# Penetration testing companies in Germany: sourced list

Source: https://pentestcompare.com/locations/germany/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing companies headquartered in Germany, A to Z, with sources, plus how we assign country, report language and data location checks to run.

> **Short answer:** The table lists penetration testing companies whose own pages show a German headquarters, A to Z and unranked. We assign a country from the provider's imprint or contact page, not from where it sells. Ask each firm about report language, where it stores evidence, remote or on-site work, and retest terms before you request quotes.

This page is for buyers who want a pentest from a company based in Germany. It filters the PentestCompare dataset by headquarters country. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it. German-language pages are out of scope for this site.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Cure53](https://pentestcompare.com/providers/cure53/) | Boutique consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not published. The site says assignments do not end with the report and that critical bugs are usually fixed by report time. | public |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |

## How do we assign a provider to Germany?

We use the headquarters country that the provider states on its own imprint, contact or about page. A company that sells to German buyers or has a German office does not count unless its pages give a German headquarters. Providers with offices in several countries show as "Multiple" and appear on no single country page.

The headquarters country says where the company is based. It does not say where the testers sit, where the work happens or where the evidence is stored. Ask for those three facts in the quote.

## What do the German providers in the table state?

Facts below come from each provider's own pages, checked on 9 November 2026.

| Provider | Base | Services stated | Retest | Sample report |
|---|---|---|---|---|
| [Cure53](/providers/cure53/) | Berlin | Web and mobile apps, cloud and server setups, crypto, source code | Not published | Public archive of client-approved reports |
| [SySS](/providers/syss/) | Tuebingen | Networks, web, API, cloud, mobile, wireless, embedded, OT/ICS, AI systems, red teaming | A retest after fixes is the last step of its process | Not published |
| [usd AG](/providers/usd-ag/) | Neu-Isenburg | Pentests, code review, TLPT red teaming, OT, cloud, AI security, security scans | Not published | Not published |

Sources: [Cure53](https://cure53.de/), [SySS](https://www.syss.de/en/services/penetration-test) and [usd AG](https://www.usd.de/en/security-analysis-pentests/). usd AG publishes ISO 27001 and ISO 9001 certificates and lists PCI Qualified Security Assessor status, which links to the PCI SSC assessor list. See [pentest providers for PCI DSS](/compliance/pci-dss/) if you test for card data compliance.

## Which local rules and buyer needs apply?

We found no single German rule that tells a buyer which pentest company to hire, and we do not invent one. Your customer, auditor or regulator may set its own requirement, so ask them first.

The German federal cybersecurity agency, the BSI, publishes a German-language study on how to organize and run penetration tests in security-relevant IT systems. Its page lists the study as dated 22 November 2003, written with BDO and Ernst & Young ([BSI](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Penetrationstest/penetrationstest.html)). The study is old. Use it as background on test planning and not as a current standard.

Some German firms in the table mention EU rules in their own pages. For example, SySS's page in the dataset mentions NIS 2, and usd AG mentions TLPT. Read the rule itself before you rely on a provider's summary of it.

## What should you ask German pentest providers?

Ask for written answers to these six checks.

1. In which language will the report, the findings and the retest letter be written?
2. Where is evidence stored (requests, responses, screenshots), and who at the provider can read it?
3. Do testers work remotely, on site or both, and from which country?
4. Which written authorization from the system owner does the provider need before it starts?
5. What does the quote say about retests: how many, and for how long?
6. Can we see a sample report, or a redacted report, before we sign?

## What drives the price?

No German provider in the table publishes a price as of 9 November 2026. Quotes depend on test days, the number of testers, the depth of the test and the retest terms. For comparison, Securitum, a Polish firm in the dataset, publishes 640 EUR to 890 EUR per man day and a typical fixed range of 3,500 EUR to 14,000 EUR ([Securitum](https://securitum.com/pricing.html)). That is a different market, so use it only to sanity-check the day-rate structure.

Ask each German firm for the number of days, the roles on the team and the day rate. The [penetration testing cost guide](/guides/penetration-testing-cost/) lists published prices from other providers.

## How do you read the table?

Read the table as a screening step. A short list is a fact about what is public. Some firms publish little, and "Not published" means we found no statement on their pages.

The Sample report column tells you the most. Cure53 hosts a public archive of client-approved reports on its site, so you can read the style of its work before you contact it. For the others, ask for a redacted report under a non-disclosure agreement.

## Remote or on site, and where does the data go?

Many tests run remotely against internet-facing systems. On-site work applies to internal networks, OT and physical access. State which applies in the scope.

Evidence from a pentest can include credentials, tokens and personal data. Agree how the provider receives test accounts, how long it keeps evidence and when it deletes it. Use the [scoping checklist](/tools/scoping-checklist/) to list roles, environments and limits before you ask for quotes.

## Questions

### Does a German pentest company write reports in English?

The provider pages in this dataset are mostly in English, but none states a report language. Ask in the quote. Name the language of the report, the findings and the retest letter, and say who will read them.

### Does the BSI certify or approve pentest companies?

We found no BSI approval list for pentest companies in the sources we checked. The BSI has published a study on how to organize and run penetration tests, dated 22 November 2003 on its site. Ask your customer or auditor whether they require a specific list.

### Do I need a German company to test a system hosted in Germany?

No rule we checked requires it. Choose on skill, scope and contract terms. Ask where the provider stores your evidence and who can access it, and sign a written authorization for the systems in scope.

### Are there prices for German pentests in the table?

No provider in the German list publishes a price, as of 9 November 2026. Securitum, a Polish firm, publishes day rates and ranges. For German firms, ask for a written quote that names days, roles and retest terms.

## Sources

- [Cure53](https://cure53.de/)
- [SySS: penetration test](https://www.syss.de/en/services/penetration-test)
- [usd AG: security analysis and pentests](https://www.usd.de/en/security-analysis-pentests/)
- [BSI: Studie Penetrationstests (Durchführungskonzept), 22.11.2003](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Penetrationstest/penetrationstest.html)
- [Securitum: pricing](https://securitum.com/pricing.html)