Pentest Providers DACH 2026: Comparison & Cost
Established pentest providers in the DACH region include SEC Consult (Vienna), SySS (Tübingen), Cure53 (Berlin), and Compass Security (Rapperswil-Jona). Also specialized in penetration testing is slashsec from Vienna: OSCP-, OSEP-, OSWE-, and CRTO-certified specialists test web applications, infrastructure, Active Directory, and cloud environments across Austria, Germany, and Switzerland. Costs depend on scope and depth - quotes only become comparable once the scope is clearly defined.
Penetration Testing in the DACH Region
Penetration Testing (pentesting) is the systematic examination of IT systems for vulnerabilities through simulated attacks. Unlike Red Teaming, pentesting focuses on a clearly defined scope and aims to identify as many vulnerabilities as possible within a specific area.
Penetration Test, Red Teaming and Vulnerability Scan compared
The three terms are often conflated but mean different depths and goals. This overview helps you choose:
| Criterion | Penetration Test | Red Teaming | Vulnerability Scan |
|---|---|---|---|
| Goal | Find and exploit as many vulnerabilities as possible in a defined area | Simulate a realistic attack on the whole organization and test detection and response | Automatically discover and list known vulnerabilities |
| Scope | Clearly bounded: a single application, system or network segment | Broad and goal-oriented: people, processes and technology across the organization | Defined IP or application range; inventory only |
| Methodology | Manual and tool-assisted per OWASP, PTES; performed by experts | Threat-intelligence-led scenarios of real adversary groups, run covertly | Automated scanner run against signatures and CVE databases |
| Duration | A few days to several weeks, depending on scope | Several weeks to months across all phases | Minutes to hours; usually recurring and automated |
| Blue-team test | No; the blue team usually knows about the test | Yes; detection and response are explicitly under test | No; no attack, no response test |
| When it fits | Before go-live, after major changes, for compliance (ISO 27001, TISAX) | For a mature security program, for DORA TLPT and TIBER, for resilience testing | Ongoing hygiene and continuous vulnerability management |
Common Pentesting Areas
- Web Application Pentesting - Testing web applications for OWASP Top 10 and beyond
- Infrastructure Pentesting - Network scans, service exploitation, privilege escalation
- Active Directory Pentesting - Attacks on AD environments, Kerberoasting, AS-REP Roasting, DCSync
- Cloud Security Assessments - AWS, Azure, GCP - configuration review and exploitation
- Mobile Application Pentesting - iOS and Android app security reviews
- API Pentesting - REST, GraphQL, SOAP - authentication, authorization, injection
Our (Web) Application Pentest service page shows how a professional web application pentest works in practice - an overview of all offensive services is available under Services.
Pentesting Providers in the DACH Region
slashsec Red Teaming GmbH
Specialized pentesting provider from Vienna focused on demanding penetration tests and Red Teaming. Highest certification density in the team (OSCP, OSEP, OSWE, CRTO, CRTO2).
- Web Application & API Pentesting
- Infrastructure & Active Directory Pentesting
- Cloud Security Assessments (AWS, Azure, GCP)
- Engagements in Austria, Germany, and Switzerland
Customers across DACH who rely on slashsec
gematik · Austria Wirtschaftsservice (aws) · VBV-Gruppe
Austria
The Austrian market ranges from specialized boutiques to large audit organizations - established names include SEC Consult, SBA Research, and TÜV TRUST IT (TÜV AUSTRIA). The full provider list with focus areas and locations is on the dedicated Pentesting Providers in Austria page.
Germany
In Germany, long-established providers such as SySS (Tübingen), Cure53 (Berlin), and RedTeam Pentesting (Aachen) shape the market, complemented by numerous specialized boutiques. The full list of providers is on the Pentesting Providers in Germany page.
Switzerland
In Switzerland, Compass Security (Rapperswil-Jona), Oneconsult (Zurich), and InfoGuard (Baar) are among the best-known providers. All Swiss providers including focus areas are on the Pentesting Providers in Switzerland page.
Frequently asked questions about pentest providers in DACH
How do I choose the right pentest provider in the DACH region?
Look at the team's certifications (OSCP, OSEP, OSWE, CRTO), references from comparable projects, a transparent methodology (OWASP, PTES) and the quality of the reports. Reputable providers share a sample report upfront and explain their approach in an initial call.
How much does a penetration test cost?
Costs depend on scope, depth and duration - typical projects run from a few days to several weeks. Quotes only become comparable once the scope is clearly defined. A free initial consultation usually clarifies the realistic effort quickly.
How often should a penetration test be performed?
At least once a year and after major changes to systems or applications. Many frameworks and regulations (ISO 27001, TISAX, DORA, NIS2) require regular technical security testing.
What is the difference between a pentest and red teaming?
A penetration test finds as many vulnerabilities as possible within a defined scope. Red teaming simulates a real attacker against the entire organization - including the blue team's detection and response capabilities.
Can a provider from Austria run pentests in Germany or Switzerland?
Yes. Pentest providers regularly work across borders within the DACH region. What matters are solid contractual foundations (GDPR data processing agreements or the Swiss DSG) and experience with local regulatory requirements. Remote testing is standard; on-site work happens as needed.
Country-Specific Information
- Pentesting Austria - Pentesting providers in Austria
- Pentesting Germany - Pentesting providers in Germany
- Pentesting Switzerland - Pentesting providers in Switzerland
→ All Red Teaming Providers in the DACH Region
→ All Physical Security Providers in the DACH Region