An audit with a fixed date
You need current test evidence; we plan backwards from the date.
Security Assessments & Penetration Testing
Get evidence of how well your IT withstands an attack.
You learn how far an attacker would get in your environment, with a report for the board, your IT and auditors. We test Entra ID, Microsoft 365, Azure and Active Directory and map each finding to NIS2, ISO 27001 and BSI IT-Grundschutz.
Example of a finding with high priority: an attack path from a phishing email via the identity and the device to confidential data. The evidence is reproducibly documented and mapped to NIS2, ISO 27001 and BSI IT-Grundschutz. After remediation the path ends at the identity, confirmed by the re-test.
- For
- Companies with 50 or more employees on Microsoft 365
- Scope
- Microsoft 365 and Entra ID, optionally Azure and Active Directory
- Approach
- Only with written authorisation; critical findings reported at once
- Result
- Report with management summary and control mapping, optional re-test
- Price
- from €5,900 excl. VAT, fixed price after scoping
Sound familiar?
A customer asks for a test report
Supplier assessments ask for a recent pentest with scope and method.
Doubts about “everything is green”
Your IT reports that all is fine but cannot prove it.
Attack path, example
How far would an attacker get?
A pentest looks for paths, not isolated gaps. Every step along the way becomes a finding with a priority. Switch the view to see where the path ends after remediation.
-
1 Phishing email
A spoofed sender reaches the mailbox DMARC and protection policies apply
Priority medium Fixed
-
2 Identity
Password and SMS code are enough to sign in Phishing-resistant MFA is mandatory
Priority critical Path ends here
-
3 Device
Sign-in works from unknown devices Access only from compliant devices
Priority high Not reachable
-
4 Admin rights
Permanent admin role on the account Time-limited admin roles via PIM
Priority high Not reachable
-
Confidential data
Readable with the rights obtained No access via this path
Reached Not reachable
In the report
The path with evidence, each step a finding with a priority, mapped to NIS2, ISO 27001 and BSI IT-Grundschutz. We report critical findings at once. The re-test confirms that the path ends at the identity. The report proves it to auditors, customers and insurers.
White-box or grey-box, depending on the goal. Tests in the Microsoft cloud follow the Microsoft Cloud Rules of Engagement.
From our webinar
MFA umgangen: 3 Angriffe auf Microsoft 365 mit Evilginx
Recording in German.
Using a test tenant, the recording shows three attacks that take over a sign-in despite multi-factor authentication, and what stops them: phishing-resistant sign-in, mailbox auditing and controlled app consent. It shows the effect without giving step-by-step attack instructions.
Moving to passkeys with Conditional AccessWhat we test
Entra ID
MFA strength, Conditional Access, PIM, app consent and paths from user to admin.
Email and sharing
Defender for Office 365, SPF, DKIM, DMARC, sharing and mailbox auditing.
Azure
RBAC, internet-facing services, segmentation and logging.
Active Directory
Tiering, service accounts, delegations, certificate services and Entra Connect.
Phishing resilience
Optional, scoped in writing; results are evaluated per control, without naming individuals.
How does a penetration test work?
-
In writing
Scope and approval
No test starts without your written authorisation.
-
Test window
Time frame, contacts and stop criteria are fixed in advance.
-
Immediate notice
We report critical findings at once, before the final report.
-
Report
Risk rating, reproduction evidence and mapping per finding.
-
Workshop and re-test
Agree remediation with your IT, optionally confirm it by re-test.
Is an audit or customer request coming up?
We clarify the occasion, scope and whether a Gap Assessment or a pentest fits.
What you receive after the test
Management summary
The overall picture in plain language for decision makers.
Prioritised findings
With risk rating, evidence and remediation direction.
Control mapping
NIS2, ISO 27001 and BSI IT-Grundschutz for your evidence trail.
Test report for third parties
For auditors, customers and insurers; test accounts are removed.
Frequently asked questions
What is the difference between a security assessment and a penetration test?
An assessment such as our Gap Assessment compares your configuration with baselines. A penetration test checks whether an attacker can exploit and chain weaknesses.
How long does a penetration test for Microsoft 365 and Entra ID take?
It depends on scope, for example whether Azure and Active Directory are included. After the introductory call we give you a binding schedule.
Does a pentest disrupt day-to-day operations?
An agreed pentest is planned so that operations continue. Checks that could affect availability only happen with explicit approval.
Do I need a pentest for NIS2 or ISO 27001?
Neither prescribes one explicitly, but both require you to assess whether your measures work. A documented pentest is direct evidence of that; an annual cycle is common.