Is your application secure? We’ll check it.
A web app, portal or app holding customer data? wunderwerk checks it from the outside and tells you in plain words where we found gaps.
- 80+ projects
- 5.0 on Google
- Clients for 10+ years
- EU & GDPR first
- For web apps, portals, SaaS, apps and APIs – including those built by other developers
Is what we’re running actually secure?
Behind this question there is rarely a specific incident. Usually it is an application with customer data that runs well, and nobody in-house who can say with confidence how secure it is. In these five situations, the wunderwerk security check brings clarity.
“The agency no longer exists, and the freelancer from back then doesn’t reply.”
Nobody knows the code, nobody installs updates. The security check shows where we found gaps from the outside, without anyone having to explain the code to you.
“Our portal was up in a few weeks. Now it holds real customer data.”
AI tools build what you ask for in no time. Whether every user only sees their own data is a question nobody tends to ask. We take a look before someone else does.
“A major customer sent us a security questionnaire, and we don’t know which boxes to tick.”
Customer audit, tender or insurance: the security check shows where you stand. If you need formal proof of testing, we can point you to specialist providers.
“The application has run smoothly for years. Nobody has touched it since.”
Software ages even when it runs smoothly: components stop getting security updates, known vulnerabilities stay open. The check shows which parts are visibly outdated from the outside.
“A competitor’s customer data turned up online. Could that happen to us too?”
A new vulnerability like PHP2Shell or a data leak in your own industry suddenly makes the question urgent. The security check gives you a factual answer instead of an uneasy feeling.
Describe your application in a few sentences. We’ll tell you whether and how we can check it and what effort to expect.
What does the security check cover?
The wunderwerk security check is an AI-assisted penetration test from the outside: we examine your web app, portal or API the way an attacker on the internet sees it. Only with your written authorisation, carefully and in agreement with you.
What it is not: not a certified penetration test, not a review of your company network or your staff, and no guarantee that everything is secure afterwards. It targets the more serious gaps and gives you an assessment quickly. We’re happy to explain how it differs from a full penetration test.
- Logins and access rights
Can someone reach areas that should be protected without logging in? Does a customer see only their own data, or someone else’s too?
- Customer data
Can names, addresses, documents or invoices be retrieved that must not be public? A data leak is what would hit you hardest.
- Interfaces (APIs)
The connections to your app, shop or ERP are often less protected than the user interface. We check whether they reveal more than they should.
- Outdated components
Frameworks, libraries and server software with known vulnerabilities for which updates have long been available.
- Configuration
Exposed admin panels, forgotten test accounts, missing encryption, error messages that give away too much.
- The most common vulnerabilities per the OWASP Top 10
The OWASP Top 10 is the best-known list of the most common security risks in web applications. We use it as a checklist for the fundamental risks.
How does the security check work?
The wunderwerk security check takes four steps: a free initial consultation followed by a quote, written authorisation, the test from the outside and the results in a conversation. Before we test, you know what will be checked and what it will cost.
- 1
Consultation and quote
In a free initial consultation we clarify which application to check and what you want to know: what it does, who built it, what worries you. Then you get a quote with a clear scope and cost estimate before we test anything.
- 2
Your written authorisation
We only test with your written authorisation. In it we record together which application, which addresses and which time window will be tested, and who your contact person is. If the application runs with a hosting provider, we coordinate the test with them as well where needed.
- 3
The test: from the outside, AI-assisted
We examine your application from the outside, AI-assisted and automated, the way an attacker on the internet sees it. Carefully and in agreement with you, preferably on a test environment if there is one. Before findings go into your assessment, a developer reviews them.
- 4
Results in a conversation
You get a plain-language initial assessment: what we found, how critical it is and what to do first. Not an 80-page report full of jargon, but a conversation with the managing director or a developer who answers your questions.
Thank you very much!
I will get back to you with a proposal for the scope and cost of the check.
If it’s urgent, book an appointment in my calendar right away: Book an initial consultation
After the check, you decide
After the security check there are three ways forward: you fix the issues yourself, wunderwerk secures the application and looks after it, or you commission a certified penetration test from a specialist. We tell you openly which route suits you, even if it isn’t us.
Finding vulnerabilities is the start. We fix them.
A test report alone doesn’t make an application secure. Otherwise the fixing is left to you, and often there is no one left who can do it. wunderwerk is a small team of developers with more than 20 years of project experience and 80+ projects: we check, fix and look after your application, all from one team.
- Security built in
In software we build ourselves, security is part of the design from day one, not bolted on afterwards. Read how we do it in secure software development.
- Software that has run for more than 10 years
We have worked with many clients for 10 to 15 years, with ongoing updates and further development. We know what an application needs to stay up to date and well maintained for years.
- A direct line, hosting in the EU
You talk directly to our managing director Christoph Niedermoser, not to a call centre. Hosting and operation in the EU.
- Honest, even when we’re not the right fit
If you need formal proof of testing, we can point you to specialist providers rather than promise something we can’t deliver.
Not just clients. Partners.
We focus on long-term partnerships. You stay flexible thanks to open standards and clear documentation.
What our clients say:
A selection of our client feedback.
★★★★★Many thanks for building and looking after our online learning platform.
We can wholeheartedly recommend Christoph and his entire team.
Whatever we ask for, almost everything is made possible, and the ongoing personal contact works brilliantly too. Many thanks.
We run the online shop thecurtain.shop for made-to-measure curtains and Roman blinds.
Working with wunderwerk was excellent in every respect.
Thanks to their work, we can offer our customers an intuitive, professional shopping experience that perfectly reflects our craftsmanship. Many thanks for the great collaboration!
Very likeable wunderworkers! Fast, uncomplicated, competent and always ready to save the world!
Highly competent support. Well advised all round.
Chris knows how to solve a problem. Quality has a name: wunderwerk.io
We had the wunderworkers develop bespoke industrial software for creating recipes for a highly sensitive industrial process.
The collaboration was extremely professional from the outset: the team quickly understood our complex requirements, implemented them precisely and always paid close attention to maximum reliability and security. I would particularly like to highlight their technical know-how, clean documentation and fast response times for questions or change requests.
The recipe editor is now running in several plants in Sweden, Italy and the Czech Republic.
The software runs reliably, is intuitive to use and our customers are completely satisfied. We can recommend wunderwerk without reservation!
wunderwerk built a digital solution for my photography business that has been running stably and reliably for years. The support is top-notch, reliable and competent. I can only recommend them.
Christoph Niedermoser and his team impressed us with their professionalism, precision and reliability, both in the consulting phase and in the implementation that followed.
Our requirements were implemented perfectly, and the GPS tracking system has now been in successful use in several of our facilities for a number of years.
Chris and his team gave me superb advice on my app idea. Uncomplicated, fast and professional! Highly recommended!
We have already implemented and completed several projects together over the past few years.
Professional implementation and personal contact.
Highly recommended!
Perfect implementation of our
billiards platform.
A very pleasant collaboration. It was fun! Highly recommended!
Facts, not a hunch.
In a free initial consultation we clarify which application to check and what you want to know. Then you get a quote with a clear scope and cost estimate before we test anything.
Frequently asked questions about the security check
Your question isn’t here? We’ll answer it directly with our managing director in a free initial consultation.
What is wunderwerk’s security check?
The wunderwerk security check is an initial assessment of the security of your existing web application, portal, app or API. With your written authorisation, we examine it from the outside, AI-assisted, carefully and in agreement with you, and go through the results with you in plain language: what we found, how critical it is and what to do first. It is aimed at companies in Austria, Germany and Switzerland that run an application and want to know where they stand.
What does the security check examine?
In the security check, wunderwerk examines what can be attacked from the outside: logins and access rights, whether customer data can be reached by unauthorised people, interfaces to your app, shop or ERP, outdated components with known vulnerabilities, and the configuration, such as exposed admin panels or missing encryption. Our checklist is the OWASP Top 10, the best-known list of the most common vulnerabilities in web applications. Your company network, workstations and staff (for example phishing tests) are not part of the check.
Is the security check a certified penetration test?
No. The wunderwerk security check is an AI-assisted penetration test from the outside, but not a certified penetration test and no guarantee that everything is secure afterwards. It targets the more serious gaps and gives you an honest assessment quickly. If customers or insurers ask for formal proof of testing, we can point you to specialist providers. Find out more on our page about penetration testing for web applications.
| wunderwerk security check | Penetration test by a specialist | |
|---|---|---|
| Goal | Know where you stand and find the more serious gaps | In-depth testing to an agreed scope |
| Approach | From the outside, AI-assisted, careful and coordinated | Manual, by specialist testers |
| Result | Plain-language assessment in a conversation | Detailed test report |
| Formal proof of testing (e.g. for customers or insurers) | No | Depends on the provider |
| Cost | Quote based on scope, cost estimate up front | As quoted by the testing firm |
| Provider | wunderwerk | Specialist providers; we can point you to some on request |
What does the security check cost?
The initial consultation with wunderwerk is free and non-binding. The security check itself, like a penetration test, is quoted based on scope: after the consultation you get a quote with a clear scope and cost estimate before we test anything. We don’t quote flat prices because the effort depends on the size and structure of your application. For anything that follows, such as closing gaps or maintenance, you also get a cost estimate before every step.
Why do you only test with written authorisation?
wunderwerk only tests with written authorisation because a security test needs clear arrangements: which application, which addresses, which time window and who your contact person is. If the application runs with a hosting or cloud provider, we coordinate the test with them as well where needed. That way everyone involved knows in advance what happens when.
How does the test fit around our day-to-day business?
wunderwerk tests carefully and coordinates the test with you: we agree scope, timing and contact persons in advance so that it doesn’t fall into a critical period. If there is a test environment, we prefer to test there. How to prepare, for example with an up-to-date backup, we discuss with you in the initial consultation.
How long does the security check take?
How long the test itself takes depends on the size and scope of your application; we state the schedule in the quote and agree the date for the results conversation with you once we have your authorisation.
Is my website secure, and how do I test it for vulnerabilities?
Only a test shows where a website or web application stands on security. Online scanners check surface-level things such as encryption and visible software versions; for a purely informational website, that is often enough. As soon as there are logins, customer data, orders or interfaces, it takes more: someone has to check whether unauthorised people can get at data. That is exactly what the wunderwerk security check does for web apps, portals, shops with their own back end and APIs.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment (or vulnerability scan) searches automatically for known weaknesses, such as outdated components, and lists them. A penetration test goes further: it deliberately tries to exploit weaknesses and so shows what an attacker could actually achieve. The wunderwerk security check is an AI-assisted penetration test from the outside: it examines your application from an attacker’s point of view and so goes further than a plain scan, but it does not replace a thorough, certified penetration test by a specialist.
We didn’t build the application ourselves. Can you still check it?
Yes. For the security check we need neither the code nor the original developer: wunderwerk examines the application from the outside, the way an attacker sees it. You give us your written authorisation for the test. If you want us to close the gaps afterwards, we need access to the code, server and database. Taking over software from other developers is everyday work for us; find out more under software modernisation.
Who is behind the security check?
The security check is offered by wunderwerk software GmbH, a small team of developers based in St. Ulrich am Pillersee in Tyrol, with offices in Salzburg, Vienna and Berlin. We bring more than 20 years of project experience from over 80 projects and have worked with many clients for more than ten years. You talk directly to our managing director Christoph Niedermoser. Hosting and operation are in the EU.