PROCESS
Process · From order to report

Four steps, no mystery.

What happens when you get in touch — and what you hold at the end.

// Report: to BSI
Sequence

How it runs.

Scope
You define what gets tested and what is off limits. In writing, before the first request.
Access
Test accounts and access to the target — all of it revocable at any time.
Test
Vordask works autonomously. I check every result before it goes in the report.
Report
IS penetration test report to BSI structure, with evidence and guidance for every finding.
The box

What comes
next.

The box is the same software as a device in your rack: test as often as you like, without anything leaving your network — even where there is no route out at all. It is in development, every order today funds it, and anyone who books a pentest gets it at a preferential rate.

Questions

What you want to know.

Does the test run against production?
The first run belongs in staging or a test instance. Production comes later, with limits agreed in advance.
Can something break?
It can create, change and delete like any tester with the same rights. That is why the scope and the account permissions determine how far it reaches — and why the first run is not production. I would rather say that plainly than give a guarantee no testing tool can keep.
Where do the AI models run?
Locally, on our own hardware. No cloud provider gets to see your data. With the box, the whole test runs on your own premises.
What happens to the data after the test?
Retention and deletion are agreed per engagement and fixed in the contract before testing starts.
What can be tested?
Web applications and the APIs behind them, internal networks, systems reachable from outside, Active Directory and WLAN.
How does this differ from a conventional pentest?
It is one — same methodology, same report format. The difference is that the repetitive work is done by a system: the hundred variants of the same test that nobody works through by hand.
Request

Ask the awkward
questions first.

If something in your environment speaks against it, I would rather hear that up front.

// Request a pentest