A look at proposals from different penetration testing providers shows a pattern for the pentest retest: it appears as a separate line item in the quote, gets charged as a flat full day or even at the full effort of the initial test, gets billed per finding, or disappears entirely on request. As a result, it is routinely negotiated away. My take: the retest should always be included in the price of a penetration test. The short version up front: the effort sits in the initial…
Ever since LLMs and AI agents have been able to run tools on their own and interpret their own results, a narrative has emerged in the market that I keep encountering more and more in customer conversations – and above all on LinkedIn: autonomous AI pentesters . Systems that are…
Anyone searching for penetration testing in the cybersecurity market usually encounters two extremes: IT system integrators selling standardized, automated vulnerability scans as genuine "pentests," or massive consulting firms where client contact is handled entirely by…
In our projects with medical device manufacturers, the topic of IT security has increasingly moved into focus in recent years. Many manufacturers face the challenge that Notified Bodies require concrete evidence of information security as part of the conformity assessment.
For 13 years now, I’ve been running a pentesting company. I’ve seen this market from the ground up—starting back then with binsec – binary security UG (haftungsbeschränkt) all the way to today’s binsec group GmbH . In over a decade on the front lines, you see pretty much…
In many current requests for proposals (RFPs) and tenders for penetration tests, explicit reference is made to "the BSI standard" or "the NIST standard." At first glance, this suggests methodical maturity and clear quality requirements. In my view, however, this trend is not…
As part of the ISO 27001 certification process, auditors are increasingly asking to see a penetration test report. But where does this requirement come from if the word pentest or penetration test does not exist in the text of ISO 27001?
We’ve seen this moment before.
OWASP ZAP is one of the most well-known tools in web pentesting. Sooner or later, most people come across it. In trainings, labs, or early hands-on experience, it is often one of the first tools used.
In application security, two references appear particularly often: the OWASP Top 10 and the CWE Top 25 Most Dangerous Software Weaknesses . Both lists are frequently mentioned in security guidelines, training materials, and penetration testing reports and aim to highlight common…
