Vendor-independent
About Rootsektor IT-Security
For businesses in Germany and internationally
Rootsektor IT-Security is a team of penetration testers, security researchers, and awareness specialists. We test IT systems, applications, and processes using the methods of real attackers – and turn the results into measures that management and technical teams understand equally well.
- Certified penetration testers and security researchers with many years of experience
- Independent of vendors and service providers – for an objective analysis
- Reports for management and technical teams with concrete recommendations for action
- For penetration tests and security assessments: a fixed price after scoping, a free retest, and a test certificate to present to customers, partners, insurers, and auditors
- From scoping to fixed-price quote (business days)
- 24 h
- For pentests and security assessments – no extra charges
- Fixed price
- Free of charge for remediated vulnerabilities
- Retest
Who we are
IT security through an attacker’s eyes
Rootsektor IT-Security GmbH is an IT security company headquartered in Arnsberg, Germany, and your specialist for penetration testing and vendor-independent security consulting. We work for organizations in Germany and abroad, testing IT systems, applications, and processes for security-relevant vulnerabilities – with security scans, manual attack simulations, source code analysis, and forensic investigations. Our work is as diverse as the threats organizations face today.
Many organizations know the situation well: digitalization speeds up processes, shortens response times, and makes offerings accessible to more customers. But every new web application, every API, and every additional cloud service also gives attackers new points of attack. In day-to-day project work, security can quickly slip out of focus – at young companies just as much as at established IT firms.
A penetration test provides clarity. Our testers think and act like attackers but work more thoroughly: an attacker needs only one gap – we look for as many as possible and document them in a traceable way. Recognized standards such as the OWASP Web Security Testing Guide, PTES, or the penetration testing guide of the BSI (Germany’s Federal Office for Information Security) give every project a clear structure; our hands-on experience adds the necessary creativity.
We are independent of vendors and service providers. Our recommendations are based on your risk, not on product portfolios. Where a solution from our partners Greenbone or Rapid7 makes sense, we say so – and where it doesn’t, we say that too.
Because a test result only helps if it is put into practice, we document for management and technical teams alike: leadership receives an easy-to-understand assessment of the risks, and your IT team receives solid facts and concrete recommendations for action. If you wish, we also help you integrate security testing efficiently into your IT processes and meet regulatory requirements pragmatically.
Network
Participant in the Alliance for Cyber Security
Rootsektor is a participant in the Alliance for Cyber Security (Allianz für Cyber-Sicherheit), an initiative of Germany’s Federal Office for Information Security (BSI). The initiative promotes exchange between business and government on cybersecurity issues and provides its participants with information resources from the BSI. We use this professional exchange and the BSI’s information to keep track of current developments.
Working together
How we work with you
Transparent steps, clear costs, and a dedicated point of contact at Rootsektor who accompanies you from the first conversation to the confirmed result.
-
01
Initial consultation & scoping
We clarify goals, systems, the testing approach, and any constraints – without obligation and, if you wish, after signing a non-disclosure agreement (NDA).
-
02
Fixed-price quote
For penetration tests and security assessments, you receive a fixed-price quote with a clearly defined scope within 24 hours of scoping (on business days) – with no hidden costs. Incident response & forensics services and dark web monitoring are quoted individually.
-
03
Testing
We test according to agreed rules and recognized standards, complemented by our hands-on experience. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.
-
04
Report & test certificate
You receive a report with an executive summary, a technical section, and prioritized measures, plus your test certificate. If you wish, we present the results in a final debrief.
-
05
Retest & improvement
Once you have fixed the findings, we retest the affected vulnerabilities free of charge. If you wish, we help you build security testing into your IT processes on a permanent basis.
Who we report for
One report, three audiences
A penetration test affects more than the IT department. Our report is structured so that each audience quickly finds what it needs.
Management
Assess risks, set priorities
The executive summary answers the key questions without jargon: How secure are we, what is at stake, and where should we invest first?
- Overall assessment of the security posture
- Prioritized areas for action
- Basis for budget and project decisions
Technical teams
Understand and fix findings
The technical section gives your team everything it needs for remediation – from the affected component to the concrete recommendation.
- Evidence and reproduction steps
- Risk rating based on CVSS
- Concrete remediation recommendations
Compliance
Provide proof of testing
The report and test certificate document that your systems have been tested – a solid basis for audits, customer inquiries, and conversations with insurers.
- Test certificate after the test is completed
- Supporting evidence for frameworks such as ISO/IEC 27001, NIS2, DORA, or TISAX
- Free retest to confirm remediation
Get to know us
Tell us what you would like to secure. In a no-obligation initial consultation, we clarify your goals and propose the right scope – for penetration tests and security assessments, the fixed-price quote follows within 24 hours of scoping (on business days).
FAQ
Frequently asked questions about Rootsektor IT-Security
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Where is Rootsektor based, and where do you work?
We are based in Arnsberg, Germany, and work for organizations in Germany and internationally. Many tests – of web applications, APIs, or cloud environments, for example – can be performed remotely. We carry out internal network and Active Directory tests either on-site or remotely, via VPN or a provided test system. For wireless assessments or physical social engineering tests, we come to your site.
Who performs the tests at Rootsektor?
Our tests are performed by certified penetration testers and security researchers with many years of experience in IT security, penetration testing, and social engineering. We rely on manual testing using the methods of real attackers; we use automated tools as a complement, not as a replacement.
How does vendor independence fit with your partnerships with Greenbone and Rapid7?
For us, independence means that our analysis and our recommendations are based on your risk, not on a vendor’s interests. Our partnerships with Greenbone and Rapid7 complement our services where continuous vulnerability management, exposure management, or threat detection makes sense. Whether one of these solutions is right for you is a recommendation – not a prerequisite for working with us.
Which standards do you follow?
We follow publicly recognized methodologies: the OWASP Web Security Testing Guide and ASVS for web applications, OWASP MASVS and MASTG for mobile apps, and PTES, OSSTMM, NIST SP 800-115, and the BSI’s penetration testing guide (Durchführungskonzept für Penetrationstests) as overarching process models. For attack simulations, MITRE ATT&CK serves as our frame of reference. We rate vulnerabilities using CVSS.
Does Rootsektor offer more than penetration testing?
Yes. Our security services include vulnerability assessments, red teaming, Active Directory assessments, cloud reviews for Microsoft 365, Azure, and AWS, OSINT assessments, code reviews, and dark web monitoring, among others. With phishing simulations, awareness campaigns, and training, we also strengthen the human factor. When an incident strikes, our Incident Response & Forensics practice supports you – from digital forensics to ransomware emergency response, remotely and on-site. You’ll find a complete overview under Services.
Talk to our team
Rootsektor IT-Security GmbH, Lottenweg 11, 59757 Arnsberg, Germany. You can reach us by phone at +49 2932 465265-0 or by email at info@rootsektor.de – or simply use the form.