Pentesting & consulting · St.Gallen · Since 2005
Find the gaps
before attackers do.
We test your applications and infrastructure the way an attacker would, then advise you on what to fix first and how to keep it secure.
Pentesting & Consulting
We attack, so that nobody else gets in.
You get a clear picture of where your systems can be broken into, and a plan you can actually carry out.
Web apps & APIs
Login, sessions, access rights and business logic, tested by hand.
Mobile & desktop apps
Local storage, network traffic, updates and what an app reveals about its users.
Networks & infrastructure
Exposed services, VPN, mail and the paths from one system to the next.
Security consulting
Priorities, concepts and standards such as the ICT minimum standard or NIS2, in plain language.
Agree the scope
What may be tested, when, and by whom, in writing.
Test
Automated scans and manual attacks, within the agreed limits.
Report
Every finding with its risk, proof and fix, sorted by what comes first.
Retest
After your fixes we check that the gaps are really closed.
- Since 2005Independent Swiss studio
- Tested by handAutomated scans and manual attacks
- Agreed in writingWhat may be tested, when, and by whom
- With a retestWe check that the gaps are really closed
The studio
A small studio,
rooted in St.Gallen.
treeinspired is an independent software studio in St.Gallen, founded in 2005. We plan, design and build our apps here – and answer every message ourselves, in German or English, within two working days.
- Founded
- 2005
- Location
- St.Gallen, Switzerland
- Contact
- info@treeinspired.com
Questions
Frequently asked questions.
Who is treeinspired?
treeinspired GmbH is a Swiss software studio in St.Gallen, founded in 2005. We build native apps and games for healthcare, cyber security, developers and everyday life on macOS, iOS, iPadOS, Android and the web.
What do you test?
Web apps and APIs, mobile and desktop apps, networks and infrastructure. What exactly may be tested, when, and by whom is agreed in writing first.
What is the difference between a pentest and an audit?
A pentest attacks your systems and shows which flaws can really be exploited. An audit checks whether measures and processes meet a standard such as the Swiss ICT Minimum Standard or NIS2. Neither replaces the other: an audit can go well even though an application is vulnerable.
Isn't an automated scan enough?
A scan mostly finds known flaws and missing updates. It rarely catches errors in access rights or business logic, such as one customer being able to see another's data. That's why we combine automated scans with manual attacks.
What do I get at the end?
A report: every finding with its risk, proof and fix, sorted by what comes first. After your fixes we check that the gaps are really closed.
Can you support us with an ICT Minimum Standard or NIS2 audit?
Yes. We advise you on priorities, concepts and standards such as the ICT Minimum Standard or NIS2. For a first assessment there are our apps IKT-Minimalstandard and NIS2 Readiness Audit. A self-assessment does not replace a formal audit or certification, though.
Can a pentest disrupt our systems?
That can never be ruled out completely. So we agree in writing beforehand what may be tested and when, and we stay within those limits. Sensitive systems can be tested in an agreed time window or in a test environment, for example. You should have a current backup in any case.
What do we need to prepare?
A contact person, a list of the systems to be tested, and test accounts if the area behind the login should be covered. Also let your hosting provider and IT partner know if they are affected. We'll settle the exact scope together.
How often should we test?
After major changes, such as a new application or a rebuilt infrastructure, and at regular intervals as well. Many companies plan one test a year. What makes sense for you depends on how exposed your systems are and how often they change.
What does a pentest cost?
That mainly depends on the scope: how many applications and systems, how deep the test should go and whether a retest is included. Briefly describe what you'd like tested. We'll discuss the price before the test begins.
How do you handle confidential data?
We settle confidentiality in writing, and the report goes only to the people agreed on.
How do we start?
Write to info@treeinspired.com with what you would like tested. We reply within two working days.
Blog