Penetration testing for your internet-facing applications.
Tyvar attacks your domains, web applications and APIs the way real attackers do. But only under rules you sign first. An analyst checks every finding before you see it.
Real attacks. Signed rules.
We use the same techniques as real attackers. You set the rules in writing beforehand, with fixed Source-IPs, agreed testing windows and an Emergency Stop on each side.
Two services.
With both services we only test what can be reached from the internet, and only with written authorization. You get a report your engineers can work with right away.
-
One time
External Penetration Testing
We test the domains, web applications and APIs you put on the internet. The OWASP Web Security Testing Guide is the starting point, and we add newer attack classes on top. For every asset we write down what was tested, so gaps stay visible.
-
Recurring
Attack Surface Monitoring
Your setup keeps changing after a penetration test. With monitoring we map your external attack surface again on a fixed schedule, tell you what changed since last time and test the exposed assets again. An analyst checks every result. Real-time alerting and SOC services are not part of it.
Authorization first.
In Germany, accessing systems you do not own without permission is a crime under sections 202a and following of the Criminal Code. So these rules apply to every engagement.
-
Written authorization
The owner of the systems signs a testing agreement. Where the hoster or cloud provider requires it, they agree too. Only then does the first packet go out.
-
Fixed Source-IPs
We only test from the addresses named in the agreement. Your monitoring can allow-list them or keep an eye on them.
-
Agreed testing windows
We only test inside the agreed windows and only the targets on the list. The exclusions stay untouched.
-
Emergency Stop
Each side has one contact who can stop the test right away with a phone call.
-
No destructive testing
We do not run denial of service attacks or delete data. We only touch production data as far as a finding needs it as evidence.
How an engagement runs.
-
Scoping call
We agree on targets, exclusions, the testing window and who the contacts are on each side. Then you get a written scope proposal.
-
Written authorization
You sign the testing agreement. It lists the fixed Source-IPs, the testing windows and the Emergency Stop contact for each side. We test nothing before that.
-
Attack surface mapping
We record subdomains, exposed services, certificates and the technology in use. You get this inventory with your report.
-
Testing
The OWASP Web Security Testing Guide is the starting point. On top come newer attack classes such as HTTP request smuggling, web cache poisoning, GraphQL, JWT or OAuth flows. For every asset we write down what was tested.
-
Verification
An analyst reproduces every finding before it goes into the report. Unchecked scanner output never ends up there.
-
Report and debrief
An executive summary for management. Technical findings with severity, evidence, steps to reproduce and a fix. And a closing call.
-
Retest
If you want, we check your fixes again and update the report.
What you receive.
The report is written for management and for your engineers. You can also show it to customers and insurers, or use it for the effectiveness assessment NIS2 expects from the companies it covers.
-
Executive summary
One page for management that sums up the risk.
-
Attack surface inventory
Subdomains, services, certificates and technology from the mapping. Including assets you did not know you had.
-
Findings
Each one with severity, evidence, steps to reproduce and how to fix it. An analyst has checked every one.
-
Coverage per asset
What we tested, what was clean and what we could not test. With the reason.
-
Closing call and retest
One call for management and engineering. A retest if you want one. The report comes as an encrypted archive and the password comes another way.
Scope and out of scope.
If a test needs more than an internet connection and your written authorization, it is out of scope.
In scope
- Domains and subdomainsEverything that resolves under your domains gets mapped first and tested after.
- Web applicationsOWASP as the starting point, plus newer attack classes.
- APIs, REST and GraphQLBroken authorization between objects and roles is the most common serious finding.
- Login flows, including OAuthWe test login, password reset, sessions, tokens and single sign-on as one chain.
- Exposed services and admin panelsManagement interfaces, databases, mail and remote access that answer from the internet.
- TLS and certificatesProtocol versions, cipher suites, certificate chains and hostnames.
- Email security with SPF, DKIM and DMARCWeak records let anyone send mail in your name.
- Logged-in testing of a web applicationOptional, with test accounts you give us.
Out of scope
- Internal networks and Active DirectoryNot reachable from the internet. We do not offer this today.
- VPN or on-site accessWe test from the outside, from the addresses in the agreement.
- Social engineering and phishingTyvar tests systems and sends no mail to your staff.
- Denial of serviceIt hurts availability and tells you nothing about your security.
- Physical testingTyvar tests what the internet can reach.
- Cloud configuration reviews, red teaming, whitebox reviewsNot offered today.
How AI and the analyst work together.
AI agents cover a lot of ground quickly. A person decides what goes into the report.
AI agents give Tyvar breadth and speed across the whole attack surface. They enumerate, fingerprint and probe faster than a person can. The analyst steers that work, follows the leads that matter and tests the logic no checklist covers.
Before a finding gets written up, a person reproduces it on the live target. Anything that cannot be reproduced is dropped or marked as an observation. You never get scanner output nobody has read. The AI analysis runs at a third-party provider under contractual data protection terms. All subprocessors are listed in the data processing agreement you get before the test. The provider is named there.
Questions and answers.
What is an external penetration test?
A test of the systems your organization puts on the internet. That means domains, web applications, APIs and exposed services. We test from the outside with the same techniques real attackers use. But only under rules you sign first. You get a report with checked findings your engineers can work through right away.
What does Tyvar test, and what does it not?
We test what belongs to you and can be reached from the internet. That covers domains, web applications, APIs, login flows, exposed services, TLS and email security records. Out of scope are internal networks, VPN access, social engineering, phishing, denial of service and physical testing. Internal networks, Active Directory, cloud configuration reviews and red teaming are not offered today.
Do we need a written authorization?
Yes, always. In Germany, accessing systems you do not own without permission is a crime under sections 202a and following of the Criminal Code (StGB). A penetration test is only legal if the person entitled to allow it says yes first. So the signature comes before the first packet. The testing agreement names targets, exclusions, fixed Source-IPs, testing windows and an Emergency Stop contact on each side.
Will the test affect our operations?
It is planned so that it does not. No denial of service, no destructive tests, and work only inside the agreed windows. Your Emergency Stop contact can call it off at any time. If a system acts strangely under normal requests, that is a finding in itself. We report it and stop pushing there.
Does Tyvar use AI?
Yes, and we say so openly. AI agents give us breadth and speed across the whole attack surface. A person reproduces every finding and decides what goes into the report. The AI analysis runs at a third-party provider under contractual data protection terms. All subprocessors are listed in the data processing agreement.
What do we get at the end?
A report with an executive summary and the attack surface inventory. Every finding comes with severity, evidence, steps to reproduce and a fix. You also get the coverage per asset and a closing call. If you want, we test your fixes again. The report comes as an encrypted archive and the password comes another way.
What is attack surface monitoring, and what is it not?
We map your external attack surface again on a fixed schedule. You learn which assets are new or gone, and we test the exposed services again. An analyst checks every result. It is not real-time alerting and it is not a security operations center.
What does a test cost?
It depends on how many hosts and applications there are and how deep we go. After the scoping call you get a written proposal with a fixed price. There is no price list here or on tyvar.de. Without a scope we cannot give you a reliable price.
Send us your domains.
Send us the domains and applications you want tested. You get a scope proposal, a fixed price and a time for the call. Testing only starts after you sign.
To keep attackers blocked, NxtFireGuard keeps the IP blocklists of your firewalls current (nxtfireguard.de).