Penetration tests that go deeper.

The price of a penetration test depends on the scope, which is why snapSEC publishes no fixed prices or public price list. What matters is the number and type of systems, their complexity, for example web applications with many roles, and whether we test internally, externally or both. After the first call you receive a quote for exactly that scope. For projects our terms provide for 35% to be invoiced when the order is placed and the rest after acceptance.

The duration depends on the scope and is agreed together during scoping. A single web portal is tested faster than an Active Directory spanning several sites with a cloud connection. You know the test window before we start, as well as the dates for the report and workshop. Tests outside normal working hours, Monday to Friday 07:00 to 17:00, are possible by arrangement.

A vulnerability scan checks automatically for known vulnerabilities. A penetration test goes further: testers attack defined systems manually and so also find logic flaws and chained attack paths. Red teaming pursues an agreed goal like a real attacker, combines technical and human attack paths and tests whether your detection and response work. For continuous scanning and recurring tests there is blacklens.io.

As a rule, no: we plan the test so that your operations carry on as normal. That is why we agree before we start which systems are tested in which window, who can be reached on both sides and which systems need particular care. Tests on sensitive systems can take place outside business hours by arrangement. If we notice anything unusual during the test, we coordinate directly with your contacts.

We need a named contact, a clear definition of the targets and the agreed test window. Depending on the scope, that could be IP ranges, domains or URLs, suitable test accounts for authenticated testing and network access for internal tests. We clarify exactly what is needed during scoping. That keeps your effort manageable and lets the test start without delay.

You receive a report with technical findings, a clear risk rating and specific recommendations for every finding. In the follow-up workshop we go through the results with your team, answer questions and discuss the hardening measures. So you know not only what was found, but also in which order to tackle it.

A one-off pentest examines your systems in depth at a fixed point in time, ongoing testing keeps the same targets in view over time, and the two complement each other. A project pentest suits occasions such as go-live or an audit. If you want the same targets tested regularly, blacklens.io, the platform of snapSEC GmbH, offers penetration testing as a service (PTaaS) with retests right in the platform. For a continuous outside view of your attack surface it offers attack surface management.

The tests are carried out by experienced penetration testers of snapSEC GmbH. Our team brings more than 20 years of experience in IT security and combines manual testing with tools and its own scripting. Under our terms we may bring in highly qualified specialists from other companies for individual assignments. You can ask for details of the person, their qualifications and the extent of their work at any time.