Exploit Labs
Headquarters · Frankfurt am Main

Offensive security at the Frankfurt financial centre.

Frankfurt is our headquarters and DACH hub. From here we deliver penetration tests, red team engagements and DORA TLPT for banks, asset managers, insurers and critical-infrastructure operators.

Request scopingScope Check (2 min)

FRA · DXB · REK

Delivered from Frankfurt

What we deliver for enterprises & institutions in the Rhine-Main area.

DORA TLPT & TIBER-EU

Intelligence-led red team testing for financial institutions under DORA supervision. We were among the first to complete a DORA TLPT (2024).

Details

Red teaming

Full adversary simulation against your organisation - digital, physical and human. Proof of business impact, not just a vulnerability list.

Details

Penetration testing

Web, API, cloud, Active Directory, mobile, SAP and network - manually tested by senior operators, documented against OWASP WSTG.

Details

NIS2 & critical infrastructure

Technical evidence for NIS2, BAIT/VAIT and ISMS requirements: audit-ready reports your assessor accepts.

Details

On-site OffSec training

Workshops and team-readiness programmes in our pentest penthouse - or at your offices in the Rhine-Main area.

Details

Pentest retainer

Recurring test windows with a fixed operator team, so releases never wait on scoping.

Details
Sectors

Who we serve from Frankfurt.

We only name clients with written consent. In a discovery call we are happy to match you with engagements of comparable sector and size.

Request matching references
  • //Banks, state banks and payment service providers
  • //Asset managers and fund companies
  • //Insurers and reinsurers
  • //Energy suppliers and grid operators
  • //Transit operators and smart mobility
  • //Audit and advisory firms
  • //Industrial and mechanical engineering
  • //Public sector and supervisory bodies
The location

The pentest penthouse.

160 sqm in Frankfurt: workspace for the team, workshop room for training and a stage for community formats. Remote-first does not mean placeless - we meet where the work and the training happen.

Team & locationsOn-site training
DACH hub
Frankfurt am Main
Other hubs
Dubai · Reykjavík
Response time
Usually 24 h on business days
Methodology
TIBER-EU · OWASP WSTG · MITRE ATT&CK
FAQ

Frequently asked questions about Frankfurt

Other locations

One team, three hubs - Frankfurt, Dubai, Reykjavík.

Location
Dubai

UAE hub - AI-native stacks, smart contracts, frontier tech.

View
Location
Reykjavík

Iceland hub - critical infrastructure, subsea nodes, TIBER-IS.

View
The team
The Operators & Hubs

Who we are, how we work and where our operators are based.

View
Confidential

Confidential scoping - Frankfurt

A short call with a senior operator in Frankfurt: objectives, scope, effort. Under NDA, answered promptly on business days.

Request confidential scoping Run the 2-Minute Scope Check

Not ready to talk yet? The Scope Check returns exercise type, tester-days and a budget range in two minutes - no email gate.