Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyPenetration Testing
Security you can prove.
Penetration testing shows how an attacker would break into your systems – and what they could reach once inside. Our certified penetration testers assess web applications, APIs, networks, cloud environments, and industrial plants using the methods of real attackers – for companies in Germany and internationally.
Definition
A penetration test – pentest for short – is an authorized, simulated cyberattack on your IT systems, applications, or processes. Experienced IT security consultants use the methods, tools, and knowledge of real attackers to try to reach critical parts of your environment – in a controlled, documented way and within clearly agreed boundaries.
That makes a pentest fundamentally different from a simple vulnerability scan. It requires coordination, preparation, planning of test procedures and objectives, and a deliberate choice of tools. Scanners report known patterns; we verify whether a finding can actually be exploited and how several minor weaknesses chain together into a real attack path. After all, an attacker needs only one gap – a penetration tester has to try to find them all.
The challenge: Digitalization creates new points of attack. Every online shop, every interface, and every remote access point expands your attack surface, and in day-to-day project work, security quickly falls by the wayside – at young companies and established IT firms alike. At the same time, industrial and economic espionage is more pervasive than ever. If you want your know-how protected as a trade secret, the GeschGehG (German Trade Secrets Act) requires you to take reasonable confidentiality measures – and effective IT security is part of that.
The solution: A penetration test gives you back a clear picture. We assess the security posture of your systems in a transparent process, follow recognized standards such as the penetration testing guideline of the BSI (Germany’s Federal Office for Information Security), PTES, OSSTMM, and the OWASP Testing Guide, and prioritize every finding by risk. You receive concrete recommendations and documentation you can use as evidence in audits and for requirements under the GDPR, ISO/IEC 27001, NIS2, DORA, TISAX, or PCI DSS 4.0.1.
As a pentest provider, we work for companies in Germany and abroad. Many tests can be performed remotely; internal network and Active Directory tests take place either on site or remotely via VPN or a provided test system. For wireless, OT, or physical tests, we come to your premises.
Our pentest services
Every environment has its own attack paths. Choose the right test – or let us advise you on which combination fits your goal.
Online shops, portals, and online banking tested manually against OWASP Top 10 and ASVS.
REST, GraphQL, SOAP, and gRPC – tested for BOLA, authentication flaws, and logic errors.
Testing iOS and Android apps and their backend API against OWASP MASVS and MASTG.
Perimeter, VPN, Active Directory, and segmentation – tested externally and internally.
WPA2/WPA3, 802.1X, guest Wi-Fi, and rogue access points – tested on site.
AWS, Azure, and Google Cloud – testing identities, storage, containers, and attack paths.
Testing chatbots, RAG systems, and AI agents for prompt injection and data leakage.
Safely testing controllers, industrial protocols, IT/OT segmentation, and IoT devices.
Phishing, vishing, and physical access tests show how well your team spots manipulation.
Why Rootsektor
Our penetration testers and security researchers are certified, bring many years of hands-on experience, and are actively involved in the security community. That’s how we know current attack techniques firsthand.
We are independent of vendors and service providers. That enables an objective analysis of your security posture – we find and document your weak points and show you solutions that fit your environment.
Our documentation is prepared for both management and technical staff – clear for senior management, with hard facts for your specialist team, and with concrete recommendations instead of generic advice.
A fixed-price quote within 24 hours of scoping, a free retest of fixed vulnerabilities, and a test certificate for customers, partners, insurers, and auditors.
Process
Transparent from your first question to the test certificate – with a dedicated point of contact at Rootsektor who supports your project from start to finish.
We talk with you personally about your security needs, goals, and the reason for the test – such as an audit requirement, a product launch, or a specific suspicion. There’s no obligation on your part.
Together, we define the test targets, testing perspective, and depth of testing. Within 24 hours (on business days), you receive a fixed-price quote with no hidden costs.
We formally agree on objectives, schedule, attack targets, off-limits areas, scope, and contacts. The contract, a written authorization, and a non-disclosure agreement provide the legal basis.
Our IT security consultants carry out the agreed tests manually and with professional tools. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.
We document every vulnerability we find clearly and reproducibly, rate it using CVSS, and derive concrete measures. On request, we present the results in a debrief meeting and work out solutions with you.
Once you’ve fixed the vulnerabilities, we check the fixes free of charge. With the test certificate, you can prove to customers, partners, insurers, and auditors that the test was carried out.
IT security is an ongoing task. On request, we train your team on specific security topics and support your security strategy with further tests.
Testing perspectives
How much we know about your systems before the test determines how realistic and how deep it is. We’ll advise you on which perspective fits your goal.
No prior knowledge
We start like an external attacker – with nothing more than your company name, a URL, or an IP range. This realistically shows what is visible and vulnerable from the outside.
Partial knowledge
We receive test accounts, network diagrams, or documentation and test with the privileges of regular user accounts – just as a malicious insider or an attacker with stolen credentials would.
Full insight
We know the architecture, the configuration, and – on request – the source code. This enables the most thorough assessment – ideal for critical systems and before go-live.
Reporting
A penetration test is only as good as its report. Our documentation speaks to both management and technical staff: the executive summary puts the results into context for senior management, while the technical section gives your specialist team hard facts. Every finding is backed by traceable evidence, rated using CVSS, and paired with a concrete remediation recommendation.
Find out before an attacker does. Tell us about your goals – after scoping, you’ll receive a fixed-price quote within 24 hours.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
The cost depends on the scope – for example, the number of applications, user roles, or IP addresses, the testing perspective, and the depth of testing you need. That’s why we clarify the scope first in a short scoping session. You then receive a binding fixed-price quote within 24 hours (on business days) – with no hidden costs and no additional charges for the agreed scope.
A clearly defined test – of a single web application or API, for example – is often completed within a few days. Extensive infrastructure, cloud, or APT tests take correspondingly longer. We set the exact schedule, including testing windows, together with you at the kickoff.
As a rule of thumb: at least once a year and after every significant change, such as major releases, a cloud migration, new interfaces, or changes to your network. Some frameworks specify intervals: PCI DSS 4.0.1 requires penetration tests at least every twelve months and after significant changes, and DORA requires at least annual testing of the ICT systems that support critical or important functions. If you deploy frequently, it’s best to build security testing into your release process.
There is no general legal obligation to conduct pentests in Germany. However, many frameworks require organizations to regularly review the effectiveness of their security measures – for example, Art. 32 GDPR, the NIS2 requirements, or ISO/IEC 27001. DORA, which has applied since January 17, 2025, requires financial entities to maintain a digital operational resilience testing program that may include penetration tests; selected entities must also carry out threat-led penetration testing (TLPT). The card payment standard PCI DSS 4.0.1 explicitly requires pentests.
Yes – provided the party responsible for the systems has given its written consent beforehand. Without this authorization, testing activities can be a criminal offense, for example under Section 202a of the German Criminal Code (StGB, data espionage) or Section 303b StGB (computer sabotage). That’s why we document the scope, time frame, and off-limits areas in writing before every test and, for hosted systems, take the rules of the hosting or cloud provider into account. For the exchange of sensitive information, we sign a non-disclosure agreement – before scoping, if you wish.
A vulnerability scan – for example, using solutions from our partner Greenbone – checks broadly and automatically for known vulnerabilities and is well suited to regular monitoring. A penetration test goes deep: it verifies vulnerabilities manually, exploits them in a controlled manner, and shows what the consequences of an attack would be. Red teaming, or an APT test, simulates a targeted attacker from initial access through lateral movement to data exfiltration – and also tests whether your detection and response work.
Active testing always carries some residual risk – careful planning keeps it as low as possible. We perform load or denial-of-service tests only if explicitly agreed, and we test critical systems in agreed time windows or in a staging environment. Contacts and escalation paths in case of a disruption are defined together before testing begins.
Yes. We work for companies in Germany and internationally. We usually test web applications, APIs, cloud environments, and externally accessible systems remotely. We assess internal networks and Active Directory either on site or remotely – via VPN or a provided test system. For wireless, OT, and physical tests, we come to you.
Whether you have a specific testing assignment or are looking for initial guidance, briefly tell us about your project. We’ll define the scope together and send you a fixed-price quote within 24 hours of scoping.
Diese Seite gibt es auch auf Deutsch.