Penetration Testing
We find the security vulnerabilities in your systems before attackers exploit them. Penetration tests for web, API, network, cloud and Active Directory – based on BSI, OWASP and PTES, carried out manually instead of scanned automatically, documented in a NIS2-compliant manner.
Why a Penetration Test from NovaCon
Solid results through manual exploitation, recognized methodology and audit-ready documentation for your compliance management
Genuine Attacker Perspective
We think like an attacker and uncover vulnerabilities before criminals do. Manual exploitation instead of pure scanner output delivers solid, exploitable results rather than false positives.
NIS2- & GDPR-Compliant
Penetration tests are a central proof of risk management under NIS2 (Art. 21) and the state of the art under Art. 32 GDPR. Our report serves as auditable evidence for auditors and supervisory authorities.
Tested by hand, not clicked through
Your test is carried out personally by the owner – following the internationally established BSI, OWASP Testing Guide and PTES methodologies. You get manual exploitation and a report written by a human, not an automated mass test.
Clear Prioritization
Every finding is rated with a CVSS score and prioritized according to real business risk. This way you know exactly which vulnerability to fix first and which one can wait.
Audit-Ready Report
You receive a two-part report: a management summary for the leadership team and detailed technical reproduction steps including proof-of-concept for your development and IT team.
Re-Test Included
After the vulnerabilities have been fixed, we check in a free re-test which findings have been effectively closed. We document the result in a traceable way — as evidence for audits and compliance records.
Our Pentest Services at a Glance
From the web application to Active Directory – we test every attack surface of your IT landscape
Web Application Pentest
Comprehensive testing of your web applications based on OWASP Top 10 and OWASP ASVS: SQL injection, XSS, CSRF, broken access control, insecure deserialization and business logic flaws.
API Pentest
Testing of REST, GraphQL and SOAP interfaces based on OWASP API Security Top 10: Broken Object Level Authorization (BOLA), mass assignment, missing rate limits and authentication gaps.
Network & Infrastructure
External and internal network tests: port scans, service enumeration, exploitation of unpatched systems, weak configurations and segmentation review of your internal networks.
Cloud Security Assessment
Configuration review of Azure, AWS and Microsoft 365: open storage buckets, over-privileged IAM roles, insecure security groups and flawed identity and access management.
Active Directory Pentest
Attack simulation against your AD: Kerberoasting, AS-REP roasting, pass-the-hash, privilege escalation and exploitation of misconfigurations up to domain admin compromise.
Black / White / Grey Box
You choose the approach: Black Box (without prior knowledge, like an external attacker), White Box (with source code and documentation, maximum depth) or Grey Box (with test access, best cost-benefit ratio).
Methodology Based on BSI, OWASP & PTES
A structured approach along recognized standards: BSI implementation concept, OWASP Testing Guide (WSTG) and PTES – from reconnaissance through exploitation to reporting, documented in a traceable way.
Social Engineering & Phishing
Optional testing of the human factor: controlled phishing campaigns and OSINT analyses reveal how resilient your employees and processes are against targeted attacks.
Related Services
Matching services that complement your project
Frequently asked questions
The questions we are asked most often before a project – with answers on process, costs and data protection.
How much does a penetration test cost?
The cost of a penetration test depends on the scope and complexity of the target system. A focused web or API pentest for SMEs usually starts in the low four-figure range, while extensive tests of networks, cloud environments or Active Directory are higher. Price drivers are the number of assets, the required test depth (black/white/grey box) and the chosen standard. After a free scoping call, we prepare a transparent fixed-price offer including report and re-test.
What is the difference between black box, white box and grey box?
In a black-box test, the tester has no prior knowledge and acts like an external attacker – realistic but time-consuming. In a white-box test, the tester gets full access to source code, documentation and architecture, enabling the highest test depth. The grey-box approach is a compromise: the tester receives test credentials and basic information, offering the best cost-benefit ratio for most SMEs.
Do SMEs need a penetration test because of NIS2?
NIS2 requires, in Article 21, appropriate technical and organizational risk-management measures, including regular assessments of the effectiveness of security measures. Penetration tests are a recognized and proven means for this. Even though NIS2 does not literally prescribe a pentest, it is considered state of the art and an auditable proof towards auditors and supervisory authorities – effectively indispensable for affected entities.
What methodology does NovaCon use for penetration tests?
We work along internationally recognized standards: the BSI implementation concept for penetration tests, the OWASP Web Security Testing Guide (WSTG) as well as the OWASP API Security Top 10 for interfaces and the Penetration Testing Execution Standard (PTES). The approach is divided into scoping, reconnaissance, vulnerability analysis, manual exploitation, post-exploitation and reporting – every step is documented transparently.
Who carries out the penetration test?
NovaCon is owner-operated: the test is carried out personally by Alen Nukovic – no rotating team, no junior in the background, no ticket queue. The work follows established standards manually: the BSI penetration testing framework, the OWASP WSTG and PTES. Automated scanners are used for preparation only; the actual exploitation is done by hand. You know in advance who is testing – and the same person walks you through the report afterwards.
What does the final report look like?
You receive a two-part report, documented in an auditable form and suitable for submission to auditors. The management summary is aimed at executives and clearly summarizes the risk situation, overall assessment and recommended actions. The technical part contains every vulnerability found, with CVSS score, proof-of-concept, exact reproduction steps and concrete remediation recommendations for your IT and developer team. After remediation, we verify the results in an included re-test.
Ready for the next step?
Let's discuss in a free initial consultation how we can move your business forward.