Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencySecurity Services
Know your vulnerabilities. Reduce your risk.
A penetration test shows where you are vulnerable today. Our security services go further: we scrutinize identities and cloud environments, simulate realistic attacks, train your team, and monitor the dark web – so your security posture isn’t just checked once but improves measurably.
Overview
Our security services cover everything Rootsektor does to test and strengthen your IT security beyond the classic penetration test. We examine IT systems, applications, and processes for security-relevant vulnerabilities – with vulnerability assessments, configuration reviews, realistic attack simulations, code analysis, awareness programs, and dark web monitoring. The services fall into two areas: Assessments & Red Teaming look at your environment from an attacker’s perspective, while Prevention & Monitoring keep your security posture stable day to day.
Each of these services answers a different question: Which known vulnerabilities are open in our network? How far would an attacker get with a single compromised user account? Is our Microsoft 365 tenant configured securely? Would our team notice a targeted attack? And are our employees’ credentials showing up on the dark web?
Our work is as varied as the threats. Our aim is to integrate security testing efficiently into your IT operations instead of delivering a report that disappears into a drawer. At the same time, the results help you meet regulatory requirements pragmatically: Art. 32 of the GDPR calls for a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures; the EU NIS2 Directive requires policies and procedures to assess the effectiveness of risk-management measures; and ISO/IEC 27001:2022 provides for a structured approach to managing technical vulnerabilities.
We are independent of vendors and service providers. You receive an objective assessment, documentation for both management and technical teams, and concrete recommendations. For penetration tests and security assessments, you get a fixed price after scoping, a free retest, and a final test certificate. We offer dark web monitoring on an individual basis – tailored to your search profile.
Dealing with an active security incident? We bundle emergency help – from immediate IT emergency response to digital forensics and malware analysis – in our Incident Response & Forensics practice. You can reach us Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST) at +49 2932 465265-0; outside business hours, the same number is our 24/7 emergency hotline.
Offensive Security
Attack simulations and assessments from an attacker’s perspective – for everything a single penetration test doesn’t cover.
Targeted attack simulation that tests detection and response under real-world conditions.
Uncover attack paths, risky permissions, and misconfigurations in AD and Entra ID.
What attackers can learn about you publicly – from data leaks to forgotten subdomains.
Analyze source code, binaries, apps, and firmware for security vulnerabilities.
Defensive Security
Manage vulnerabilities, harden systems, train people, and spot leaks early. For help with an active incident, see Incident Response & Forensics.
Find, verify, and prioritize known vulnerabilities in your network and systems.
Check Entra ID, Conditional Access, Exchange Online, and Azure for misconfigurations.
Review IAM, S3, networks, and logging in AWS accounts against CIS and Well-Architected.
Phishing simulations and training that make your team measurably more secure.
Spot leaked credentials, customer data, and internal company data on the dark web early.
Why Rootsektor
Our assessments are carried out by certified experts in penetration testing and security research – with many years of experience in IT security, social engineering, and awareness training. Through our active involvement in the security community, we know current attack techniques firsthand.
We are independent of vendors and service providers. That allows us to assess your security posture objectively and recommend measures that fit your environment – not a product catalog.
Our reports are written for both management and technical teams: easy to understand for senior leadership, with hard facts and evidence for your IT team.
For penetration tests and security assessments, you receive a fixed-price quote with no hidden costs within 24 hours of scoping (on business days); we retest fixed vulnerabilities free of charge, and you receive a test certificate on completion.
Process
Whether it’s a vulnerability assessment, an Active Directory review, or red teaming – our security assessments follow a clear, transparent process with a dedicated contact at Rootsektor and named contacts on your side.
In a no-obligation conversation, we clarify your goals, your environment, and the reason for the engagement – such as preparing for NIS2, an upcoming audit, or a specific suspicion. If you wish, we sign a non-disclosure agreement beforehand.
Together, we define the scope, method, time window, and contacts. That way, both sides know exactly what will be tested – and what won’t.
Within 24 hours of scoping (on business days), you receive a fixed-price quote – with no hidden costs and no additional charges for the agreed scope.
Our work is guided by recognized standards such as the penetration testing guideline “Durchführungskonzept für Penetrationstests” published by the BSI (Germany’s Federal Office for Information Security), NIST SP 800-115, OWASP, and MITRE ATT&CK. We report critical vulnerabilities immediately – during the assessment, by phone or email to the agreed contact.
You receive an executive summary, a technical section with all findings, and concrete remediation recommendations. If you wish, we go through the results together with your team.
Once the issues are fixed, we retest the vulnerabilities free of charge. Finally, you receive a test certificate to present to customers, partners, insurers, and auditors.
Use cases
Our security services map to three goals. Many organizations start with an assessment and add simulations and monitoring later.
Analyze
You want to know where your systems, identities, and cloud services stand today – and which gaps you should close first.
Simulate
You have invested in protective measures and want to know whether technology, processes, and people can withstand a real attack.
Monitor
You want to spot data leaks early and have your own software tested thoroughly. For emergencies, our Incident Response & Forensics practice is there to support you.
Reporting
A report is only as valuable as the actions that follow from it. That’s why we document every service so that senior management can put risks into context and your IT team can start implementing right away. We back up technical findings with traceable evidence and rate them using CVSS.
Tell us about your goals and your environment – we’ll suggest the right scope. For penetration tests and security assessments, you receive a fixed-price quote within 24 hours of scoping (on business days).
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
A penetration test manually attacks a clearly defined target – such as a web application or a network segment – and uncovers exploitable vulnerabilities. Security services broaden that view: they let us analyze entire environments such as Active Directory or Microsoft 365, simulate complete attacks across all layers, train your team, or monitor the dark web. The two approaches go hand in hand, and many projects combine them. For an overview of all types of testing, see Penetration Testing.
That depends on your goal and your security maturity. If you need an overview for the first time, a vulnerability assessment or an Active Directory assessment is usually the best place to start. Organizations with established protective measures and their own monitoring benefit particularly from red teaming. In the initial consultation, we recommend the most sensible starting point – with no obligation.
Yes – and that’s often especially efficient. An OSINT assessment, for example, lays the groundwork for realistic phishing simulations, and a vulnerability assessment shows where an in-depth penetration test is worthwhile. If you combine penetration tests and security assessments, we bundle them into a single fixed-price quote.
Yes. Among other things, NIS2 requires vulnerability management and procedures for assessing the effectiveness of security measures, ISO/IEC 27001:2022 requires the structured management of technical vulnerabilities, and DORA (the EU Digital Operational Resilience Act) obliges financial entities to maintain a program for testing their digital operational resilience. Our reports and test certificates document your measures in a traceable way – for auditors, for example.
For penetration tests and security assessments, you receive a fixed-price quote within 24 hours of scoping (on business days). The price depends on scope and complexity – for example, on the number of systems, locations, domains, or user accounts. For the agreed scope, there are no hidden costs and no additional charges, and the retest of fixed vulnerabilities is free of charge. For dark web monitoring, we prepare an individual quote based on the search profile, scope, and duration.
Confidentiality is the foundation of our work. We treat information, credentials, and results as strictly confidential and use them exclusively for your project. If you wish, we sign a non-disclosure agreement before scoping – including on the basis of your own template.
Yes. We work for companies and organizations in Germany and internationally. We perform internal assessments such as the Active Directory assessment either on site or remotely – via VPN or a provided test system. Physical tests as part of a red teaming engagement take place on site.
If you wish, we walk through the results with your team in a debrief meeting and answer questions about remediation. For penetration tests and security assessments, we then check fixed vulnerabilities again in a free retest; finally, you receive a test certificate that you can present to customers, partners, insurers, or auditors.
Whether you have a specific request or need initial guidance: tell us which systems you want to have tested and which requirements you need to meet. Together, we’ll define the scope, and after scoping, we’ll send you a fixed-price quote within 24 hours (on business days) – or an individual quote for dark web monitoring.
Diese Seite gibt es auch auf Deutsch.