Traditional security measures such as firewalls, antivirus software, and EDR/NDR systems provide an important foundation. However, only when they are put to the test under real-world attack conditions you can determine their efficacy. Our Offensive Security experts take the perspective of a real-world attacker and uncover vulnerabilities before criminals can exploit them.

There is no one-size-fits-all solution for cybersecurity. The suitability of selected measures depends on a company’s individual starting point, industry, and risk situation. Instead of investing in technologies across the board, it is worth first conducting an honest assessment of the current situation based on a few key questions:

• Are proven structures and plans in place?
  Emergency plans and processes need to be documented, but they are of little use if they exist only on paper and do not work in an emergency. Their effectiveness should be tested through regular emergency exercises.
• Are measures effective and tested?
  To know what effective defence looks like, you first need to know what you actually need to protect against. Threat and risk analyses help to better assess potential threats and define appropriate measures. Penetration tests reveal whether existing security measures actually work or whether critical gaps remain despite existing security solutions.
• Are attacks reliably detected?
  Without functioning detection and response capabilities, attackers often remain undetected in the network for weeks or months. Attack simulations, for example as part of red teaming, show how effectively attacks are detected in practice and where blind spots exist.
• Who will help me in an emergency?
  Clear responsibilities and response processes determine how quickly and effectively a company can respond to an incident. To ensure that specialised incident response providers can provide rapid support in an emergency, it is advisable to establish contact and complete onboarding at an early stage.

The answers to these questions show where the greatest need for action lies. Based on this, a prioritised cyber defence strategy tailored to the company can be developed instead of implementing measures “on suspicion.” Professional security consulting can help assess your current situation and define appropriate next steps. Feel free to get in touch with us!

A penetration test specifically examines individual systems, applications, or networks for technical vulnerabilities – usually within a clearly defined timeframe and with a fixed test scope. The objective is to find and document as many security vulnerabilities as possible.

Red teaming goes one step further. It simulates a realistic attack on the entire company – usually without informing the internal IT or security teams. In addition to technical vulnerabilities, organisational and human factors are also tested. This approach focuses less on the number of vulnerabilities found and more on whether and how an attack remains undetected and how the company responds to it (Detection & Response).

In principle, the security level of all systems whose compromise could result in business disruptions, or security or data protection incidents should be assessed regularly. This includes:

• Corporate networks and external infrastructure: Unsecured services, misconfigured perimeter systems, weak authentication and authorisation mechanisms, and connected third-party systems can serve as entry points for attackers into the corporate infrastructure.
• Internet-accessible web applications and APIs: Undiscovered vulnerabilities in external web applications can be directly exploited from the internet and may enable unauthorised access to sensitive data, data loss, or operational disruptions. In addition, APIs often form the basis of modern applications and business processes. Regular API penetration tests help identify authentication, authorisation, and data processing flaws at an early stage.
• Cloud environments: Cloud environments introduce new risks, particularly through misconfigurations, insecure permissions, and exposed management interfaces.
• Mobile apps: If data stored locally on end devices is insufficiently protected against third-party access, insecure communication channels are used, or inadequate authentication mechanisms are implemented, attackers may gain access to confidential information, obtain unauthorised access, or compromise app functionality.
• Critical internal applications: As critical systems often consolidate central functions, sensitive data, and extensive permissions, a successful attack can lead to significant business disruptions, substantial financial losses, or risks to security and compliance.
• IoT and embedded devices: IoT devices are often permanently connected to networks, cloud services, and other systems, making them potential attack points. Since new vulnerabilities, outdated software, or changed configurations can create new risks at any time, regular security assessments are important.

The frequency and scope of assessments should be based on the risk profile, regulatory requirements, and importance of the respective system. Security assessments are particularly recommended before go-live and whenever major changes are made to systems or the underlying architecture.

The quality of security services such as penetration testing, red teaming, and security consulting depends largely on the provider’s experience. Companies should therefore not focus solely on price, but particularly on technical expertise, transparency in the approach, and the quality of the results.

Important selection criteria include:

• Experience and expertise: The team should have demonstrable experience in the relevant area. Depending on the project context, this may include experience with comparable environments, technologies, and industries.
• Qualifications: Certifications and comparable qualifications can be a good indicator of technical expertise. Depending on the focus area, these may include certifications from OffSec (OSCP, OSCE, OSEP, OSED, OSWE) and GIAC (GPEN, GX-PT, GREM) in penetration testing, CRTL, CRTO, and CRTP in red teaming, as well as CISSP or BSI IT-Grundschutz-Praktiker in security consulting.
• Public engagement: Active contributions to the security community are an indication of well-founded expertise – for example, through the provider’s own publications, recommendations and insights, responsible disclosure of CVEs, presentations at specialist conferences, or contributions to the development of public tools, projects, and standards.
• Reliable communication: Security is not a one-time project, but an ongoing process. A good service provider should therefore not only be a reliable point of contact during the project but also provide long-term support.

The framework of BDO Cyber Security GmbH is based on established, up-to-date standards. Depending on the specific project objectives, the following guidelines and standards are used in particular.

Penetration Testing:

• OWASP Web Security Testing Guide (WSTG)
• OWASP Mobile Application Security Testing Guide (MASTG)
• OWASP IoT Security Testing Guide (ISTG), as well as a test case catalogue for hardware devices developed and maintained by BDO Cyber Security GmbH
• Test case catalogue for IT infrastructures and infrastructure components, developed and maintained by BDO Cyber Security GmbH

Red Teaming:

• MITRE ATT&CK Framework
• Lockheed Martin Cyber Kill Chain
• Threat-Led Penetration Testing in accordance with the Digital Operational Resilience Act (DORA), further development of the Threat Intelligence-based Ethical Red Teaming Framework (TIBER)

Security Assessments:

• CIS Benchmarks for security audits and hardening checks
• OWASP Threat Modelling for threat analysis and BSI Standard 200-3 for risk analysis
• Requirements catalogues from regulatory frameworks, standards, and guidelines, such as NIS2, the Cyber Resilience Act, the BSI’s industry-specific security standards (B3S), as well as ETSI EN 303 645 and ETSI TS 103 701