Find vulnerabilities
before attackers do.

A vulnerability scan is an automated scan that identifies known weaknesses - fast and cost-effective, but without manual verification. A penetration test goes significantly further: our experts manually review systems, chain vulnerabilities into attack paths and find business logic flaws that no scanner can detect. Red teaming is the most comprehensive variant: we simulate a realistic attack across multiple weeks and vectors (phishing, physical, technical) to test your entire detection and response capability.

This depends on your maturity level. Organisations without prior testing ideally start with a vulnerability scan or the SME Security Assessment. If you already have basic security measures in place, a penetration test is the next step. We recommend red teaming for organisations with an established SOC/SIEM that want to test their detection capabilities under realistic conditions. In a free initial consultation we help you make the right choice.

Our process follows five steps: 1) Scoping workshop to define test scope, test type and rules of engagement. 2) Reconnaissance and automated scans. 3) Manual analysis and exploitation by our pentesters. 4) Documentation of all findings with CVSS score, proof-of-concept and recommendations. 5) Closing presentation with management summary and technical deep-dive. The exact timeline for reporting is agreed individually in the scoping workshop.

No. We work to recognised standards (OWASP, PTES, OSSTMM) and agree all tests in writing in advance. Destructive tests such as DoS are only conducted in isolated environments. A current backup is ensured before any production environment testing. Our testers adhere to contractually defined rules of engagement.

Yes. The NIS-2 Directive requires affected organisations to implement measures to prevent disruptions to availability, integrity and confidentiality. Penetration testing is explicitly listed as a required security measure. The DORA regulation has also required threat-led penetration testing for financial entities since January 2025. Our reports are designed to serve as compliance evidence for auditors and regulators.

Costs depend on scope and complexity. A focused web application test starts from approx. EUR 5,000, a comprehensive infrastructure test from approx. EUR 8,000, red teaming from approx. EUR 15,000. You receive a binding fixed-price quote within 24 hours - no hourly rates, no additional charges.

No. All pentesters are full-time employees of AWARE7 and are bound by strict confidentiality agreements. No freelancer and no subcontractor has access to your systems or results. All data is processed in Germany - on our own infrastructure, not in the cloud.

At minimum annually, more frequently for critical systems or after major changes. NIS-2-affected organisations should test quarterly. Many of our clients use our retainer model for regular, plannable tests at reduced rates. We recommend monthly or continuous vulnerability scanning.