Two specialisations, one goal
Network Pentesting
We thoroughly test your internal and external network for vulnerabilities in infrastructure, firewalls, services and configurations. Black-box, grey-box and white-box assessments are all possible.
- External network scan
- Internal network segmentation
- Firewall & ACL review
- Service and version analysis
- Privilege escalation tests
- Lateral movement
Web Application Pentesting
From public websites to internal portals and APIs: we systematically test your web applications based on the OWASP Top 10 and applicable security standards.
- OWASP Top 10 testing
- Authentication & session management
- API security testing
- Business logic vulnerabilities
- Input validation & injection
- Access control & authorisation
Structured from A to Z
Scoping & preparation
Together we determine objectives, define the scope and establish the rules of engagement. Transparency is our baseline.
Reconnaissance & scanning
We passively and actively explore the target: open source intelligence, port scans, service identification.
Exploitation & validation
Vulnerabilities are demonstrated — not just reported. We validate the actual impact and risk level.
Reporting
You receive a detailed report with an executive summary for management and technical findings for your IT team.
Debriefing
We explain the results to both technical and non-technical audiences. Not a monologue — a conversation.
Remediation follow-up
We are available during the remediation process and perform a retest after completion for critical findings.
Standards used
Clear report, understandable for everyone
After the test you receive a professional PDF report with two sections: an executive summary for management and detailed technical findings for your IT team.
- Risk score per finding (CVSSv3)
- Proof-of-concept for each vulnerability
- Concrete remediation recommendations
- Executive summary for management
- Retest included for critical items
NetGuard
Pentesting Report — Example
Executive Summary
Critical
High
Medium
Low
During the test, 19 vulnerabilities were identified. 2 critical findings require immediate action. Full remediation guidance and retest included.
Technical findings
The login endpoint accepts unsanitised user input that is directly processed in an SQL query. An attacker can gain full access to the database.
Impact
Full data theft, authentication bypass.
Remediation
Use prepared statements and parameterized queries.
The admin panel is accessible without an active session. Only the direct URL path suffices to access management functions.
Impact
Unauthorised access to user data and settings.
Remediation
Mandatory server-side session validation on all admin routes.
+ 16 more findings in the full report