Web application & API
Authentication, authorization, business logic and injection, per OWASP WSTG and API Top 10.
KEEL ASSESS
Find it before attackers do.
Manual penetration testing and red teaming by certified testers. Every finding reproducible, every fix retested for free.
- OSCP · OSCE³ · CRTO
- CREST [placeholder]
- Free retest
- Fixed price
01 / SCOPING CONFIGURATOR
A ballpark in 60 seconds.
BALLPARK ESTIMATE · FIXED PRICE AFTER SCOPING
€13,500 – €17,000
- 2 web apps / APIs8 d
- 32 external IPs1.5 d
- Kickoff, report, debrief1.5 d
Excl. VAT. Includes report, debrief and one free retest within 90 days. Illustrative rates.
02 / TEST TYPES
From one web app to a full red team.
External & internal network
Perimeter exposure, Active Directory attack paths and segmentation checks.
Cloud configuration
IAM, storage, networking and CI/CD review for AWS, Azure and GCP.
OT / ICS
Passive-first testing of production networks, coordinated with your plant engineers.
Social engineering
Phishing, vishing and physical access tests, agreed with works council and legal.
Red teaming
Goal-based, multi-week adversary simulation against your detection and response.
03 / METHODOLOGY
OWASP and PTES, done by hand.
-
01
Scoping
Targets, rules of engagement, test windows and emergency contacts in writing.
-
02
Reconnaissance
Mapping the attack surface as an attacker would see it.
-
03
Testing
Manual exploitation, supported by tooling, never replaced by it.
-
04
Critical findings
Reported the same day by phone, not at the end.
-
05
Report & debrief
Executive summary plus technical detail. Walkthrough with your team.
-
06
Free retest
Within 90 days, with an updated report for your auditor.
04 / FROM A SAMPLE REPORT
23 findings. Ranked, reproducible, fixable.
Web application test, 8 tester days. Every finding has CVSS 4.0 scoring, a proof of concept and a concrete fix.
Download redacted sample report
Critical1
High4
Medium9
Low6
Info3
05 / TESTERS
Fourteen testers. No scanners-as-a-service.
All employed in Germany, background-checked and bound by NDA. You meet your lead tester in the kickoff.
- OSCP
- 14
- OSCE³ / OSEP
- 6
- CRTO
- 5
- GICSP (OT)
- 3
Illustrative · 2026-09