Web application and API
Customer portals, shops and your own browser-based software. Plus APIs, the programming interfaces through which apps and systems exchange data. We test login, permissions, inputs and data flows.
·PENETRATION TESTING · PENTEST
Penetration testing: find the gaps before attackers do
Our experts attack your web applications, networks and cloud environments like real attackers, with your written permission. You see which gaps can really be exploited and what to fix first. From Frankfurt, across Germany.
·WHAT IS A PENETRATION TEST
A controlled attack with your permission
A penetration test, or pentest for short, is a commissioned attack on your IT. The testers look for vulnerabilities, meaning flaws in software, settings or access rights, and demonstrate which of them can actually be exploited. They cause no damage and stay within the scope agreed in writing.
- 01
Evidence instead of assumptions
A scan reports what might be vulnerable. A pentest shows what can really be exploited and how far an attacker would get with it.
- 02
Attack paths in context
Several small gaps often add up to a route to critical data. The test makes this route visible, from first access to the target.
- 03
A report for technical teams and management
Every finding with severity, evidence and a remediation recommendation, plus a summary for management.
·TYPES
What we can test
The scope follows where your risk lies. We often combine several types in one engagement.
External infrastructure
Everything reachable from the internet: servers, remote access, mail systems and firewalls. The view of an attacker who has no access yet.
Internal network and Active Directory
What happens once an attacker is inside the company network, for example via a device with malware. Active Directory is Microsoft's directory service that manages accounts and permissions. This is often where it is decided whether an attacker gains administrator rights.
Cloud environment
Accounts, roles, shares and settings in AWS, Azure or European clouds. A single wrongly set share can expose data to the internet.
Source code and in-house software
For critical in-house software we test with insight into source code and architecture. This also uncovers gaps that are hard to see from the outside.
Phishing simulation
The human factor as a separate service: realistic, harmless test emails to your staff, with a short lesson for everyone who clicks. If there is a works council, we agree the campaign with it beforehand.
·TESTING DEPTH
Black box, grey box or white box, depending on the goal
The three terms describe how much the testers know about your systems before the test. More knowledge brings more depth in the same time, less knowledge mirrors an outside attacker more closely.
- 01
Black box
No prior knowledge, only the publicly visible attack surface. Suits the outside view of the perimeter and web applications.
- 02
Grey box
Partial knowledge such as a test account or a network diagram. For most companies the cost-effective starting point, for example for applications with login and internal networks.
- 03
White box
Full insight into source code, architecture and access. The greatest depth, useful for critical in-house software and mandatory audits.
·PROCESS
Five steps from scope to retest
Every step is documented so the test stays traceable for auditors and management.
- 01
Define the scope
Agree target systems, testing depth and goals of the test together
- 02
Written authorisation
Sign off target systems, permitted test types, time windows and emergency contact
- 03
Controlled test
Reconnaissance, analysis and exploitation of gaps without causing damage
- 04
Report with risk rating
Findings sorted by severity, with evidence and recommendation, presented in a meeting
- 05
Retest
After remediation we check whether the measures really work
Start: scope agreed in writingResult: report and verified remediation
Without written authorisation, access to third-party systems is a criminal offence (in Germany §§ 202a to 202c of the Criminal Code). If systems belong to a hosting or cloud provider, we obtain their consent together with you.
·STANDARDS AND REGULATIONS
Following recognised guides, usable for audits
We align our tests with public guides. They describe approach and test items, they are not a certification.
- 01
OWASP
The Open Worldwide Application Security Project publishes the Web Security Testing Guide and the Top 10 lists of the most common gaps in web applications and APIs.
- 02
PTES
The Penetration Testing Execution Standard describes the phases of a pentest, from agreeing the scope to the report.
- 03
BSI practical guide
Germany's Federal Office for Information Security (BSI) describes in its practical guide for IS penetration tests how a test is planned, carried out and documented.
The reports serve as evidence under regulations. NIS 2 requires essential and important entities to have procedures to assess the effectiveness of their measures (in Germany § 30(2) no. 6 BSIG). In an ISMS under ISO/IEC 27001:2022, pentests support the controls on management of technical vulnerabilities (Annex A 8.8) and on security testing in development and acceptance (Annex A 8.29), provided they are in your Statement of Applicability. An ISMS (information security management system) is a fixed set of roles, rules and processes with which a company manages its information risks.
Certified ourselves, pentests included GermanAI Defense has been certified to ISO/IEC 27001:2022 since May 2026, audited by the accredited certification body A-Mark Ratings Limited (certificate no. 26052601, valid until 25 May 2029). Penetration testing is part of the certification scope. Read the Information Security Policy →
As of 26 October 2026. Legal basis: German BSI Act as amended by the NIS 2 Implementation Act, German Criminal Code. Standard: ISO/IEC 27001:2022.
·BETWEEN TWO TESTS
RedMentis complements the pentest, it does not replace it
A pentest is a snapshot. Our pentest platform RedMentis makes security checks repeatable and shows attack paths in context. Today we use RedMentis in pilot operation with selected customers, as a service delivered by GAD.
Classic pentest
Experts test your systems in a targeted and in-depth way, with report and retest. The anchor for evidence towards auditors.
Repeated test runs
With RedMentis our team checks again within the agreed scope whether a closed path stays closed. Every test run only starts after your written approval.
Questions about penetration testing? Answers
How much does a penetration test cost?
The price depends on the number and type of systems, the testing depth (black box, grey box or white box), the time window for the test and whether a retest is included. You tell us what should be tested and receive a concrete quote.
How long does a penetration test take?
That depends on the scope. A single web application is tested faster than a whole company network with cloud components. On top of the testing time come the scoping beforehand and the report afterwards. We set the schedule together with the quote.
How does a penetration test differ from a vulnerability scan?
A scan lists known weaknesses automatically. A penetration test goes further: we demonstrate in a controlled way which weaknesses can be exploited and show how far an attacker would get from first access to critical systems. The result is a report with technical findings and a summary for management.
What do black box, grey box and white box mean?
The terms describe how much the testers know in advance. In a black box test they only know what an outside attacker can see. In a grey box test they receive partial knowledge, such as a test account or a network diagram. In a white box test source code, architecture and access are open, which gives the greatest depth.
Is a penetration test mandatory under NIS 2?
The law does not name the pentest literally. Essential and important entities do, however, need procedures to assess the effectiveness of their measures (in Germany § 30(2) no. 6 BSIG). A pentest is the usual evidence for this. Whether your company falls under NIS 2 is something we clarify in our NIS 2 consulting.
How often should a penetration test be carried out?
Before new systems go live, after major changes and at fixed intervals that you set in your security concept. Some regulations set deadlines: in Germany, operators of critical facilities prove to the BSI every three years that their measures are effective (§ 39 BSIG). For the time between two tests, RedMentis offers repeatable checks.
Is a penetration test legal?
Yes, with written authorisation from the client. It defines target systems, permitted test types, time windows and an emergency contact. Without this authorisation, access to third-party systems is a criminal offence (in Germany §§ 202a to 202c of the Criminal Code). If systems belong to a hosting or cloud provider, their consent is often needed as well.
What is in the pentest report?
A summary for management and, for each finding, the technical description, the severity, the steps to reproduce it and a recommendation for remediation. We rate severity, for example, using CVSS, a scale from 0 to 10 for how severe a vulnerability is. We present the report to you and discuss it.