review
DNS enumeration & subdomain discovery

Internal infrastructure

Active Directory, network segmentation, internal servers and services, patch levels, configuration weaknesses.

AD configuration review
Patch level analysis
Network segmentation check

Web applications

OWASP Top 10, SSL/TLS, security headers, known CMS vulnerabilities, API endpoints, configuration errors.

OWASP-based assessment
Security header analysis
Known CVEs in frameworks

Cloud environments

AWS, Azure, GCP: IAM configuration, storage permissions, network security groups, container images, serverless functions.

IAM & permissions review
Storage misconfigurations
Container image scanning

Pricing

What does a vulnerability scan cost?

Transparent pricing. Fixed-price quote in 24 hours.

One-time Scan

A snapshot of your current security posture.

from 1,500 EUR

Rapid overview of your security posture
Expert validation included
Ideal as a baseline before a pentest
Suitable as compliance evidence for auditors

Request a scan

Recommended

Managed Scanning

Monthly or quarterly in the retainer model.

from 990 EUR/month

New CVEs checked against your systems immediately
Trend analysis and progress measurement
Meets NIS-2 and ISO 27001 requirements
Dedicated contact, priority support

Request managed scanning

All prices excl. VAT. Includes expert validation, management summary, and remediation recommendations.

Combine scan + pentest - save up to 20%

Regular scans as your continuous baseline, complemented by annual pentests. The ideal combination for lasting security.

Request combined pricing

Own research

What we typically find

Real vulnerabilities from our own research - published after coordinated disclosure

Published CVEs from our vulnerability research:

Severity (CVSS)Advisory

7.5 High CVE-2026-25231 - Unauthenticated File Read in FileRise 5.7 Medium CVE-2021-32793 - Stored Cross-Site Scripting in Pi-hole AdminLTE Web Interface 4.6 Medium CVE-2026-25230 - HTML Injection in FileRise File-Tags

All Security Advisories

Sample document

Scan Report

See how we document vulnerabilities - with risk ratings and concrete remediation recommendations.

Report structure

01: Management Summary
02: Validated findings with CVSS ratings
03: Prioritised remediation recommendations
04: Trend analysis (retainer model)

Request a sample scan report

See an anonymised vulnerability scan report showing how we document and prioritise findings - free and without obligation.

By submitting you agree to our Privacy Policy. No spam - only the requested report.

How secure is your infrastructure, really?

Free 30-minute call. Fixed-price quote in 24 hours.

Request a Scan

Free · 30 minutes · No obligation

Methods

Vulnerability scan or penetration test?

Both methods have their place. The question is: which do you need right now?

Vulnerability Scan

Broad coverage across many systems
Fast results (3-5 business days)
Cost-effective for regular monitoring
Ideal for compliance evidence
Identifies known CVEs and misconfigurations

From EUR 1,500 one-time - from EUR 990/month

Penetration Test

In-depth assessment of specific systems
Finds logical flaws and business logic vulnerabilities
Active exploitation of vulnerabilities
Chains vulnerabilities into realistic attack paths
Reproducible proof-of-concepts

From EUR 5,000 - Learn about penetration testing

Our recommendation: Start with a vulnerability scan to establish your baseline. Then plan targeted penetration tests for your most critical systems. In a retainer, we combine both.

Process

How a vulnerability scan works

From scope definition to validated report - in 5 steps.

Scope definition

Together we map your IT landscape: IP ranges, domains, cloud resources. External systems, internal infrastructure, or both?

Day 1

Automated scan

Our enterprise-grade scanners assess your systems for known vulnerabilities (CVE), misconfigurations, outdated software, and exposed services.

Day 1-2

Expert validation

Every finding is manually reviewed by our certified experts. False positives are eliminated. Risks are prioritised by CVSS score and business context.

Day 2-3

Report & recommendations

A clear report with a management summary, technical findings, risk ratings, and prioritised remediation steps.

Day 3-5

Debrief & next steps

In the retainer model: regular repetition with trend analysis. You can see the progress of your security measures over time.

Optional

NIS-2 Obligation

Vulnerability management is no longer optional

Article 21 NIS-2 Directive requires approximately 30,000 organisations in Germany to implement measures for detecting and handling technical vulnerabilities. ISO 27001:2022 (Annex A.8.8) mandates the same. Without documented evidence, fines of up to EUR 10 million or 2% of global annual turnover apply. Directors bear personal liability under NIS-2.

Our scan reports are designed as compliance evidence for NIS-2, ISO 27001, and NIST CSF
Regular scans document due diligence obligations - required evidence in audits and regulatory reviews
Trend reports in the retainer model demonstrate continuous improvement - exactly what auditors expect

Start a compliant scan

Why AWARE7 for your vulnerability scan

What sets us apart from other providers

Pure awareness platforms don't test systems. Pure consulting firms are too far removed. AWARE7 combines both: we hack your infrastructure and train your employees: tailored to mid-sized companies, personal, without enterprise overhead.

No.ValueClaimDetail

20 %

Research and teaching as our foundation

Around 20% of our revenue comes from research projects for the BSI and the BMBF. Our studies, published at ACM and Springer conferences, analyse millions of websites and tens of thousands of phishing emails. Three of our executives are professors at German universities at the same time.

100 %

Digital sovereignty: no compromises

From first contact to final report, your data is stored on our own servers in Germany - no US cloud providers, no third-country transfers. Our AI also runs on our own hardware in Germany - with locally operated open-source models. Client and project data never reach external AI services. All staff are permanently employed, covered by social insurance and bound by uniform legal obligations.

Fixed price within 24h: predictable project timelines

Within 24 hours you receive a binding fixed-price quote without hourly rate risk. A well-practised team and standardised processes ensure a clear schedule with a defined start and end date.

1:1

Your dedicated contact

A personal project manager accompanies you from the first meeting to the final report. You book appointments directly with your contact person and keep the same contact throughout the project.

Peer-reviewed publications

Different Seas, Different Phishes - Large-Scale Analysis of Phishing Simulations

ACM AsiaCCS 2025

Oskar Braun, Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

A Platform for Physiological and Behavioral Security

NSPW 2025

Jan Hörnemann

Privacy from 5 PM to 6 AM: Tracking and Transparency in the HbbTV Ecosystem

IEEE/IFIP DSN 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Understanding Regional Filter Lists: Efficacy and Impact

PoPETS 2025

Jan Hörnemann, Norbert Pohlmann, Matteo Große-Kampmann

Who is AWARE7 the right partner for?

Mid-sized companies with 50-2,000 employees

Companies that need real security, without paying for a DAX-corporation provider. Fixed price, clear scope, one point of contact.

IT managers & CISOs

Who have to argue convincingly in-house and need a report in boardroom language for that, not just technical findings.

Regulated industries

Critical infrastructure, healthcare, financial services: NIS-2, ISO 27001, DORA. We know the requirements and deliver evidence that auditors accept.

References

Client references

These case studies are available in German.

01 Penetration Testing Sill Optics GmbH Read case study (German) 02 Penetration Testing XignSys GmbH Read case study (German)

Security is also social responsibility

AWARE7 is committed beyond day-to-day business: as the founder of a scholarship at Ruhr University Bochum, we support the next generation of cybersecurity professionals. We are a member of the BSI Alliance for Cyber Security and train our own specialists. Our R&D certificate confirms our commitment to cybersecurity research and innovation.

Learn more about AWARE7

Frequently asked questions about vulnerability scanning

What is a vulnerability scan?

A vulnerability scan is a systematic, tool-assisted assessment of your IT systems for known weaknesses. Unlike a penetration test, vulnerabilities are identified but not actively exploited. It is the most efficient way to gain a comprehensive overview of your security posture. At AWARE7, every automated scan is combined with manual expert validation to eliminate false positives and deliver results you can act on immediately.

How does a vulnerability scan differ from a penetration test?

A vulnerability scan identifies known weaknesses (CVEs, misconfigurations, outdated software) using automated tools and is faster and more cost-effective than a pentest. A penetration test goes further: our experts actively exploit vulnerabilities, chain them into attack paths, and find logical flaws that no scanner can detect. The ideal approach is a combination: regular scans as a continuous baseline, complemented by annual pentests for in-depth analysis.

What sets AWARE7 apart from standalone scanning tools?

Pure scanning tools such as Nessus, Qualys, or OpenVAS deliver raw data with 30-70% false positives. At AWARE7, a certified expert (OSCP, T.I.S.P.) manually validates every finding, prioritises by actual business risk, and provides concrete remediation guidance. You receive a report you can act on immediately - not a 200-page CSV file.

How often should a vulnerability scan be conducted?

We recommend scanning at minimum quarterly. For NIS-2-affected organisations and critical infrastructure operators, monthly scanning is standard. Approximately 70 new CVEs are published every day - without regular scans, your attack surface grows unnoticed. In the retainer model, we scan automatically and provide trend analyses that demonstrate the progress of your security measures.

Can both internal and external systems be scanned?

Yes. We offer both external scans (internet-facing systems such as web servers, mail servers, VPN gateways, cloud resources) and internal scans (network infrastructure, Active Directory, internal servers and services). For internal scans we deploy a scan appliance on-site or use your VPN access.

What does a vulnerability scan cost?

One-time scans start from EUR 1,500 for small infrastructures (up to approx. 50 IP addresses). In the retainer model (monthly or quarterly), pricing starts from EUR 990/month including expert validation and trend reporting. We provide an individual fixed-price quote within 24 hours based on your scope.

Will our systems be impacted during the scan?

As a rule, no. Modern vulnerability scanners are designed not to disrupt production systems. We agree the scan window with you in advance and can adjust scan intensity to suit your environment. On request we scan outside business hours. Destructive tests (DoS checks) are only conducted upon explicit authorisation and in isolated test environments.

Is a vulnerability scan required for NIS-2 compliance?

Yes. NIS-2 (Article 21 NIS2 Directive) requires affected organisations to implement measures for risk analysis and the security of information systems. Regular vulnerability scans are the operational foundation of this requirement. ISO 27001:2022 (Annex A.8.8) and DORA also explicitly mandate the management of technical vulnerabilities. Our reports are structured to serve as compliance evidence for auditors.

Which compliance requirements does a vulnerability scan support?

Regular vulnerability scans support compliance with: NIS-2 (Article 21), ISO 27001:2022 (Annex A.8.8 - Management of Technical Vulnerabilities), NIST CSF 2.0 (ID.RA, DE.CM), PCI DSS (Requirement 11.2), DORA (Articles 24-27), TISAX (ISA 5.2.6), and SOC 2 (Availability, Confidentiality). Our reports are structured so they can be submitted directly as evidence in audits.

Is our data processed in Germany?

Yes. All scan data, results, and reports are processed and stored exclusively on our own infrastructure in Germany. No cloud provider, no data centre outside Germany. AWARE7 is itself ISO 27001:2022 certified and subject to German data protection law. Your vulnerability data does not leave Germany.

Getting started