Website vulnera­bility assessment for online stores and web applications

A vulnerability assessment systematically tests your website or web application for known risks and delivers a prioritized findings list – with us along the OWASP Top 10 and followed by remediation. A formal penetration test follows a defined testing methodology with its own evidence report and is explicitly required, for example, in tenders or by clients. Our offering is not a formal pentest; if you need one, we tell you openly whether our scope is enough or a specialized pentest provider makes sense.

Depending on scope, a vulnerability assessment including remediation for a company website or store is possible in the Starter package from €2,500. We quote extensive web applications with roles, interfaces and several systems in the Professional package from €8,000 or individually as Enterprise. The cost of a formal pentest is set by the respective testing provider; in the free initial consultation, we clarify which option you need and then send you an exact quote.

For a typical company website, the assessment is usually completed within a few days, while extensive web applications with many roles and interfaces take longer. How long remediation takes depends on the number and type of findings. Once the test scope is defined, we give you a concrete timeframe.

Free online checks usually only test what is visible from the outside, such as encryption, security headers or the CMS version. They generally don't detect flaws in logins, access rights or forms. For a reliable answer, we combine automated scans with manual review and evaluate the findings in the context of your application.

We agree the time window and test intensity with you in advance and test gently, so that visitors and orders are not disrupted. For sensitive systems, we test a test environment first if you wish. A current backup should be in place before we begin – we clarify that in the preliminary call.

You receive a prioritized findings list with recommendations; on request, we fix the findings and document the measures implemented. This documentation can help you demonstrate technical safeguards to customers or partners. Whether your company is set up in compliance with data protection overall is a legal question. This does not replace legal advice.