Pentest Providers Germany 2026 at a Glance

Last updated:

Pentesting in Germany

Germany is the largest market for penetration testing in the DACH region. With the BSI as the regulatory authority and requirements from TIBER-DE, DORA, and NIS2, demand for qualified pentesting providers continues to grow.

Regulatory Context for Pentests in Germany

In Germany, too, a pentest should deliver more than a compliance checkbox: it demonstrates in practice how resilient your systems are against real attacks. Several sets of requirements shape the landscape:

  • BSI recommendations: The Federal Office for Information Security (BSI) is Germany's central authority for IT security. Its recommendations and certifications serve many organizations as the reference for planning and commissioning technical security assessments such as penetration tests.
  • DORA and TIBER-DE for the financial sector: The Digital Operational Resilience Act (DORA) has applied directly across the EU since 17 January 2025. All regulated financial entities must run an ongoing digital operational resilience testing program; entities designated by the authorities additionally undergo threat-led penetration testing (TLPT) at least every three years - implemented in Germany via TIBER-DE, run by the Bundesbank and BaFin.
  • NIS2: The EU-wide NIS2 directive obliges essential and important entities to practice risk management and technical security measures. Regular penetration tests are an established way to demonstrate that these measures actually work.

In practice, this means: decide up front which requirement the test addresses, and make sure the scope, methodology, and reporting format match it. A web app pentest securing a customer portal looks different from an infrastructure-wide test backing a DORA testing program.

Pentesting Providers in Germany

slashsec Red Teaming GmbH

Vienna, Austria · Engagements across DACH · slashsec.at

Specialized pentesting provider from Vienna focused on demanding penetration tests and Red Teaming. Highest certification density in the team (OSCP, OSEP, OSWE, CRTO, CRTO2).

  • Web Application & API Pentesting
  • Infrastructure & Active Directory Pentesting
  • Cloud Security Assessments (AWS, Azure, GCP)
  • Engagements in Austria, Germany, and Switzerland
Schedule a free consultation

Customers in Germany who rely on slashsec

gematik · Statista

What to Look For When Choosing a Provider

The German provider landscape is the densest in the DACH region - from long-established firms to highly specialized boutiques. These criteria help you find the right partner:

  • Demonstrable technical depth. Look for recognized, hands-on certifications among the people doing the work (e.g., OSCP, OSEP, OSWE) rather than management certificates alone. What matters is that testing is genuinely manual and exploitation-driven - not just a delivered tool scan.
  • Fit of scope and methodology. A good provider first asks about your objective (web app, API, internal infrastructure, Active Directory, cloud) and tailors the approach and test depth (black-, gray-, or white-box) accordingly. Recognized methodologies such as OWASP, OSSTMM, or the PTES provide a solid baseline.
  • A clear, actionable report. The value of a pentest comes from the report: reproducible steps, a defensible risk rating, and concrete, prioritized recommendations. Ask for an anonymized sample report before you commit.
  • Regulatory fit. If the test should address BSI recommendations, DORA, TIBER-DE, or NIS2 requirements, the provider must understand those references and be able to structure the report accordingly.
  • Independence and re-testing. Favor providers that test themselves (no pure resellers), disclose conflicts of interest, and offer a re-test after remediation - that is the only way to prove the gaps were actually closed.

What Does a Pentest Cost in Germany?

Costs depend directly on scope, test depth, and complexity: a focused test of a single web application runs for days to a few weeks, while an infrastructure-wide test covering Active Directory and cloud components takes correspondingly longer. Reputable providers calculate based on effort and make their approach transparent during scoping, rather than quoting flat prices without scoping. For upper-bound orientation: comprehensive red teaming assessments start at around EUR 40,000, and full regulatory TIBER/DORA TLPT cycles including threat intelligence at around EUR 150,000 - classic penetration tests come in well below that.

This overview of pentesting providers in Germany has been compiled to the best of our knowledge. We do not guarantee the accuracy or currency of the information.

We welcome tips about additional providers. We only list companies that offer penetration testing services themselves (no pure resellers).

For inquiries and tips, send us a message at E-Mail.

→ All Pentesting Providers in the DACH Region
→ All Red Teaming Providers in the DACH Region
→ All Physical Security Providers in the DACH Region

Request red teaming, a pentest or physical security

slashsec is a specialized red team from Vienna - engagements across the DACH region, TIBER-AT/DORA-aligned assessments and the highest certification density in the team (OSCP, OSEP, OSWE, CRTO).

Book a free 30-min consultation

All services at a glance · Red teaming services · Contact