Pentest Factory

What Pentest Factory does

Pentest Factory GmbH is a German penetration testing services firm founded in 2019 and headquartered in Geldern, North Rhine-Westphalia, with additional offices in Berlin and Frankfurt. The company is a subsidiary of the tacticx Gruppe and operates as a boutique consultancy with 1–10 employees, specializing exclusively in offensive security testing for SMEs and enterprises in the DACH region. Its service portfolio spans infrastructure testing (external/internal IT, Active Directory, OT/SCADA), application testing (web, API, mobile, rich-client, AI/LLM), security audits (workstation, password, OSINT, configuration), and scenario-based engagements (red/purple teaming, phishing, social engineering, vulnerability scanning), complemented by a recurring Pentesting-as-a-Service offering and framework agreements for associations and central procurement bodies.

The company's core proprietary technology is the Pentest-Konfigurator 2.0, an online self-service tool that allows customers to configure customized pentest engagements and receive instant fixed-price quotes, with downstream hand-off to OSCP-certified in-house consultants. The firm differentiates on a 100% in-house OSCP-certified tester base, a 4-eyes-principle quality assurance process, and ISO 27001 certification of its information security management system. Its go-to-market combines product-led growth (configurator, content marketing, public GitHub tools and CTF challenges, a free CVE database) with sales-led expert consultation for enterprise and compliance-driven engagements, particularly around NIS2, DORA, and ISO 27001. Revenue is generated through fixed-price project fees, recurring subscriptions, and framework agreements, all sold direct with no third-party resellers, and execution is delivered both remotely and on-site across Germany.

Name

Pentest Factory

Legal name

Pentest Factory GmbH

Website

https://pentestfactory.de

Company type

Private

Founded year

2019

Operating status

Operating

Headcount range

1–10 employees

Short description

Pentest Factory is a German boutique cybersecurity consultancy (founded 2019, Geldern HQ, Berlin and Frankfurt offices) that delivers OSCP-certified, in-house penetration testing services — across web, API, mobile, Active Directory, OT/SCADA, and AI/LLM applications — to DACH SMEs and enterprises via an online configurator with fixed pricing.

Ownership category

akta.pro rank

Product category

Penetration Testing Services

NAICS

Testing Laboratories and Services (54138)

akta.pro primary industry

Penetration Testing & Red Teaming (BPAKAHAF)

akta.pro secondary industry

Vulnerability Management & Penetration Testing Services (BPAEADAD)

Keywords

• Penetration testing services
• Cybersecurity assessments
• IT infrastructure security
• Web application security
• Red team operations

Headquarters

HQ city

Geldern

HQ country

Germany

HQ region

Europe

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Professional Penetration Testing Services: One-time and recurring penetration testing engagements for web applications, IT infrastructure, APIs, mobile apps, Active Directory, and red teaming. Services are priced via online configurator with fixed-price guarantee or custom quotes for specialized requirements.
2. Pentesting as a Service: Continuous security testing services providing ongoing monitoring beyond single point-in-time assessments
3. Framework Agreements: Pre-negotiated service agreements with associations, central procurement organizations, and partners for volume pricing

Pricing tiers

Go-to-market motion2 records

Distribution channels3 records

Marketing channels4 records

Core offering

Pentest Factory GmbH is a German cybersecurity services company specializing in penetration testing of IT infrastructure, web applications, APIs, mobile apps, Active Directory environments, and OT/SCADA systems. The company delivers services through an online self-service configurator that provides instant transparent pricing and fixed-price guarantees, with all assessments executed by OSCP-certified in-house penetration testers.

Product overview

Pentest Factory is a penetration testing and security analysis company offering a portfolio of security services. The core product is the Konfigurator, an online self-service tool that allows customers to configure and order customized pentests with transparent, fixed pricing. Services span four main categories: (1) Infrastructure testing covering external/internal IT, Active Directory, and OT/SCADA systems; (2) Application testing covering web applications, AI/LLM applications, APIs, mobile apps, and rich-client desktop applications; (3) Security Audits including workstation security, password audits, OSINT-based cyber security checks, and configuration reviews; and (4) Scenario-based testing including Red/Purple Teaming, Evil Employee social engineering, phishing campaigns, and vulnerability scanning. Additional offerings include a CVE/vulnerability database, Pentesting as a Service (recurring assessments), and framework agreements for organizations.

Differentiator

Problem solved

Functional benefit

Products and services

• Pentest-Konfigurator 2.0 Online self-service tool that allows customers to configure and order customized penetration tests with transparent pricing, fixed-price guarantees, and cost control. Customers receive an instant non-binding quote within 5 minutes and are subsequently consulted by OSCP-certified experts.
• Pentesting as a Service Recurring penetration testing service providing continuous security assessments and ongoing monitoring rather than one-time point-in-time tests.
• External IT Infrastructure Pentest Penetration testing of publicly accessible IT systems including websites, mail servers, and VPNs using Black-Box, Grey-Box, and White-Box testing approaches.
• Internal IT Infrastructure Pentest Security testing of internal systems including servers, intranets, and internal corporate networks to identify lateral movement paths and privilege escalation risks.
• Active Directory Pentest Specialized penetration testing of Microsoft Active Directory environments including Kerberoasting, ADCS, DCSync, and other AD-specific attack vectors.
• Web Application Pentest Comprehensive security testing of web-based applications including websites, e-commerce platforms, and web portals to identify injection flaws, authentication issues, and business logic vulnerabilities.
• API Pentest Security testing of API endpoints supporting REST, SOAP, gRPC, and GraphQL protocols to identify authentication, authorization, and data exposure issues.
• Mobile Application Pentest Security testing of mobile applications for Android (APK) and iOS (IPA) platforms including reverse engineering, runtime analysis, and API communication review.
• AI/LLM Application Pentest Security testing of AI and large language model applications including chatbots, RAG systems, and ML models for prompt injection, data leakage, and model abuse.
• Red/Purple Teaming Advanced threat simulation including APT simulation and adversary emulation aligned with the MITRE ATT&CK framework to test organizational detection and response capabilities.
• Password Audit Technical password auditing including offline password cracking and DCSync attacks to assess password strength in Active Directory environments.
• Phishing and Social Engineering Phishing campaigns and social engineering assessments including awareness training and spam filter audits to evaluate human security posture.
• Framework Agreements (Rahmenvereinbarungen) Pre-negotiated volume-based service agreements for associations, central procurement organizations, and partner organizations to provide ongoing pentesting access.
• KMU Pentest (SMB Pentest Packages) Specialized pentest packages designed for small and medium-sized enterprises with tailored scope and pricing to fit limited IT security budgets.

Quantifiable outcome

• 82%+ of audited employee passwords successfully cracked
• +1 more outcomes

Segments3 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

One partnership is on record.

• tacticx GruppeparentOthersPentest Factory GmbH is a subsidiary of the tacticx Gruppe, a corporate group specializing in security services. The parent company provides strategic direction and shared services to the penetration testing subsidiary.

Scale indicators5 records

Recent moves6 records

Expansion highlights5 records

Direct peers

• Cure53: Berlin-based boutique cybersecurity firm specializing in penetration testing of web applications, browsers, and complex infrastructures. Highly comparable niche focus, similar German client base, and similar OSCP-grade talent profile to Pentest Factory.
• RedTeam Pentesting: German pentest boutique with deep active directory and infrastructure expertise, long operating history in DACH, and similar professional-services revenue model. Closest direct competitor for German mid-market penetration testing engagements.
• SRLabs (Security Research Labs): Berlin-based security research and consulting firm offering penetration testing, red teaming, and network security assessments. Overlaps directly with Pentest Factory's infrastructure, web, and application testing menu for German enterprise customers.
• NetSPI: US-based pentest and attack surface management provider with a strong enterprise and regulated-industry book. Comparable menu of network, web, API, and Active Directory pentests, with a similar fixed-scope, recurring-service commercial model.

Broad incumbents

• TÜV Rheinland (Cybersecurity Services): Large German TIC incumbent offering pentesting, ISO 27001 audits, and broader IT/OT security services. Competes for the same compliance-driven German buyers but as part of a much wider testing, inspection, and certification portfolio.
• NCC Group: Global cybersecurity services firm with a major European pentesting practice. Competes for larger German enterprise and DACH mandates but operates across a much broader portfolio (incident response, software escrow, managed security).
• Mandiant (Google Cloud): Global incident response and red-teaming powerhouse, now part of Google Cloud. Competes for the high-end red-teaming and assume-breach engagements that Pentest Factory offers to its enterprise segment, though at much larger scale.
• Trustwave: Global cybersecurity and MDR provider with an established penetration testing practice. Competes for the same compliance-driven German enterprise mandates but bundled with broader managed detection and response services.

Emerging players

• HackerOne: Bug bounty and crowdsourced security testing platform that overlaps with Pentest Factory's application and infrastructure testing services. Competes for budget on continuous testing engagements but operates a fundamentally different delivery model (researcher platform vs. in-house OSCP team).
• Bugcrowd: Crowdsourced cybersecurity platform offering penetration testing as a service alongside bug bounties. Targets similar mid-market and enterprise customers and competes specifically against Pentest Factory's Pentesting-as-a-Service offering.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights7 records

Customer concentration

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Pentest Factory