Methodology Following recognised standards. Not gut feeling.
Every test follows a documented approach, every finding a traceable rating. That keeps the result comparable – also towards third parties.
What we stick to.
The framework for web applications and APIs.
The OWASP Testing Guide defines which vulnerability classes are systematically tested in web applications – from authentication and session handling to injection vulnerabilities. We don't work through this catalogue rigidly, but weight it according to what actually poses a risk for your specific application.
The common thread through the entire test.
The Penetration Testing Execution Standard describes seven phases from preparation to reporting. It ensures that a test is carried out in a traceable way regardless of which tester performs it – and that nothing is forgotten at the end.
A number instead of an opinion.
The Common Vulnerability Scoring System rates every finding on traceable criteria – exploitability, impact, complexity – and produces a score from 0 to 10. So we don't argue about whether something is "important"; we can prioritise it objectively.
The boundaries are fixed before anything is touched.
Objectives, exclusions, time windows, escalation paths and emergency contacts are set out in writing and signed by both sides before anything is tested. This protects you and us alike and is the legal basis of every test.
From the first conversation to the confirmed fix.
Intro call
30 minutes, free of charge. We clarify what you want to protect and where an attacker would start with you. At the end you get an honest assessment of whether a test is the right next step at all.
Scope & rules
Objectives, boundaries, time windows, emergency contacts and escalation paths are put in writing. Without a signed engagement and Rules of Engagement, no test begins with us.
Execution
The test runs and you follow it in the portal. Anything critical we report immediately rather than at the end – so you can react while we are still working.
Report & re-test
You receive all findings with a CVSS score and concrete measures. Once you have implemented them, we test again. Only when that is confirmed is a finding considered closed.