Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyAttack. Defend. Investigate.
From security assessments and prevention to 24/7 incident response: we help businesses identify cyber risks early, fend off attacks, and limit the damage – in Germany and internationally.
How we can helpWe attack your web applications, networks, cloud environments, and APIs in a controlled way – with penetration testing, red teaming, and targeted assessments such as an Active Directory or OSINT assessment. This shows you which vulnerabilities are actually exploitable and what to fix first.
Test your attack surfaceVulnerability management, cloud reviews for Microsoft 365, Azure, and AWS, security awareness, and dark web monitoring: we help you harden your systems for the long term, raise your team’s awareness, and detect data leaks early – not just on audit day.
Explore Security ServicesDealing with an acute security incident? We help remotely and on-site to contain the attack, secure evidence, and restore your systems cleanly – outside business hours via our 24/7 emergency hotline. With incident response plans and exercises, we also prepare you for a real emergency.
Get help when it mattersWhy Rootsektor?
Digitalization makes organizations faster – and expands their attack surface at the same time. Every online service, every interface, and every cloud connection creates entry points that are easily overlooked in day-to-day project work. We give you a clear picture of where these entry points are and how to close them.
We are not tied to any vendor or service provider. That allows for an objective analysis of your security posture – with no product interests in the background. Our certified penetration testers and security researchers bring many years of experience in penetration testing, social engineering, and awareness training.
Our documentation speaks to management and technical teams alike: leadership gets a clear assessment of the risks, and your IT team gets solid facts for remediation. That turns findings into concrete measures – not reports that just gather dust.
Report & test certificate
A penetration test is only as valuable as its report. That’s why we document every vulnerability with evidence, a CVSS risk rating, and a concrete remediation recommendation. The executive summary puts the results into context for leadership, the technical section gives your team every detail – and, if you wish, we present everything in a final debrief.
After the test is completed, you also receive a test certificate. It allows you to show customers, partners, insurers, and auditors that your systems have been tested – without handing over the full report. Our Glossary explains technical terms from the report in plain language.
Process
Four clear steps – from the first conversation to confirmed remediation. A dedicated point of contact at Rootsektor accompanies your project, and you always know what happens next and what costs to expect.
Together we clarify goals, systems, the testing approach (black, gray, or white box), and possible time windows. The result is a scope that fits your risk and your budget.
Within 24 hours of scoping (on business days), you receive a fixed-price quote with a clearly defined scope and methodology. No hidden costs, no extra charges for the agreed scope.
We test within the agreed time frame according to jointly defined rules, following standards such as OWASP, PTES, and the BSI’s penetration testing guide (Durchführungskonzept für Penetrationstests). We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.
You receive the report and test certificate and fix the findings based on our recommendations. We then retest the remediated vulnerabilities free of charge and confirm which gaps have been closed.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
A vulnerability scan is an automated check: a tool looks for known vulnerabilities and returns a list of potential issues – false positives included. A penetration test starts where the scan stops. Our testers manually verify whether a vulnerability can really be exploited, chain individual weaknesses into attack paths, and show what an attacker could achieve with them. Flaws in authorization concepts or in an application’s business logic, on the other hand, usually remain hidden from a scanner.
That depends on what you want to protect and where your biggest risks lie – in web applications and APIs, in the internal network, in the cloud, or with the human factor. In a no-obligation scoping call, we clarify goals, systems, and the testing approach and propose a suitable scope. If you mainly want to know whether your detection and response work, a red teaming engagement may be the better choice.
The price depends on the effort – and the effort depends on the scope: the number and complexity of systems, the testing approach (black, gray, or white box), the number of user roles, the desired depth of testing, and any special requirements for testing windows. Flat rates quoted without scoping are therefore not very meaningful. After scoping, you receive a fixed-price quote within 24 hours (on business days) – with no hidden costs and no extra charges for the agreed scope.
A single web application with a few user roles can be tested much faster than a corporate network with multiple sites or a multi-stage red teaming engagement, which can extend over several weeks. That’s why we already discuss the likely duration of your test during scoping. We schedule the testing period to fit around releases, maintenance windows, and your day-to-day business.
We work with agreed rules (rules of engagement), defined testing periods, and clear communication channels. Particularly sensitive systems can be tested in test environments, during off-peak hours, or with less intrusive methods – we decide this together. A residual risk can never be ruled out completely with active testing; that’s why we discuss it openly with you beforehand.
An annual penetration test has proven effective, supplemented by tests after major changes – for example, before a new application goes live, after a cloud migration, or after a network redesign. Frameworks such as PCI DSS 4.0.1 or DORA prescribe fixed testing intervals in some cases, and your customers may also require regular proof. Between two penetration tests, a regular vulnerability assessment helps you detect new vulnerabilities early.
You receive a report with an executive summary, a technical section, and prioritized remediation recommendations; every vulnerability is documented with evidence and a CVSS rating. You also receive a test certificate that you can present to customers, partners, insurers, or auditors. If you wish, we present the results in a final debrief, and after remediation, we retest the vulnerabilities free of charge.
Yes, of course. During a penetration test, we gain insight into architecture, credentials, and vulnerabilities – we treat this information as strictly confidential. If you wish, we will sign a non-disclosure agreement (NDA) before scoping – using your own template if you prefer.
Tell us briefly what you would like to test. For penetration tests and security assessments, you receive a fixed-price quote within 24 hours of scoping (on business days) – including a free retest and a test certificate.
Whether you have a specific project or just need some initial guidance: call us at +49 2932 465265-0 (Mon–Fri, 8:00 a.m.–5:00 p.m. CET/CEST), email info@rootsektor.de, or use the form. The initial consultation is, of course, without obligation. In the event of an acute security incident, you can reach us outside business hours at the same number via our 24/7 emergency hotline – or use the Report an Emergency page. You’ll also find all contact options on our Contact page.
Diese Seite gibt es auch auf Deutsch.