Penetration testing companies in Germany: sourced list
The table lists penetration testing companies whose own pages show a German headquarters, A to Z and unranked. We assign a country from the provider's imprint or contact page, not from where it sells. Ask each firm about report language, where it stores evidence, remote or on-site work, and retest terms before you request quotes.
This page is for buyers who want a pentest from a company based in Germany. It filters the PentestCompare dataset by headquarters country. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it. German-language pages are out of scope for this site.
3 of 3 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Cure53Boutique consultancy, Germany | human-led | Yes | ? | Yes | ? | Yes | ? | Custom quote | Not published | Not published. The site says assignments do not end with the report… | Public |
| SySSConsultancy, Germany | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published. A Quick Penetration Test option can start right after… | A retest after fixes confirms the fixes work and checks for new… | not published |
| usd AGConsultancy, Germany | human-led | ? | ? | Yes | ? | Yes | Yes | Custom quote | Not published | Not published | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
How do we assign a provider to Germany?#
We use the headquarters country that the provider states on its own imprint, contact or about page. A company that sells to German buyers or has a German office does not count unless its pages give a German headquarters. Providers with offices in several countries show as "Multiple" and appear on no single country page.
The headquarters country says where the company is based. It does not say where the testers sit, where the work happens or where the evidence is stored. Ask for those three facts in the quote.
What do the German providers in the table state?#
Facts below come from each provider's own pages, checked on 9 November 2026.
| Provider | Base | Services stated | Retest | Sample report |
|---|---|---|---|---|
| Cure53 | Berlin | Web and mobile apps, cloud and server setups, crypto, source code | Not published | Public archive of client-approved reports |
| SySS | Tuebingen | Networks, web, API, cloud, mobile, wireless, embedded, OT/ICS, AI systems, red teaming | A retest after fixes is the last step of its process | Not published |
| usd AG | Neu-Isenburg | Pentests, code review, TLPT red teaming, OT, cloud, AI security, security scans | Not published | Not published |
Sources: Cure53, SySS and usd AG. usd AG publishes ISO 27001 and ISO 9001 certificates and lists PCI Qualified Security Assessor status, which links to the PCI SSC assessor list. See pentest providers for PCI DSS if you test for card data compliance.
Which local rules and buyer needs apply?#
We found no single German rule that tells a buyer which pentest company to hire, and we do not invent one. Your customer, auditor or regulator may set its own requirement, so ask them first.
The German federal cybersecurity agency, the BSI, publishes a German-language study on how to organize and run penetration tests in security-relevant IT systems. Its page lists the study as dated 22 November 2003, written with BDO and Ernst & Young (BSI). The study is old. Use it as background on test planning and not as a current standard.
Some German firms in the table mention EU rules in their own pages. For example, SySS's page in the dataset mentions NIS 2, and usd AG mentions TLPT. Read the rule itself before you rely on a provider's summary of it.
What should you ask German pentest providers?#
Ask for written answers to these six checks.
- In which language will the report, the findings and the retest letter be written?
- Where is evidence stored (requests, responses, screenshots), and who at the provider can read it?
- Do testers work remotely, on site or both, and from which country?
- Which written authorization from the system owner does the provider need before it starts?
- What does the quote say about retests: how many, and for how long?
- Can we see a sample report, or a redacted report, before we sign?
What drives the price?#
No German provider in the table publishes a price as of 9 November 2026. Quotes depend on test days, the number of testers, the depth of the test and the retest terms. For comparison, Securitum, a Polish firm in the dataset, publishes 640 EUR to 890 EUR per man day and a typical fixed range of 3,500 EUR to 14,000 EUR (Securitum). That is a different market, so use it only to sanity-check the day-rate structure.
Ask each German firm for the number of days, the roles on the team and the day rate. The penetration testing cost guide lists published prices from other providers.
How do you read the table?#
Read the table as a screening step. A short list is a fact about what is public. Some firms publish little, and "Not published" means we found no statement on their pages.
The Sample report column tells you the most. Cure53 hosts a public archive of client-approved reports on its site, so you can read the style of its work before you contact it. For the others, ask for a redacted report under a non-disclosure agreement.
Remote or on site, and where does the data go?#
Many tests run remotely against internet-facing systems. On-site work applies to internal networks, OT and physical access. State which applies in the scope.
Evidence from a pentest can include credentials, tokens and personal data. Agree how the provider receives test accounts, how long it keeps evidence and when it deletes it. Use the scoping checklist to list roles, environments and limits before you ask for quotes.
Questions
Does a German pentest company write reports in English?
The provider pages in this dataset are mostly in English, but none states a report language. Ask in the quote. Name the language of the report, the findings and the retest letter, and say who will read them.
Does the BSI certify or approve pentest companies?
We found no BSI approval list for pentest companies in the sources we checked. The BSI has published a study on how to organize and run penetration tests, dated 22 November 2003 on its site. Ask your customer or auditor whether they require a specific list.
Do I need a German company to test a system hosted in Germany?
No rule we checked requires it. Choose on skill, scope and contract terms. Ask where the provider stores your evidence and who can access it, and sign a written authorization for the systems in scope.
Are there prices for German pentests in the table?
No provider in the German list publishes a price, as of 9 November 2026. Securitum, a Polish firm, publishes day rates and ranges. For German firms, ask for a written quote that names days, roles and retest terms.
Sources
- Cure53 (checked 9 November 2026)
- SySS: penetration test (checked 9 November 2026)
- usd AG: security analysis and pentests (checked 9 November 2026)
- BSI: Studie Penetrationstests (Durchführungskonzept), 22.11.2003 (checked 9 November 2026)
- Securitum: pricing (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.