Monthly
For stable applications with a manageable rate of change.
from
1.999 €net / month
- Monthly external testing
- Assessed findings update
- Retest fixed findings
What your company
shows on the internet.
We take a closer look.
Forgotten subdomains. Public entry points. New APIs. Understand your attack surface and have your systems checked regularly for security vulnerabilities.
Start with your company email DNS only when needed No credit card
An outside viewILLUSTRATIVE EXAMPLE
Discover hostnamesAssign systemsUnderstand the testing scope
One domain. Often more exposure than expected.
Pwnry is backed by
real security research.
real security research.
From subdomain takeovers to authorization flaws: insights from practical research inform our testing.
Explore Franz Bettag’s research
You know your website.
What about everything else?
The old ticket system. The new staging environment. A GitLab instance nobody remembers anymore.
Every change expands your company’s public exposure. Pwnry makes it visible, groups likely applications and helps you define a suitable testing scope.
How we test
From your domain
to the next step.
A free start. An understandable overview.
A sound basis for your offer.
1
Verify company email
Register your company and verify your email. Your company domain is suggested; additional or particularly large domains require DNS verification.
No access to your infrastructure required.
2
Understand your attack surface
We analyze public certificate, archive and DNS data. You explicitly authorize any additional automated security checks.
Sources and limitations stay visible.
3
Clarify scope and price
Confirm your systems and choose a testing frequency. The estimate explains how your price is calculated.
You decide what happens next.
Finally, a list
you
can act on.
Hostnames are the starting point. What matters is which applications they represent and which should be tested.
- Publicly visible systems with their sources
- Likely applications and service types
- Editable assignments and testing scope
- Transparent price estimate
firma.de
Fictional example
Public systemsFrom hostname
to application.
to application.
www
www.firma.deWebsite · domain / DNS
Website
API
api.firma.deInterface · certificate data
API
git
git.firma.deDevelopment · review assignment
Test
You confirm which systems belong to your testing scope.
Security has
a frequency.
Your rate of change determines your testing frequency.
All amounts are net per month and depend on scope.
Weekly
For product teams with regular releases and new interfaces.
from
5.999 €net / month
- Weekly external testing
- Updated findings
- Retest fixed findings
Daily
For frequent changes and particularly critical external systems.
from
9.999 €net / month
- Daily external testing
- Ongoing findings updates
- Retest fixed findings
All packages include expert assessment, prioritized reports and agreed communication with your team. Scope, methods, capacity and communication channels are confirmed before testing starts. How we calculate
Good questions.
Clear answers.
What you should know before your first check.
What does the free check include?+
A bounded inventory of your external attack surface, editable system assignments and a non-binding price estimate. Additional automated security checks run only with your explicit authorization.
Is this already a full penetration test?+
The free check provides an initial external view. A full penetration test covers an agreed scope, suitable methods, test accounts where needed and expert assessment of specific vulnerabilities.
Can I start without a DNS record?+
For a bounded initial check of your own company domain, verified company email is sufficient. Personal email accounts, shared platforms, different target domains and large environments require DNS verification. You explicitly confirm authorization for the testing scope.
Can I add further domains and missing systems?+
Yes. Add further company domains in your private report and verify them using an individual DNS TXT record. Their analysis starts after verification. You can add missing hostnames under confirmed domains. New targets update your estimate; previously saved offer drafts remain unchanged.
How is my price calculated?+
We weight reachable application groups by inferred service type, including authenticated testing and frequency. Your scope corrections update the estimate. Unclear or large environments receive expert review before a binding offer.
Can I start through a partner?+
Yes. With your consent, a personal referral link attributes your request to the partner. They can see shared contact and offer data for follow-up. Technical reports remain protected.
The first look
is free.
Your company email is the starting point.
Your attack surface is the next step.
Start your free check
Company email or DNS verification. No credit card.