Basics What actually is a pentest?
This page explains without jargon what we do, how it works and which terms you will come across. If you still have questions afterwards, it wasn't good enough – then give us a call.
- In one sentenceWe attack your systems or your building on your behalf and show you how far someone would get.
- The difference from the real thingYou know about it, it is agreed in writing, we destroy nothing and return everything.
- What you get out of itA documented list of what needs fixing – sorted by urgency, not alphabetically.
Better us than someone else.
A break-in attempt with your signature
Imagine you hire someone to break into your own house. Not to take anything, but to show you afterwards how they got in.
That is exactly what a penetration test, usually just called a pentest, is. We try to get in with the same means as someone with bad intentions – except that we sign a contract beforehand, damage nothing and explain every step to you at the end.
The decisive difference from consulting: we don't tell you what could theoretically happen. We do it and show you the photo or the log.
Why a list isn't enough
There are programs that automatically search for known vulnerabilities. They are useful, but they don't answer the question you actually have.
Such a program reports, for example, "This software is outdated". Whether that can be exploited in your specific environment, it doesn't know. Often these are false alarms, and sometimes the really dangerous gap isn't listed at all because it only arises from a combination of several small things.
A human tries it out. They chain three harmless details into a path no program finds – because each detail is inconspicuous on its own.
Black box, grey box, white box.
You will come across these three terms in every quote. They sound technical, but they describe only one thing: how much we get from you beforehand.
Black box
You only give us your address. Nothing else.
We start like a stranger standing in front of your building for the first time. Everything we want to know we have to find out ourselves.
It seems the most realistic – but it has a catch: a real attacker has unlimited time for this search. You pay for it. A considerable part of the budget therefore goes on searching rather than finding.
Makes sense if you want to know how much someone without any prior knowledge can find out about you.
Grey box
You give us a visitor's badge.
We get a perfectly normal account – the kind a new employee would have on their first day or a customer in your portal.
This tests the question that usually matters in an emergency: what can someone do who is already inside? Because that is exactly where an attacker stands after a successful phishing email.
Makes sense if you want the best ratio of effort to insight. This is the most common case.
White box
You put the blueprint on the table.
We get full insight: architecture, access and, for software, the source code too. Nothing has to be guessed.
In the same time we find the most here, because no hour is spent searching. If you want to know what is really open, choose this option – even if it feels less like a film.
Makes sense if you want to find as many vulnerabilities as possible per euro spent.
A common misconception: black box is not "the better test". It is the more expensive route to the same goal. That is why we usually recommend grey box – and say so when something else fits better.
The words you will come across.
These terms appear in every quote and every report – ours included. Here they are once without jargon, so that you don't have to ask in a meeting if you'd rather not.
Vulnerability
A flaw or an unfavourable setting that makes something possible that shouldn't be possible. Not every vulnerability is dangerous – what matters is what someone can actually do with it.
Exploit
The ready-made tool used to exploit a known vulnerability. For common gaps such tools are freely available for download. That is why "nobody can do that" is rarely a good argument.
Patch
An update that closes a gap. The unpleasant part: as soon as a patch is released, the gap is publicly known. Between publication and installation lies the window in which automated searches take place.
Zero-day
A gap for which there is no patch yet because the manufacturer doesn't know about it. Sounds threatening, but for most businesses it is the smaller problem – attacks far more often use gaps for which an update has been available for months.
Social engineering
Attacks aimed not at technology but at people: a credible pretext, a little time pressure, a request that sounds plausible. No firewall helps against this, because formally nothing is bypassed – someone opens the door voluntarily.
Ransomware
Malware that encrypts your files and demands money for decryption. Usually anything interesting is copied first so that the attackers can also threaten to publish it. A working backup takes the sting out of the first threat, but not the second.
Backup
A copy of your data that is stored separately and can be restored to an earlier point in time. A permanently connected hard drive or a mirrored cloud folder doesn't meet this – both get encrypted too.
Two-factor authentication
A second proof in addition to the password: a confirmation on your phone, a numeric code, a security key. The single most effective measure of all, because a stolen password on its own becomes worthless.
Encryption
Data is stored or transmitted in such a way that it is unreadable without the right key. The difference matters: an encrypted hard drive protects you if the device is stolen – against someone who logs in normally, it doesn't protect at all.
Scope
The agreed test scope: which systems, buildings and methods are included and which explicitly are not. The scope protects both sides – you from nasty surprises, us from the accusation of having tested something that wasn't commissioned.
Finding
A single result from a test: what was found, how serious it is, what evidence supports it and what helps against it. A report is nothing more than the organised collection of all findings.
Re-test
The follow-up check after you have fixed something. Without it, it remains unclear whether the measure really worked. With us, a finding is only closed once the re-test has confirmed it.
What to expect, step by step.
From the first question to the moment the gap is demonstrably closed.
Conversation
Free, 30 minutes. You tell us what you want to protect. We say whether a test makes sense and which one – if need be, also that none is needed right now.
Quote
Exactly what is tested, how long it takes, what it costs. No open items, no surprises after the test.
Ground rules
Put in writing: what is allowed, what remains off limits, when testing takes place, whom we call if something serious turns up. Only once that is signed do we start.
Test
We work. You see live in the portal what we find. We report anything critical immediately by phone – not only in the report.
Report
Two parts: a summary for management without jargon and a technical part for your IT. Every finding with evidence and rating.
Follow-up check
Once you have fixed things, we check again. Only when that is confirmed is a finding considered done. Without this step a report remains a piece of paper.
The questions before the first commission.
Normally not. Tests that could risk an outage are explicitly agreed with you beforehand and only carried out after approval. We still always recommend checking a backup beforehand – not because of us, but because that should be done regularly anyway.
Possibly, because that is precisely the question: can someone get at this data? We only look at it as far as necessary for the evidence, copy nothing out and delete everything no later than 14 days after the project ends.
You decide. If they know, things run more smoothly. If they don't, you also see whether your monitoring raises an alarm at all. At least one person on your side must be reachable, though.
A manageable test two to three days, a larger one one to two weeks. Preparation and reporting come on top. We state the exact framework in the quote, not only in the invoice.
That depends on the scope, which is why there are no list prices here. After the free intro call you get a concrete amount – not an hourly budget that grows along the way.
Once a year is a good rhythm, plus after major changes. In between, a small passive check is often enough, because the attack surface visible from outside changes constantly.
We hear that a lot, and it is almost never true. Most attacks don't pick a target, they find it automatically – your size plays no role, only your reachability. What changes for small businesses is the scope: instead of a multi-week engagement, a single day covering the three things that really matter is often enough. If a test doesn't make sense for you right now, we'll say so in the intro call.
Then you find out immediately, not at the end. For a critical finding we call – and if we see signs that someone else has been or is in your systems, we stop the test and switch to emergency mode. A running test then takes second place.
Yes, the report belongs to you. For passing it on to third parties we recommend the summary rather than the technical part – it proves that a test was carried out and what the status is, without handing over a manual. On request we issue a short confirmation of the test carried out.
Where you can look now.
What we encounter in assessments, before you encounter it.
Not a product newsletter. We write about attack paths that actually worked against Austrian businesses, authorities and schools – and what helps against them.
- About once a month, not every week
- Concrete attack paths from real assessments
- No tracking pixel, no sharing with advertisers
- Unsubscribe with one click in every email