Security is not a project. Security
is a cycle.
Attack surface monitoring, penetration testing, red teaming and security consulting — four phases that feed each other instead of sitting side by side. German security lead, efficient delivery team, pricing that works for mid-sized companies.
One pentest a year is not a security programme
Most companies buy a penetration test once a year, receive a PDF, file it — and change nothing until the next audit. Meanwhile the attack surface keeps growing: new subdomains, a forgotten staging server, a credential leaked in somebody else's breach, a deployment that skipped review. Attackers work continuously. A defence that happens once a year loses by design. That is why we do not sell isolated engagements but a cycle — and half of it is what happens after the report.
The DeViLink Security Cycle
See. Test. Attack. Harden.
Four phases that trigger each other. You can enter at any point — and stay in the loop instead of starting from zero every year.
Monitoring
See
What does an attacker see before they start?
Continuous monitoring of your externally reachable attack surface: domains, subdomains, exposed services, certificates, cloud storage — plus leak monitoring for employee credentials surfacing in third-party breaches.
- External asset and service discovery
- Alerts on new exposure, not on inventory
- Credential and leak monitoring
- Monthly report for management
Finds an exposed application → triggers phase 2.
See attack surface monitoringPenetration testing
Test
Is what is reachable also exploitable?
Manual penetration testing to OWASP, PTES and BSI standards — web applications, APIs, cloud and infrastructure. With management summary, CVSS-prioritised findings, concrete fixes and a re-test after remediation.
- Web, API, cloud, infrastructure
- Blackbox, greybox or whitebox
- CVSS-prioritised findings with fix guidance
- Re-test after remediation included
Finds a class of bug → triggers phase 4.
See penetration testingRed teaming
Attack
And if somebody really wants in?
An expert attacks from the outside with AI support — the vantage point automated attacks will soon come from. The Red Teaming Starter shows, at a fixed price, what an attacker discovers about your public systems. Internal foothold and detection on request.
- Red teaming starter: external, fixed price €2,500
- Expert with AI, not just a scanner
- Optional retest €300
- Assumed breach and detection on request
Reveals detection gaps → triggers phases 1 and 4.
See red teamingConsulting & audit
Harden
Why does this keep happening?
The part where most reports die: remediation. We review configuration and architecture, clear findings with your developers, anchor security in your delivery pipeline — and produce the evidence for NIS2, CRA, ISO 27001 or TISAX along the way.
- Security audit and configuration review
- Secure SDLC review and developer workshop
- NIS2 readiness check and CRA support
- We can fix it with you, not just flag it
Raises the baseline → back to phase 1.
See security auditThe difference to a pure security boutique: we are a software company. Remediation is our home turf — we can not only name the findings but close them with your team.
Decision guide
Which entry point fits you?
You don't have to buy the whole cycle. Start where your trigger is. This overview shows where we would begin in typical situations.
Your situation
Where we suggest you start
We don't know exactly which of our systems are reachable from the internet.
Free Attack-Surface-Check: we show you what an attacker sees from the outside. If you want to keep watching it, monitoring follows.
Check free · Monitoring from €249/monthAttack surface monitoring →
A customer, auditor or tender requires a current pentest report.
Manual penetration test of the application or infrastructure in question, with a management summary, an auditor-ready report and a re-test after remediation.
from €3,500Penetration testing →
We fall under NIS2 in Germany and don't know where we stand.
NIS2 readiness check: where are measures missing, where is evidence missing? A pentest then demonstrates that your measures work (§ 30 BSIG).
€2,900 (2 days)NIS2 & penetration testing →
We make software or connected products and sell them in the EU.
Free CRA reporting-readiness check: could you detect and report an actively exploited vulnerability within 24 hours? Then support and product pentests at a day rate.
Check free · Support from €800/dayCyber Resilience Act →
We test regularly and want to know whether an attacker would still reach their goal.
Red Teaming Starter: an expert, supported by AI, attacks your public-facing systems. Goal-oriented rather than coverage-oriented.
€2,500 fixed priceRed teaming →
The same vulnerabilities show up in every report.
Security audit or secure SDLC review: we look for the cause in configuration, pipeline and review practice rather than in the single finding, and help fix it.
Audit €2,500 · SDLC review €4,900Security audit →
We have an active security incident right now.
We are not the right first call for that: we don't offer round-the-clock incident response. Contact an incident response provider (in Germany, the BSI lists qualified APT response providers). After the clean-up, a pentest confirms that the gap is really closed.
IT security by the numbers
Professional security expertise at mid-market conditions
Regulation
The deadline is no longer an argument. It has passed.
NIS2 has applied in Germany since 6 December 2025 with no transition period. The first CRA reporting obligations became binding on 11 September 2026. If you have no evidence now, you have a problem — not a project.
NIS2 / BSIG
Around 29,500 German companies must demonstrate risk management — including testing the effectiveness of their measures. That is exactly what a penetration test delivers.
NIS2 & penetration testingReporting since 11 Sep 2026Cyber Resilience Act
Manufacturers of connected products and software must report actively exploited vulnerabilities within 24 hours — including for products shipped long ago. No detection, no report.
CRA & vulnerability handlingAudit evidenceISO 27001 & TISAX
Certification and re-audits require solid technical testing. We deliver the report in the form your auditor expects — including remediation tracking.
See security auditIndustry standardPCI-DSS & customer audits
Payment data, enterprise customers, tenders: a current pentest report is increasingly the ticket to the table, not a nice-to-have. We deliver it predictably and repeatably.
See penetration testingOur security services
Available individually — considerably more effective as a cycle
Why DeViLink for IT security?
German leadership, efficient delivery, honest limits
German security lead
Your contact is based in Germany, runs the engagement, signs every report and can be on site when it matters. Most of the testing is carried out by our certified team in Vietnam.
We can also fix it
Most security providers deliver findings and disappear. We are a software company: if you lack the capacity to remediate, we take it on — within the same engagement.
Mid-market pricing
Penetration tests from €3,500 instead of the €7,500–15,000 typical in Germany for comparable scopes. Transparently calculated, verifiable upfront in the calculator.
Reports that survive audits
Management summary for leadership, technical section for your developers, evidence format for auditors. CVSS scoring, reproduction steps, remediation guidance.
A cycle, not a one-off
Monitor, test, remediate, re-test — planned across the year as a retainer from €990 per month instead of an annual fire drill.
Honest limits
We say openly what we do not do: no 24/7 SOC, no TLPT under TIBER-DE, no certification body. What we commit to, we deliver even at full capacity.
Transparent security pricing
Entry from €249 per month — or the full cycle as a retainer
Attack surface monitoring
The entry point to the cycle
- External attack surface monitoring
- Leak and credential monitoring
- Alerts on new exposure
- Monthly report
- No minimum term on the Basic plan
Security Cycle retainer
The complete cycle
- Monitoring included
- One penetration test per year
- Two audit/consulting days per year
- Re-tests after remediation
- Priority scheduling
- Compliance documentation for NIS2, ISO 27001, CRA
Single engagements
Specific, one-off need
- Security audit from €2,500 (2 days)
- NIS2 readiness check €2,900
- Penetration test from €3,500
- Red teaming starter €2,500 (external, fixed price)
- Consulting day €1,250
Frequently asked security questions
What customers ask us before the first engagement
A penetration test starts at €3,500 for a small web application. The price depends on scope: number of endpoints, user roles, methodology (blackbox, greybox, whitebox), cloud infrastructure, data sensitivity and compliance requirements. Our pentest calculator lets you model your scope in two minutes and returns a solid price indication.
Start with what an attacker can see
In a 30-minute intro call we clarify your need, place it in the cycle and tell you honestly what you need now — and what can wait.