What gets tested

Applications

What goes wrong
in applications.

Access rights

Users reach data and functions that are not theirs.

Steps that exist to protect something, and can be skipped.

Payment & process logic

Permitted steps in an order nobody intended.

Tenant separation

Whether the boundary between two customers actually holds.

Networks

Internal network

What someone reaches once they are inside — and how far they get.

Visible from outside

Which systems the internet can see, and what among them does not belong there.

Active Directory

The path from an ordinary account to administrator rights.

WLAN & infrastructure

Whether the separation between networks that should be separate actually holds.

Method

Understand

What the system is meant to do, and who may do what.

Assume

State concretely what should not be possible.

Attack

Actually take the path instead of assuming it.

Re-stage

Repeat it. What cannot be reproduced does not become a finding.

Report

Structured to BSI. An IS penetration test report in the format auditors and supervisors know.
Every finding evidenced. Severity, reproduction steps, remediation guidance.
Nothing speculative. A model produces a hundred hypotheses. What reaches the report is what was re-staged.

Request

A few lines about the target are enough to start.