Penetration Testing & Security Consulting
threatover is the security consulting practice of Patrik Grobshäuser, a security researcher based in Germany. All work is performed by me personally. I work remotely with clients worldwide, in English or German.
Platforms
HackerOne
Bugcrowd
Intigriti
In-house
Leistungen
Penetrationstest
Manual testing of web applications, REST and GraphQL APIs, cloud environments (AWS, GCP, Azure), and mobile applications, with source code review where access permits. Findings are reported individually with reproduction steps, impact, and a recommended fix. A re-test after remediation is included.
Sicherheitsberatung
A monthly retainer for engineering teams without a dedicated security function: code review, threat modeling, architecture decisions, and ad-hoc security questions during EU business hours. Retainers can be cancelled at the end of any month.
Bug-Bounty-Beratung
Support for planning and running a bug bounty program: scope definition, rules of engagement, payout structure, and platform selection. I accept no platform referral fees.
Triage as a Service
Validation of incoming vulnerability reports inside an existing HackerOne, Bugcrowd, or Intigriti program: reproduction, severity assessment, deduplication, and researcher communication. Billed per validated report or as a monthly arrangement.
WordPress-Vorfallsmanagement
Cleanup of compromised WordPress sites for a flat rate of $279 per site: malware and backdoor removal, identification and closure of the entry point, blocklist reconsideration requests, and a written report.
Background
Before threatover, I worked at HackerOne as Triage Manager EMEA, at Shopify as a security engineer on the bug bounty program, at Recorded Future as a Senior Threat Research Engineer, and earlier at ERNW and Bugcrowd. I have written about web security at IT-Securityguard since 2011. More about me.
Writing
- The first hour after a WordPress hack — A calm, ordered checklist for the first hour after you discover a compromised WordPress site — what to do, wh…
- The five ways WordPress sites actually get compromised — WordPress core is rarely the problem. Here are the five entry vectors behind almost every compromise I clean,…
- Japanese SEO spam, explained — What Japanese SEO spam actually is, why it only shows up in Google and not on your own screen, how it persist…
E-Mail [email protected] or use the contact form.