We think likeattackers.So that you aren't the next target.

1. STEP · 01

   Scope & threat model

   Joint threat modeling, concrete objectives, unambiguous rules of engagement. Never a time-and-materials blank cheque.

2. STEP · 02

   Execution

   Two-person team principle, four-eyes review before every escalation. Daily status update to your technical point of contact.

3. STEP · 03

   Reporting & debrief

   Executive summary for leadership, technical report with reproducible proof-of-concepts, live debrief with Q&A.

4. STEP · 04

   Retest & continuous

   Optional retest of closed findings, cleanly documented. On request: ongoing engagements across multiple quarters.

Our experts hold industry-standard certifications and work on real mandates every day:

• OSCP
• CRTO
• CRTL
• GPEN
• GWAPT
• CISSP
• CEH

We sort by what actually drives a test rather than by industry classification: which systems are exposed, who works on them, and which regulation has a say. Five patterns recur across sectors and countries often enough that we raise them during scoping as a matter of course.

1. 01

   Production & OT

   Mechanical engineering, manufacturing, automotive suppliers. Networks grown over decades, where office IT and production were never cleanly separated: scope is decided by segmentation, remote maintenance access and what may be touched while the line is running.

2. 02

   Regulated operators

   Municipal utilities (Stadtwerke), energy suppliers, water and wastewater, hospitals, banks and insurers. Here KRITIS, NIS-2 and DORA prescribe the depth of testing and the form of evidence — which of them applies belongs in the quote, not in the report.

3. 03

   Public sector

   Municipalities, authorities, universities and their IT service providers. Many specialist applications from many vendors, citizen data and narrow maintenance windows: the test follows the interfaces between those applications, not the org chart.

4. 04

   Digital products & SaaS

   Software houses and platform operators whose product is the attack surface. Tenant separation, authentication and API permissions decide the scope; the CRA adds evidence across the entire product lifecycle.

5. 05

   Many sites & supply chain

   Retail, logistics, law firms and anyone with many locations or suppliers on the network. The shortest way in is rarely the web application here — it is an access path somebody else administers.

The list excludes no one: scope follows the attack surface, not the industry classification. If your case is not listed, we place it during the initial call.