AI-assisted penetration testing for web apps, portals and APIs
A pentest for your application, AI-assisted and from the outside. We explain the vulnerabilities we find in plain language and can fix them for you, too.
- 80+ projects
- 5.0 on Google
- Clients for 10+ years
- EU & GDPR first
- For web apps, customer portals, SaaS, app backends and APIs – including those built by other developers
What is AI-assisted penetration testing?
AI-assisted penetration testing is a security test in which your application is deliberately attacked, with your permission, to find vulnerabilities before anyone else does. wunderwerk uses AI-assisted, automated testing that can uncover the more serious gaps quickly and across the whole application. We then talk you through what we found, in plain language.
The security check is an honest assessment, not a certified penetration test and no guarantee that everything is secure afterwards. In the free initial consultation we clarify which application will be tested and what you want to know. You then receive a quote with a clear scope and cost estimate before we test anything.
- From the outside, the way an attacker sees it
We test what can be reached from the internet, meaning your web app, your portal and your APIs. We don’t need access to your source code for that.
- Careful and agreed with you
We agree the time window and scope with you in advance. If you have a test environment, we prefer to test there.
- Only with your written authorisation
We only test with your written authorisation and, for hosted systems, where needed the consent of your hosting provider. That way it is clear in advance what will be tested and when.
- Plain language, not jargon
You learn what we found, how critical it is and what to do first. Discussed with the managing director or a developer who answers your questions.
What does a penetration test check?
The wunderwerk pentest checks the places where web applications are most often vulnerable in practice: logins and permissions, data access, inputs, APIs, configuration and outdated components. Our yardstick is the OWASP Top 10, the well-known list of the most common security risks for web applications.
Not part of the security check: your company network, workstations and email, phishing tests and a source code review. If you need those, we can point you to specialist providers.
Vulnerability scan, AI pentest or classic pentest: which fits?
A vulnerability scan automatically looks for known flaws. A classic penetration test goes deep by hand and delivers a formal test report. The AI-assisted security check by wunderwerk sits in between: explained in plain language, and done by developers who can also fix the gaps.
Online vulnerability scan
What is tested: known vulnerabilities and misconfigurations from a fixed list
Depth: surface level, fully automated
Result: automated list of findings that you assess yourself
Formal proof of testing (e.g. for customers or insurers): no
Who fixes the gaps: you
Cost: usually low
Right for you if: you want a quick first overview
AI-assisted pentest (wunderwerk security check)
What is tested: your application from the outside: logins, permissions, data access, inputs, APIs, configuration, components
Depth: looks specifically for vulnerabilities that can actually be exploited, and proves them
Result: plain-language assessment: what, how critical, what first, explained in a call
Formal proof of testing (e.g. for customers or insurers): no, it is an assessment
Who fixes the gaps: wunderwerk if you wish, also in software built by other developers
Cost: quote by scope, cost estimate up front
Right for you if: you want to know where your application stands and want help closing the gaps
Classic, certified pentest
What is tested: the agreed scope, depending on the engagement also infrastructure and network
Depth: step by step by specialists, including flaws in complex workflows
Result: detailed test report
Formal proof of testing (e.g. for customers or insurers): depending on the provider
Who fixes the gaps: you or your developer
Cost: by quote, depending on scope
Right for you if: customers or insurers ask for formal proof of testing
To be honest: wunderwerk is not a certified pentest company. If you need formal proof of testing, for example for customers or insurers, we can point you to specialist providers. With the security check, the more serious gaps can be found and closed beforehand.
How the security check works
Five steps from the free initial consultation to deciding what happens next. Before we test, you receive a quote with a clear scope and cost estimate, and we only test with your written authorisation.
- 1
Free initial consultation
In the free initial consultation we clarify which application will be tested and what you want to know: its web address, what it does, who built it and what worries you. Online, directly with the managing director.
- 2
Quote and written authorisation
You then receive a quote with a clear scope and cost estimate before we test anything. If it suits you, we obtain your written authorisation and, for hosted systems, where needed that of your hosting provider, and agree the time window with you.
- 3
AI-assisted test from the outside
We test your application with AI-assisted, automated methods, the way an attacker sees it from the internet. Carefully and in the agreed time window, preferably on a test environment if you have one.
- 4
Results in plain language, discussed
Instead of a report full of jargon, you get an assessment you can understand: what we found, how critical it is and what to do first. We go through it with you, with the managing director or a developer, the people who can also fix things.
- 5
You decide what happens next
Fix it yourself, have wunderwerk harden it, or, if you need formal proof of testing, a certified pentest by a specialist provider; we can point you to some. For anything we take on, you get a cost estimate first.
Thank you very much!
I will get back to you with a proposal for the scope and cost of the security check.
If it’s urgent, book an appointment in my calendar right away: Book an initial consultation
Finding gaps is half the job. We close them.
A test report alone doesn’t make an application secure. wunderwerk is a small developer team with more than 20 years of project experience: we fix what the security check finds and, if you wish, keep looking after your application so it stays up to date.
We fix the findings in the code, install updates and correct the configuration, also in software built by another developer. Afterwards we check again that the gap really is closed.
New features and updates can open new gaps. We test your application again after major changes and at intervals that suit the pace of your development.
Nobody looks after your application any more? We take it over after an analysis, keep it current with updates and monitoring and, if you like, host it in the EU. We have been looking after many of our clients for more than ten years.
If a customer or your insurer asks for formal proof of testing, we can point you to specialist providers.
Not just clients. Partners.
We focus on long-term partnerships. You stay flexible thanks to open standards and clear documentation.
What our clients say:
A selection of our client feedback.
★★★★★Many thanks for building and looking after our online learning platform.
We can wholeheartedly recommend Christoph and his entire team.
Whatever we ask for, almost everything is made possible, and the ongoing personal contact works brilliantly too. Many thanks.
We run the online shop thecurtain.shop for made-to-measure curtains and Roman blinds.
Working with wunderwerk was excellent in every respect.
Thanks to their work, we can offer our customers an intuitive, professional shopping experience that perfectly reflects our craftsmanship. Many thanks for the great collaboration!
Very likeable wunderworkers! Fast, uncomplicated, competent and always ready to save the world!
Highly competent support. Well advised all round.
Chris knows how to solve a problem. Quality has a name: wunderwerk.io
We had the wunderworkers develop bespoke industrial software for creating recipes for a highly sensitive industrial process.
The collaboration was extremely professional from the outset: the team quickly understood our complex requirements, implemented them precisely and always paid close attention to maximum reliability and security. I would particularly like to highlight their technical know-how, clean documentation and fast response times for questions or change requests.
The recipe editor is now running in several plants in Sweden, Italy and the Czech Republic.
The software runs reliably, is intuitive to use and our customers are completely satisfied. We can recommend wunderwerk without reservation!
wunderwerk built a digital solution for my photography business that has been running stably and reliably for years. The support is top-notch, reliable and competent. I can only recommend them.
Christoph Niedermoser and his team impressed us with their professionalism, precision and reliability, both in the consulting phase and in the implementation that followed.
Our requirements were implemented perfectly, and the GPS tracking system has now been in successful use in several of our facilities for a number of years.
Chris and his team gave me superb advice on my app idea. Uncomplicated, fast and professional! Highly recommended!
We have already implemented and completed several projects together over the past few years.
Professional implementation and personal contact.
Highly recommended!
Perfect implementation of our
billiards platform.
A very pleasant collaboration. It was fun! Highly recommended!
Why us?
What else is on your mind?
Many projects touch more than one topic. Here are the other areas in which we support businesses.
Know where your application stands.
Hope is not a security strategy. In the free initial consultation we clarify which application will be tested and what you want to know. You then receive a quote with a clear scope and cost estimate before we test anything. With developers at your side who don’t just test, but fix.
Frequently asked questions about penetration testing
Question not listed? We will answer it directly with the managing director in the free initial consultation.
How much does a penetration test cost?
What a penetration test by wunderwerk costs depends on the scope: how many applications, roles and APIs are tested and how deep the testing goes. The initial consultation is free; in it we clarify which application will be tested and what you want to know. You then receive a quote with a clear scope and cost estimate before we test anything. The same applies to any hardening afterwards: a cost estimate before each step. Book the initial consultation or describe your application in the form.
How long does a pentest take?
How long a pentest takes depends mainly on the size of the application and on how quickly the written authorisation is in place. We plan the time window of the test and the results call together with you, and with the quote you know in advance what to expect.
What does a penetration test check?
A penetration test checks whether an application can be attacked from the outside, that is, whether someone can get at data or functions not meant for them. In the wunderwerk security check, that means logins and permissions, access to other customers’ data, inputs and forms, APIs, configuration and outdated components, guided by the OWASP Top 10. It does not cover your company network, workstations, phishing tests or a source code review.
AI pentest or classic pentest?
An AI-assisted pentest is well suited to finding out quickly and across the board where an application is vulnerable. A classic, manual pentest goes deep by hand and delivers a formal test report. For many companies, the AI-assisted security check by wunderwerk is a sensible first step: it shows where you stand, the more serious gaps can be closed, and a later classic pentest becomes more targeted. If you need formal proof of testing, for example for customers or insurers, we can point you to specialist providers.
Vulnerability scan or pentest, what’s the difference?
A vulnerability scan automatically checks for known flaws and misconfigurations and produces a list of findings. A penetration test goes further: it checks whether vulnerabilities can actually be exploited, for example whether a user really can reach someone else’s data, and assesses how critical that is. The wunderwerk security check is an AI-assisted pentest, not just a scan, and the result is explained to you in plain language.
Can the test disrupt our operations?
wunderwerk tests carefully and agrees the scope and time window with you in advance, so the test doesn’t fall into your busiest hours. If you have a test environment, we prefer to test there. What that means for your application we discuss openly in the initial consultation, before we start.
Do you also test apps and APIs?
Yes. Besides web apps and customer portals, wunderwerk also tests SaaS applications, APIs and the backends of mobile apps, meaning the servers a mobile app exchanges its data with. That is often where it shows whether an API gives away more data than the app displays.
How often should you run a pentest?
Test your application regularly and also after major changes, such as a new feature, a new login or a new API, because changes can open new gaps. How often exactly depends on how frequently your application is developed further and how sensitive the data is. For applications we look after, wunderwerk can retest after major releases.
What happens if you find vulnerabilities?
If wunderwerk finds vulnerabilities in the security check, the results call tells you how critical they are and what to do first. Then you decide: fix them yourself or with your developer, have wunderwerk harden the application, or follow up with a certified pentest by a specialist. If we do the hardening, we close the gaps in the code, install updates and retest, also in software built by another developer. More on taking over existing software is on software modernisation.
Why wunderwerk for penetration testing?
wunderwerk is not just a testing company but a small developer team with more than 20 years of project experience from over 80 projects. We don’t just test, we also close the gaps we find and, if you wish, look after applications for years, many clients for more than ten. You talk directly to the managing director, get an honest assessment and, if a certified pentest is needed, an honest pointer to specialist providers rather than a sales pitch. How we build software ourselves is described under secure software development, and everything about the security check under security check for web apps.