A pen test report that is just scanner output helps no one. We test with intent, document every finding with reproduction steps and a concrete recommendation — and translate the result into decisions: what needs fixing now, what can wait, what is noise.
What we test
- Web applications — authenticated and unauthenticated, role-based
- APIs — REST/GraphQL, auth logic, authorisation boundaries
- Mobile apps — iOS and Android
- External infrastructure — your attack surface as seen from the internet
- Internal infrastructure & Active Directory — what an attacker reaches after the first foothold
- Microsoft 365 / Azure security check — configuration review of Entra ID, Exchange Online, Defender, Azure baseline hardening against CIS benchmarks
- Re-tests after remediation — to complete the evidence trail
How we run it
Scoping
Free 30-minute call. Define targets, systems, and the test window.
Fixed-price offer
Clear scope, clear price. No effort-based surprises.
Test
Executed in the agreed window by certified testers (OSCP-class).
Report & debrief
Technical report, management summary, closing debrief with prioritisation.
What you get
- Technical report: findings with CVSS rating, reproduction steps, and concrete remediation guidance
- Management summary written for executives and customers (available in German)
- Closing debrief with prioritisation: fix now, schedule, accept
- On request, a test attestation for customers and insurers
- Re-test after remediation with updated evidence
Why this matters
Customers, insurers, and regulators increasingly ask for evidence of regular technical testing. A properly scoped pen test provides that evidence — and finds the gaps that configuration reviews and process audits structurally cannot see.
Questions we get
What does a penetration test cost?
Fixed price after free scoping. A 30-minute call clarifies scope and test depth — you then receive a binding fixed-price offer with no effort-based risk.
Who performs the test?
Certified penetration testers of OSCP-class, under Cortavion contract, NDA, and quality assurance. Scoping, interpretation of results, and your point of contact are Cortavion throughout.
How is this different from a security assessment?
A pen test actively attacks a defined boundary and proves concrete exploitability. An assessment reviews the entire defence model across technology, processes, and team. The two complement each other — clients often combine an external pen test with a Microsoft 365 check.
Will the test disrupt operations?
Test windows and escalation paths are agreed in advance. Destructive tests happen only with explicit approval; critical findings are reported immediately, not just in the final report.