Security is not a project. Security is a cycle.
Attack surface monitoring, penetration testing, red teaming and security consulting — four phases that feed each other instead of sitting side by side. German security lead, efficient delivery team, pricing that works for mid-sized companies.
One pentest a year is not a security programme
Most companies buy a penetration test once a year, receive a PDF, file it — and change nothing until the next audit. Meanwhile the attack surface keeps growing: new subdomains, a forgotten staging server, a credential leaked in somebody else's breach, a deployment that skipped review. Attackers work continuously. A defence that happens once a year loses by design. That is why we do not sell isolated engagements but a cycle — and half of it is what happens after the report.
The DeViLink Security Cycle
See. Test. Attack. Harden.
Four phases that trigger each other. You can enter at any point — and stay in the loop instead of starting from zero every year.
See
What does an attacker see before they start?
Continuous monitoring of your externally reachable attack surface: domains, subdomains, exposed services, certificates, cloud storage — plus leak monitoring for employee credentials surfacing in third-party breaches.
- External asset and service discovery
- Alerts on new exposure, not on inventory
- Credential and leak monitoring
- Monthly report for management
Finds an exposed application → triggers phase 2.
See attack surface monitoringTest
Is what is reachable also exploitable?
Manual penetration testing to OWASP, PTES and BSI standards — web applications, APIs, cloud and infrastructure. With management summary, CVSS-prioritised findings, concrete fixes and a re-test after remediation.
- Web, API, cloud, infrastructure
- Blackbox, greybox or whitebox
- CVSS-prioritised findings with fix guidance
- Re-test after remediation included
Finds a class of bug → triggers phase 4.
See penetration testingAttack
And if somebody really wants in?
An expert attacks from the outside with AI support — the vantage point automated attacks will soon come from. The Red Teaming Starter shows, at a fixed price, what an attacker discovers about your public systems. Internal foothold and detection on request.
- Red teaming starter: external, fixed price €2,500
- Expert with AI, not just a scanner
- Optional retest €300
- Assumed breach and detection on request
Reveals detection gaps → triggers phases 1 and 4.
See red teamingHarden
Why does this keep happening?
The part where most reports die: remediation. We review configuration and architecture, clear findings with your developers, anchor security in your delivery pipeline — and produce the evidence for NIS2, CRA, ISO 27001 or TISAX along the way.
- Security audit and configuration review
- Secure SDLC review and developer workshop
- CRA support and evidence for NIS2
- We can fix it with you, not just flag it
Raises the baseline → back to phase 1.
See security auditThe difference to a pure security boutique: we are a software company. Remediation is our home turf — we can not only name the findings but close them with your team.
Decision guide
Which entry point fits you?
You don't have to buy the whole cycle. Start where your trigger is. This overview shows where we would begin in typical situations.
| Your situation | Where we suggest you start |
|---|---|
| We don't know exactly which of our systems are reachable from the internet. | Free Attack-Surface-Check: we show you what an attacker sees from the outside. If you want to keep watching it, monitoring follows.Check free · Monitoring from €249/monthAttack surface monitoring |
| A customer, auditor or tender requires a current pentest report. | Manual penetration test of the application or infrastructure in question, with a management summary, an auditor-ready report and a re-test after remediation.from €3,500Penetration testing |
| We fall under NIS2 in Germany and don't know where we stand. | Penetration test of your critical systems: it shows whether your measures work (§ 30 BSIG). If you like, a security audit also reviews configuration and architecture.Pentest from €3,500 · audit €2,500 (2 days)NIS2 & penetration testing |
| We make software or connected products and sell them in the EU. | Free CRA reporting-readiness check: could you detect and report an actively exploited vulnerability within 24 hours? Then support and product pentests at a day rate.Check free · Support from €800/dayCyber Resilience Act |
| We test regularly and want to know whether an attacker would still reach their goal. | Red Teaming Starter: an expert, supported by AI, attacks your public-facing systems. Goal-oriented rather than coverage-oriented.€2,500 fixed priceRed teaming |
| The same vulnerabilities show up in every report. | Security audit or secure SDLC review: we look for the cause in configuration, pipeline and review practice rather than in the single finding, and help fix it.Audit €2,500 · SDLC review €4,900Security audit |
| We have an active security incident right now. | We are not the right first call for that: we don't offer round-the-clock incident response. Contact an incident response provider (in Germany, the BSI lists qualified APT response providers). After the clean-up, a pentest confirms that the gap is really closed. |
IT security by the numbers
Professional security expertise at mid-market conditions
Regulation
The deadline is no longer an argument. It has passed.
NIS2 has applied in Germany since 6 December 2025 with no transition period. The first CRA reporting obligations became binding on 11 September 2026. If you have no evidence now, you have a problem — not a project.
NIS2 / BSIG
Around 29,500 German companies must demonstrate risk management — including testing the effectiveness of their measures. That is exactly what a penetration test delivers.
NIS2 & penetration testingCyber Resilience Act
Manufacturers of connected products and software must report actively exploited vulnerabilities within 24 hours — including for products shipped long ago. No detection, no report.
CRA & vulnerability handlingISO 27001 & TISAX
Certification and re-audits require solid technical testing. We deliver the report in the form your auditor expects — including remediation tracking.
See security auditPCI-DSS & customer audits
Payment data, enterprise customers, tenders: a current pentest report is increasingly the ticket to the table, not a nice-to-have. We deliver it predictably and repeatably.
See penetration testingOur security services
Available individually — considerably more effective as a cycle
Attack surface monitoring
Continuous monitoring of your external attack surface including leak monitoring. From €249 per month.
Penetration testing
Manual security testing for web, API, cloud and infrastructure to OWASP, PTES and BSI. From €3,500.
Red teaming
A fixed-price external red teaming starter — an expert with AI attacks from the outside. Assumed breach, phishing and detection on request.
Security audit & consulting
Configuration review, secure SDLC, hardening and action plan — with implementation support.
NIS2 evidence
Penetration tests and readiness check as solid proof of effectiveness under §30 BSIG.
Cyber Resilience Act
Vulnerability detection, reporting process and product testing for manufacturers of connected products.
Why DeViLink for IT security?
German leadership, efficient delivery, honest limits
German security lead
Your contact is based in Germany, runs the engagement, signs every report and can be on site when it matters. Most of the testing is carried out by our certified team in Vietnam.
We can also fix it
Most security providers deliver findings and disappear. We are a software company: if you lack the capacity to remediate, we take it on — within the same engagement.
Mid-market pricing
Penetration tests from €3,500 instead of the €7,500–15,000 typical in Germany for comparable scopes. Transparently calculated, verifiable upfront in the calculator.
Reports that survive audits
Management summary for leadership, technical section for your developers, evidence format for auditors. CVSS scoring, reproduction steps, remediation guidance.
A cycle, not a one-off
Monitor, test, remediate, re-test — planned across the year as a retainer from €990 per month instead of an annual fire drill.
Honest limits
We say openly what we do not do: no 24/7 SOC, no TLPT under TIBER-DE, no certification body. What we commit to, we deliver even at full capacity.
Transparent security pricing
Entry from €249 per month — or the full cycle as a retainer
Attack surface monitoring
The entry point to the cycle
- External attack surface monitoring
- Leak and credential monitoring
- Alerts on new exposure
- Monthly report
- No minimum term on the Basic plan
Security Cycle retainer
The complete cycle
- Monitoring included
- One penetration test per year
- Two audit/consulting days per year
- Re-tests after remediation
- Priority scheduling
- Compliance documentation for NIS2, ISO 27001, CRA
Single engagements
Specific, one-off need
- Security audit from €2,500 (2 days)
- NIS2 readiness check €2,900
- Penetration test from €3,500
- Red teaming starter €2,500 (external, fixed price)
- Consulting day €1,250
Frequently asked security questions
What customers ask us before the first engagement
A penetration test starts at €3,500 for a small web application. The price depends on scope: number of endpoints, user roles, methodology (blackbox, greybox, whitebox), cloud infrastructure, data sensitivity and compliance requirements. Our pentest calculator lets you model your scope in two minutes and returns a solid price indication.
The law does not name penetration testing explicitly. It does require risk management measures and verification that they are effective. A penetration test is the most common and most defensible way to demonstrate that effectiveness — and what auditors and supervisors expect to see when asked.
A penetration test asks: which vulnerabilities does this system have? It is coverage-driven and produces a prioritised list. Red teaming asks: could an attacker actually reach their objective? It is objective-driven. Our Red Teaming Starter answers that from the outside at a fixed price; broader scenarios with an internal foothold, people and detection are available on request.
Engagement management, client communication and sign-off on every report sit with our security lead in Germany. The actual testing — for penetration tests as for the Red Teaming Starter — is largely carried out by our certified security experts in Vietnam; the security lead in Germany reviews the results and signs off every report. Which work happens where is agreed in writing before the engagement starts, including access and data-protection arrangements.
Monitoring access is usually active within a few business days. For a penetration test, plan two to four weeks of lead time for scoping, authorisation and a test window. For urgent triggers such as a customer audit or an incident, talk to us directly — short-notice slots are possible with a priority surcharge.
You receive a management summary and a technical report, then we walk the findings through with your development team. You can remediate yourself or hand it to us — as a software company we can implement the fixes. A re-test after remediation is included so the final report is clean.
The first step is small
Start with what an attacker can see
In a 30-minute intro call we clarify your need, place it in the cycle and tell you honestly what you need now — and what can wait.
Yen Ngoc Phan · Manuel Gruschka