Skip to content

The only hacker you invite in.

We break in, with your written permission, so criminals can’t. Manual penetration tests for web apps, APIs, mobile apps, cloud, networks, Active Directory and IoT. Fixed price, audit-ready report, free retest.

See my fixed price

Prefer to talk first? Book a call

  • Manual pentests from €1,900

Founding clients: +1 test day free · 4 of 5 left Get my fixed price See prices

Vulnerabilities reported to

  • SCHUFA
  • Adobe
  • Infomaniak
  • DANA Indonesia
  • Zabbix
  • Icinga
  • Pi-hole
  • Jenkins
  • Prometheus
  • BMW
  • Doctolib

Critical vulnerabilities found, responsibly reported, fixed.

At a glance

Mr Cyber is a Germany-based penetration testing consultancy. We find vulnerabilities in applications and infrastructure before attackers do, and deliver audit-ready reports for NIS2, ISO 27001 and SOC 2.

Who
Mr Cyber, a Germany-based security consultancy specialising in penetration testing.
What
13 manual core tests in three areas: Applications, Network & cloud and Attack & code. Also tested: Microsoft 365, Kubernetes, Wireless, OT/ICS and more. Plus continuous pentesting, the vulnerability assessment (not a pentest) and the AI-assisted pentest as separate options.
For whom
Startups and mid-sized companies in Germany, Austria, Switzerland and the EU. Businesses only.
Price
Manual pentests at a fixed price from €1,900, depending on scope, retest included. Continuous pentesting: €590 per month. AI-assisted pentest: €590 one-time or €390 per month, per target.
Payment
Invoice after the report, payable within 14 days. No deposits.
Location
Remote by default. On-site on request, travel billed at cost.
Timeline
You pick the start date yourself in the quote calendar, from the next free day. Report within 5 business days after testing ends.
Standards
OWASP WSTG, OWASP API Top 10, OWASP MASVS/MASTG, PTES, BSI guidance, CVSS 3.1.
Evidence for
NIS2, ISO 27001, SOC 2, TISAX, PCI DSS, BSI IT-Grundschutz and customer security reviews.

Penetration tests for everything attackers can reach. Every test led by hand.

Separate options

Straight to the tester. You talk to the person who tests your system.

At large consultancies a partner sells the project and rotating teams do the testing. At Mr Cyber the same person handles your project from your request to the retest.

See my fixed price
The person you brief also tests, writes the report and checks your fixes.

  • Direct access to the tester

    Your questions go to the person who found the issue, and they answer them. Nothing gets lost between sales and testing.

  • Manual, not a scanner

    No scanner finds broken business logic, privilege escalation or tenant isolation flaws. That’s where the critical findings are.

  • Start when you want

    Pick your start date right in the calendar, from the next free day, in time for audit deadlines and release plans.

  • Fixed price, agreed upfront

    You know the cost before we start. Retesting fixed findings is included.

Someone will test your security. Better it’s us.

Attackers scan around the clock for exactly the weaknesses a penetration test finds. The only question is who finds them first. According to IBM, a data breach costs German companies €4.25 million on average, more than 1,000 times the price of a pentest from €1,900.

119

new vulnerabilities in IT systems became known per day on average, around 24% more than in the previous period.

Germany, 1 July 2024 to 30 June 2025. Source: BSI State of IT Security 2025, p. 3.

  • €289.2 bn

    damage to the German economy from theft, espionage and sabotage, around 70% of it caused by cyberattacks.

    Bitkom 2025

  • 87%

    of surveyed German companies were hit in the past 12 months, or suspect they were.

    Bitkom 2025

  • ~80%

    of reported attacks, for example with ransomware, targeted small and medium-sized companies.

    BSI State of IT Security 2025, p. 3

  • 29,500

    entities in Germany are estimated to fall under NIS2 and must prove their security measures work.

    BSI, NIS-2

Annual figures from public reports.

Source: Bitkom, “Wirtschaftsschutz 2025” study (1,002 companies surveyed) · BSI, “The State of IT Security in Germany 2025” (PDF, p. 3) · BSI: NIS-2 regulated entities

NIS2 has applied in Germany since 6 December 2025.

The German NIS2 implementation act requires in-scope companies to take risk-management measures and to assess whether they are effective. A penetration test is exactly that evidence for management, auditors and the BSI.

See my NIS2 fixed price NIS2 penetration testing explained

From quote to passed retest.

  1. Day 0

    Quote

    Your binding fixed price appears instantly in the price calculator, valid for 30 days for the scope you entered; the written offer (PDF) with NDA, DPA and testing authorisation is sent by email right after your request. Want to talk it through first? A free call is always possible.

  2. Before testing

    Kickoff & authorisation

    NDA, signed scope and rules of engagement, test accounts, contacts for emergencies. Nothing is touched before this is signed.

  3. From 2 test days

    Testing

    Manual, expert-led testing against the agreed scope. Critical findings are reported to you immediately, not at the end.

  4. +5 business days

    Report & debrief

    Audit-ready report within 5 business days, with an executive summary, CVSS 3.1 ratings and fix guidance. Walk-through call with your team.

  5. Within 60 days

    Free retest

    Once you have fixed the findings, we retest them free of charge within 60 days and confirm in an updated report.

See my fixed price

Prefer to talk first? Book a call

Attackers don’t send a report. We do.

Every finding is reproducible, rated with CVSS 3.1 (4.0 on request) and comes with a concrete fix. The executive summary answers management’s question: how big is the risk, and what do we do now?

  • One-page executive summary
  • Findings with reproduction, evidence and fix
  • CVSS 3.1 ratings and prioritisation
  • Mapped to OWASP, CWE and compliance controls
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
  • Retest confirmation and attestation letter for your auditor
See my fixed price See the report

Client portal with triage, status per finding and one-click ticket creationIn development

Pentest report · Admin & Söhne GmbH · MC-2026-014
Risk: High CVSS 3.1 · 8.2 Open · retest included

Admin area reachable without login

app.admin-soehne.example · /admin

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Description

The administration area at /admin opens without asking for a password. Anyone who types the address sees the full customer list with names, addresses and order history, and can change a few settings such as the shop’s opening notice.

Steps to reproduce

  1. Open a private browser window, without logging in.
  2. Go to https://app.admin-soehne.example/admin.
  3. The admin dashboard loads, showing all customers and edit buttons.
GET /admin HTTP/2
Host: app.admin-soehne.example

HTTP/2 200
<title>Admin Dashboard</title> …

Business impact

Anyone on the internet can read all customer data, with no account and no special skill. That is a GDPR data breach that must be reported within 72 hours, plus a letter to every customer. Search engines or automated scanners can find this kind of page within days.

Remediation

Protect the whole /admin area with a mandatory login on the server, and require two-factor authentication for admins. Better still, make the admin area reachable only from the company network or VPN. Add an automated test that checks every admin page refuses access without login.

OWASP Top 10 2021: A01 Broken Access Control · CWE-306 (Missing Authentication for Critical Function)

Built for your auditors. Proof you can pass on.

Five documents from one engagement: the report for your team, the letter for everyone who asks.

  • Pentest report · findings with evidence, fix and CVSS 3.1
  • Management summary · the risk picture on one page
  • Retest confirmation · fixed findings tested again, at no charge
  • Ticket import file (CSV, JSON and email) · one ticket per finding
  • Attestation letter · one page for auditors, customers and insurers
See the report

From the field

All posts

Frequently asked questions

How much does a penetration test cost?
Our fixed prices start at €1,900 for an external network pentest; a web application pentest starts at €2,900. The exact price depends on scope. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request. See pricing.
How long does a pentest take?
Depending on the service, our manual pentests start at 2 to 10 test days; larger scopes take longer. The report follows within 5 business days of testing ending; critical findings are reported immediately.
What do we get at the end?
A report with an executive summary, findings with reproduction and fix, and CVSS ratings. Plus a ticket import file (CSV, JSON and email): every finding becomes its own ticket, ready to import into Jira, ServiceNow, GitLab, Azure DevOps and GitHub. Helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 receive them by email import. After you fix, a retest confirms it, and you get a one-page attestation letter for auditors and customers. See the report.
Will testing disrupt our production systems?
Test windows, intensity and forbidden actions are agreed upfront in the rules of engagement. Destructive tests only happen with explicit approval; we can also test against staging.
Are we too small for a pentest?
No. Startups in particular need pentest reports to win enterprise customers, satisfy investors or pass ISO 27001 / SOC 2 audits. We scope the test so the budget goes where the risk is highest.
We already run a vulnerability scanner. Isn’t that enough?
A scanner finds known technical issues. A penetration test also finds logic flaws, missing authorisation checks and chained attacks, which is what attackers actually exploit. The two complement each other.
How is our data handled?
NDA, DPA and testing authorisation come with the offer. Test data and results are stored encrypted on our servers in Germany, only ever sent encrypted, and deleted 30 days after the project closes.
Is penetration testing legal?
Yes, with your written authorisation defining targets, timeframe and methods. This authorisation is standard and protects both sides. We never test without it.

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call