Penetration testing – find vulnerabilities before attackers do
In a penetration test we deliberately attack your website, your web application or your externally reachable servers – with your permission and according to clear rules. This lets us find security gaps that automated scanners miss: flaws in authentication, insecure interfaces, vulnerabilities in the code or misconfigured services.
We carry out the tests ourselves and bring in specialised partners where necessary. In doing so we draw on more than 30 years of hosting and web development experience and work as a company certified to ISO/IEC 27001. You receive an easy-to-understand report with rated vulnerabilities and concrete recommendations, and after remediation a retest that confirms the gaps are closed.
- LCube & partnersown experts, specialists if needed
- Web & serversapplications and infrastructure
- Reportwith recommendations
- Retestafter remediation
What we test
We define the scope together with you – from a single form to the entire platform.
Websites and web applications
webWe test your application for the typical vulnerabilities of the OWASP Top 10, such as SQL injection, cross-site scripting and broken access control.
Authentication and sessions
loginLogins, password reset, multi-factor authentication and session management – the most common entry points for attackers.
Interfaces and APIs
APIREST and other interfaces are examined for missing authorisation checks, data leaks and manipulation options.
Online shops
shopShopping cart, checkout, customer accounts and admin areas of your shop – where attacks become particularly expensive.
Servers from outside
infrastructureWe check which services and ports are reachable from outside and whether they are up to date, securely configured and sufficiently protected.
Encryption and configuration
configurationTLS settings, certificates, security headers and misconfigurations of the web server and services.
How a pentest works
- Briefing and authorisation
We define goals, scope and time windows; you authorise the test in writing. - Test
Our experts test your systems manually and with tools – in a controlled way and without endangering your operations. - Report and debriefing
You receive all findings rated by severity, with explanations and recommendations for remediation. - Retest
After remediation we test again and confirm that the gaps are closed.
Price
| Service | Price incl. VAT | Note |
|---|---|---|
| Penetration test for websites, web applications and servers | on request | depending on scope, including report and retest |
After the briefing you receive a binding quote with a fixed scope and schedule.
Why pentesting from LCube?
We know websites, shops and servers from more than 30 years of operation – and know where attackers strike.
ISO/IEC 27001 certified
LCube itself is certified to ISO/IEC 27001. Information security is an audited standard in our own processes – not just in the data centre. More about our certification
Made in Germany
Our team works in Germany and your data is stored in German data centres. Operation is GDPR compliant.
Personal support
You talk directly to experienced specialists who know your system and personally take care of your request.
Since 1995
More than 30 years of hosting experience – and for many years specialised in source code hosting and development environments.
Custom solutions
Whether a single GitLab server, a cluster or a special setup with VPN connection to your company network: we design the environment that fits your requirements.
Our own cloud platform
With the Virtuozzo Enterprise Cloud (VEP) we run our own cloud platform made in Germany – for highly available and business-critical workloads.
Frequently asked questions about pentesting
What is the difference between a pentest and a vulnerability scan?
A vulnerability scan automatically checks for known gaps, such as outdated software. In a penetration test our experts additionally proceed manually like real attackers: they combine findings, examine the logic of your application and thus find vulnerabilities that no scanner detects. For ongoing automated checks of your source code we additionally recommend the GitLab Security Node with SAST and DAST.
Will the test affect my website or operations?
We test in a controlled way and agree scope and time windows with you in advance. Tests that could put a heavy load on systems are only carried out after explicit agreement, on request outside your business hours or on a test environment. If we notice a critical vulnerability during the test, we inform you immediately so that you do not have to wait for the report.
What is in the report?
The report contains an easy-to-understand summary for management and a technical description of every vulnerability found, with a severity rating, evidence and a concrete recommendation for remediation. This shows you at a glance where action is needed, and your developers or service providers know exactly what to do. We go through the report together with you.
Does a pentest help with ISO 27001, NIS2 or cyber insurance?
Yes. Regular security testing is expected by ISO/IEC 27001, NIS2 and many cyber insurers. Our report with retest documents transparently that you have had your systems tested and that the vulnerabilities found have been fixed. LCube itself is certified to ISO/IEC 27001 and knows the requirements from its own experience – which helps when preparing for audits.
Do you also test systems that are not hosted at LCube?
Yes. We test websites, web applications and externally reachable servers regardless of where they are operated. A written authorisation from you as the operator is required, and coordination with your hosting provider where necessary. If your system runs at LCube, we can fix the vulnerabilities found together with you on request, for example through updates, configuration or Imunify360.
Know how secure your systems are
Request your pentest – we discuss scope and process with you personally.