Everything on penetration testing.
Provider selection, cost, types (webapp, API, cloud, Active Directory, red team), Pentest-as-a-Service, TLPT under DORA. Plus a free 30-minute external check as an entry point.
English articles
- Penetration Testing Cost UK 2026: Real Day Rates and Project Prices, With Sources2026-08-19
What a penetration test costs in the UK in 2026. Supplier-declared day rates from the government Digital Marketplace, published vendor rate cards, and what drives the price. Every figure carries its source.
- Penetration Testing Cost USA 2026: Published Prices, Scope Ranges and What the Rules Actually Require2026-08-19
What a penetration test costs in the United States in 2026. Prices vendors publish openly, dated scope ranges, and the US rules that do and do not require a pentest. Every figure carries its source.
- Penetration Testing Providers UK 2026: How to Choose, What They Cost, Which Accreditation You Actually Need2026-08-19
A buyer's guide to UK penetration testing providers in 2026. The four provider types, what CREST and CHECK really mean, which UK schemes are mandatory, published prices, and the questions to ask before you sign.
- Pentest Providers in Germany 2026: Comparison, Selection Criteria, Cost2026-04-19
How to pick the right pentest provider in Germany: certifications, pricing models, strengths of classic consultancies vs. PTaaS platforms. Decision guide for IT and security leaders.
- Vulnerability Management: The Complete Guide 20262026-04-19
Vulnerability management explained: lifecycle, prioritization with EPSS and KEV, SLAs, KPIs, and how to build a program for NIS2, DORA, ISO 27001, and SOC 2 compliance.
- AI Penetration Testing: The Complete Guide to AI-Powered Security Testing2026-03-09
How AI penetration testing works, what it can find, its limitations, and how it compares to traditional tools. The definitive guide to AI-powered pentesting in 2026.
- Automated vs Manual Penetration Testing: A Complete Comparison for 20262026-03-09
Compare automated vs manual penetration testing: costs, coverage, speed, and compliance. Learn when each approach works and why AI pentesting changes the game.
- Pentest as a Service (PTaaS): The Complete Guide for 20262026-03-09
What is Pentest as a Service? Learn how PTaaS works, pricing models, compliance benefits, and what to look for in a platform. Compare PTaaS vs traditional pentesting.
- TLPT Under DORA: The Complete Guide to Threat-Led Penetration Testing2026-02-18
In the realm of European financial regulation, DORA (Directive on operational resilience for financial institutions) has set a new bar for cybersecurity practices
- PCI DSS Penetration Testing and Vulnerability Management2026-02-16
Step 1: Open your PCI DSS compliance dashboard. If it's outdated or lacks recent testing results, schedule an update
Deutsche Artikel
- Active Directory Pentest: Den haeufigsten Angriffsweg deutscher Unternehmen pruefen2026-04-19
Active Directory Pentest praxisnah: Kerberoasting, AS-REP Roasting, AD CS, BloodHound-Analyse, Mitigation. Fuer Mittelstaendler mit klassischer Windows-Domain.
- API-Pentest: Pruefung von REST-, GraphQL- und SOAP-APIs 20262026-04-19
API-Pentest praxisnah: OWASP API Top 10, REST/GraphQL/SOAP-Spezifika, Authentifizierungspruefung, typische Findings und Kosten. Fuer SaaS-Anbieter und integrationsstarke Architekturen.
- Blue Team und Purple Team: Verteidigung modern aufstellen 20262026-04-19
Blue Team und Purple Team erklaert: Aufbau eines SOC, Detection Engineering, MITRE ATT&CK, Purple-Team-Workshops, KPIs und Toolchain. Fuer CISOs und Security-Leads.
- Cloud-Pentest: AWS, Azure und GCP sicher pruefen 20262026-04-19
Cloud-Pentest fuer AWS, Azure, GCP und Kubernetes: Provider-Regeln, IAM-Pruefung, CSPM, typische Misconfigurations und Kosten. Fuer Cloud-first-Unternehmen.
- NIS2 und Penetrationstests: Was Artikel 21 wirklich von Ihnen fordert2026-04-19
Schreibt NIS2 Pentests vor? Was Artikel 21 zur regelmaessigen Bewertung fordert, wie Aufsichtsbehoerden das interpretieren und welche Pentests Sie 2026 wirklich brauchen.
- Patch-Management-Software 2026: Vergleich, Auswahlkriterien und Best Practices2026-04-19
Patch-Management-Software im Vergleich: Microsoft Intune, ManageEngine, Tanium, Action1, NinjaOne. Auswahlkriterien, Kosten und Integration in Schwachstellenmanagement-Programme.
- Pentest-Anbieter in Deutschland 2026: Vergleich, Auswahlkriterien, Kosten2026-04-19
Pentest-Anbieter richtig auswaehlen: Zertifizierungen, Preismodelle, Staerken klassischer Dienstleister vs. PTaaS-Plattformen. Entscheidungshilfe fuer IT-Verantwortliche.
- Pentest as a Service (PTaaS): Warum kontinuierliche Pentests klassische Projekte ersetzen2026-04-19
Pentest as a Service erklaert: Funktionsweise, Vorteile gegenueber klassischen Pentests, Kosten, Anbietervergleich und wann sich PTaaS fuer deutsche Unternehmen lohnt.
- Pentest-Kosten 2026: Was ein Penetrationstest in Deutschland wirklich kostet2026-04-19
Pentest-Kosten transparent: Tagessaetze, Projektpreise nach Scope, PTaaS-Abos. Plus Rechenbeispiele fuer NIS2-, DORA- und ISO-27001-pflichtige Unternehmen.
- Phishing-Simulation 2026: Anbieter, Methodik und was wirklich funktioniert2026-04-19
Phishing-Simulation als Teil der IT-Sicherheit: Anbieter-Vergleich, Methodik, Click-Rates, rechtliche Rahmenbedingungen, Kosten. Plus Integration in NIS2- und ISO-27001-Programme.
- Red Teaming: Der vollstaendige Leitfaden 20262026-04-19
Red Teaming praxisnah: Unterschied zu Pentest, Phasen, MITRE ATT&CK, Kosten und wann es sich fuer deutsche Unternehmen lohnt. Plus DORA TLPT und TIBER-EU.
- Schwachstellen-Scanner 2026: Tool-Vergleich, Funktionen, Kosten2026-04-19
Schwachstellen-Scanner im Vergleich: Nessus, Qualys, Rapid7, Greenbone/OpenVAS, Wiz, Tenable. Auswahlkriterien, Preise, Einsatzszenarien fuer NIS2- und ISO-27001-Programme.
- Schwachstellenanalyse vs. Pentest: Welches Verfahren Sie wann brauchen2026-04-19
Schwachstellenanalyse oder Penetrationstest? Unterschiede, Kosten, Einsatzszenarien und was NIS2, DORA und ISO 27001 tatsaechlich fordern.
- ISO 27001 Schwachstellenmanagement: Der vollstaendige Leitfaden 20262026-04-19
ISO 27001 Schwachstellenmanagement praxisnah: Annex A 8.8, Lebenszyklus, Tools, KPIs, Reifegradmodell und konkrete Umsetzung fuer NIS2, DORA und ISO 27001. Fuer CISOs und IT-Leiter.
- Webapp-Pentest: Leitfaden fuer die Pruefung von Webanwendungen 20262026-04-19
Webapplikations-Pentest praxisnah: OWASP-Top-10, Scope, typische Findings, Kosten und wie Sie den Test optimal vorbereiten. Fuer IT-Leiter und Produktmanager.
- Penetrationstest: Der vollstaendige Leitfaden fuer IT-Entscheider in Deutschland2026-03-09
Penetrationstest kompakt: Typen, Kosten, BSI-Standards, DORA-Pflichten und warum automatisierte Pentests die Zukunft der IT-Sicherheit sind.
- DSGVO Pentest: Warum Penetrationstests fuer den Datenschutz unverzichtbar sind2026-03-09
DSGVO und Penetrationstests: Warum Art. 32 DSGVO Pentests fordert, wie Sie Tests dokumentieren und was Aufsichtsbehoerden erwarten.
- TLPT unter DORA: Das vollständige Handbuch zum Bedrohungsgeführten Penetrationstesten2026-02-18
In the realm of European financial regulation, DORA (Directive on operational resilience for financial institutions) has set a new bar for cybersecurity practices
- PCI DSS Penetrationstest und Verwaltung von Schwachstellen2026-02-16
Step 1: Open your PCI DSS compliance dashboard. If it's outdated or lacks recent testing results, schedule an update
Compare to alternatives
Frequently asked questions
What does a penetration test cost in Germany?+
Ranges EUR 5,000 (small perimeter check) to EUR 250,000 (full TLPT under DORA). Typical mid-market spend: EUR 25-60k annually. Pentest-as-a-Service subscriptions: EUR 10-145k/year with continuous coverage.
Classical pentest vs Pentest-as-a-Service?+
Classical: one-time project, 2-4 week engagement, point-in-time report. PTaaS: continuous coverage via platform, periodic deep-dive by human testers, integrated ticketing and compliance mapping. Whether PTaaS costs less over a year depends on how many tests you run and what each provider charges; we publish no comparative saving figure because no source we trust publishes one.
Who needs TLPT?+
TLPT (Threat-Led Penetration Testing per TIBER-EU) is required for significant financial entities under DORA Art. 26-27. Typically systemically important banks, major insurers, central market infrastructures. Mandated at minimum every 3 years. Cost: EUR 90-280k per engagement. Smaller financial entities do standard pentesting.
Ready to tackle Pentest?
Matproof covers Pentest in one EU-hosted platform alongside 10 other frameworks. 30-minute demo tailored to your scope.