We have been testing web and mobile applications since 2007. AI makes us faster and more thorough, but the findings are still assessed by hand.
SektionEins is a security company based in Bonn, Germany, working for clients around the world. We find vulnerabilities in web and mobile applications, on the server and in the client, from Java and PHP to iOS and Android. We use AI as a tool, not as a replacement for people: it searches, sorts and makes suggestions. Experienced people decide whether a vulnerability is real and what it means for you.
Architecture, data flows and threat model. We get to know your application before we attack it.
AI models and our own tools comb through the code and the running application for patterns and variants of known bugs.
We prove every finding by hand. Suspicious behaviour and bugs that cannot be exploited directly are flagged as such in the report.
Prioritised by risk, with specific advice on how to fix each issue. Follow-up questions are part of the service.
We read your code thoroughly. AI searches large code bases for patterns and variants; we verify every finding by hand.
We attack your running application the way a real attacker would: with automated tools, by hand and with an eye for logic flaws.
Complex applications depend on their infrastructure. We examine the environment your application relies on.
Independent of any vendor, at every stage of a project, from the architecture concept to a secure development lifecycle.
Two separate trainings for developers, administrators and DevOps, each with roughly half of the time spent on hands-on exercises.
AI is changing IT security at a remarkable pace. In this article I look at how the everyday work of a security auditor differs from what it was a few years ago, and at the opportunities and problems that come with the change.
Release 0.3.0 of the PHP Secure Configuration Checker (pcc) is out: a 2026 update for PHP 8.x with new security checks, bug fixes, and cleanup.
It's Friday afternoon. The last client meeting of the day is over and your mind is already on the weekend. Just a quick look at your email and the team chat on your phone on the way home. Then a message catches your eye, one that an IT security consultant posted that morning, almost in passing:
IT security is topical and often exciting, but above all it plays a big part in whether a company succeeds. As an IT security consultant I see every day how important it is to get people interested in security, and ideally even a little enthusiastic about it.
Tool Update / New Release: SSHDCC 0.3 of the OpenSSH Security Configuration Checker
Suhosin, the popular PHP hardening extension, is back!
Reach us by e-mail, phone or the contact form. PGP-encrypted on request.