Cybersecurity & Penetration Testing

Manual testing along OWASP, with findings your developers can act on.

We test web applications, APIs and platforms manually along OWASP, and report findings with reproduction steps, evidence and fixes that match the architecture. Our background is in building the same class of systems, which is what the remediation advice is based on.

Two shapes of engagement. A scoped assessment of a defined system, with report and retest. Or security as a standing part of a longer engineering engagement — checks in the pipeline, testing per release cycle, and review of new surface as it is built. The second is where the failure classes actually stop recurring.

Engagement model. Longer engagements, typically 3–12 months, part- or full-time. Remote or on site in the Munich area. German and English. We work inside your team and your repository, with responsibility for an area end to end.

Our Focus Areas in Cybersecurity

  • Web applications and platforms
    Manual testing beyond automated coverage: mutation XSS, HTTP request smuggling, session and token handling, broken authentication and authorisation, insecure direct object references, and logic flaws in multi-step workflows.
  • APIs and backends
    REST and GraphQL endpoints, authorisation boundaries, OAuth flows, rate limiting, and tenant isolation in multi-tenant systems.
  • Platform and infrastructure
    Container and Kubernetes configuration, secrets handling, exposed services, and access paths through the CI/CD pipeline.
  • DevSecOps
    Automated security checks in the pipeline including OWASP ZAP, dependency and secret scanning, access controls and secure API practice. We have introduced these into a live production platform, not only assessed one from outside.
  • Reporting and retesting
    Findings ranked by exploitability and impact, each with reproduction steps, evidence and a concrete remediation; a summary readable without a security background; a walkthrough with your developers; verification once fixes are in.
  • Scope, authorisation and confidentiality
    Scope and authorisation are agreed in writing before testing begins. Findings remain confidential.

Track record

  • P0 vulnerability in a major European SaaS platform
    User sessions compromisable through cross-site scripting — identified by us and reported directly and responsibly to the company’s CTO. Further practical work with mXSS, HTTP request smuggling and platform-level web security.

Standards & tooling: OWASP Top 10 · OWASP ZAP · manual testing · DevSecOps in CI/CD (GitHub Actions, GitLab CI) · OAuth / JWT · dependency & secret scanning · Docker · Kubernetes

Tell us the platform, the stack and the stage.

You get a scope proposal before anything is tested.