We test the people.The technology, with our partner.
Technical pentests, red teaming and cloud security, carried out together with a closely affiliated partner team with CREST membership and NATO security clearance. Your point of contact remains HRC.
We deliver technical penetration tests together with a closely affiliated partner: a CREST member company with offices in Berlin and Cluj-Napoca, whose leadership holds NATO security clearance. We bring in the human factor, the partner brings the technical depth. Scoping, coordination and your point of contact stay with HRC.
A complete technical service portfolio
From a single web application to adversary simulation across IT, OT and physical perimeters.
Penetration testing
External, internal, web, mobile, API, wireless.
Cloud & infrastructure
Azure, AWS, Active Directory, containers, DevSecOps.
Specialised tests
ICS/SCADA, IoT, physical security, thick client, AI/LLM testing.
Red team
APT simulation, assumed breach, combined with our social engineering.
Compliance
PCI DSS, ISO 27001 gap analysis, NIS2, DORA.
Response
Incident response, digital forensics.
One attack picture instead of two reports
Attackers do not distinguish between people and technology. Neither do we.
Two perspectives, one result
Our social engineering expertise meets the technical depth of the partner team. Phishing, vishing or physical access provide the entry point; the partner shows how far an attacker gets from there.
One point of contact
Scoping, coordination and communication run through HRC. You talk to the people you know and receive the results from a single source.
The same testers from start to finish
The people on the scoping call are the same people who carry out the project and explain the results. No bench, no subcontractors.
Stronger in combination with our services
From the click to the domain
Our phishing or vishing campaign provides the access. The partner team shows how far an attacker gets into the network from that account.
From the building to the server
We get into the building. The partner tests what an attacker can achieve at a network port or on unattended devices.
One attack, every layer
Adversary simulation across IT, OT, people and physical perimeters. Full validation of detection and response.
What matters in the end
What is usually sold
- Certifications
- Methodologies
- Toolset
- Team size figures
What stays with you
- A report that budget owners understand
- An experienced tester who explains the results live
- The same faces in phase two
- A free retest with retest report
A report the board can actually read
The report
- Management summary
For the executive who approved the budget, understandable without a technical background.
- Technical findings
Clearly separated for the engineering team: how the intrusion happened, how the attacker moved, what to fix in which order.
- Preliminary draft
High and critical findings before final delivery. No surprises in the final report.
Readout & retest
- Live walkthrough
The results are discussed with your technical team, not sent as a PDF.
- Delivery lead on the call
The tester who carried out the attack explains the findings. No coordinator reading aloud.
- Free retest
After remediation, a retest confirms the fixed state, with a retest report.
Clear responsibility at every step
48 hours from agreement to project start.
One team. No subcontractors.
You always know exactly who has access to your systems and data.
In-house team
Every project is carried out by the partner’s in-house team. Nothing is passed on to third parties.
NATO security clearance
The leadership of the partner team holds NATO security clearance. Strict data protection is standard.
EU locations
Berlin, Germany and Cluj-Napoca, Romania. Your data stays in the EU.
NDA first
Before any technical details are exchanged, the non-disclosure agreement is in place.
The qualifications behind the partner team
CREST member company, NATO security clearance, published CVEs. Over 2,000 assessments on six continents.
- OSCP
- OSEP
- OSWE
- OSCE
- OSED
- OSWP
- CRTO
- CRTP
- CRTE
- CARTP
- CCSP-AWS
- C-ADPenX
- Sektor7
- WLPE
- CREST
- CRT
- eCPTXv2
- eWPT
- eWPTX
- PNPT
- GPEN
- GWAPT
- CEH Certified Incident Handler
- Burp Suite
- Certified APIsec
- Certified CNSP
- CAP
- PMPA
Proven where it counts
Financial supervisory authority
Full infrastructure assessment. Critical weaknesses in Active Directory and network segmentation found and fixed, and staff trained in secure implementation.
Bank in the Middle East
Tests across web, mobile, cloud and privileged access. External audit passed with complete documentation.
360° red team assessment
Comprehensive adversary simulation across IT, OT and physical perimeters for a global manufacturer, with full validation of detection and response capability.
Unmasking a crypto fraudster
Blockchain transactions and messenger communication traced back to identify the perpetrator behind a large-scale fraud, as the basis for criminal proceedings.
The human factor, from a single source
Frequently asked questions
Who carries out the technical tests?
The tests are carried out by our closely affiliated partner team: a CREST member company with EU offices in Berlin and Cluj-Napoca, whose leadership holds NATO security clearance. HRC coordinates the entire process and remains your point of contact.
Why does HRC work with a partner here?
We specialise in the human factor. Technical depth across web, cloud, Active Directory or ICS requires a team that does nothing else. Instead of offering a pentest on the side, we work with a team that has carried out more than 2,000 assessments.
Who is my point of contact?
HRC. The partner team joins the scoping call and the readout, so that you know the testers who carry out your project.
How quickly can a test start?
Usually 48 hours pass from agreement to project start. For larger scopes we agree the date at kickoff.
Who has access to our systems and data?
Only the partner’s in-house team. There are no subcontractors, the offices are in the EU, and the non-disclosure agreement is signed before any technical details are exchanged.
Is a retest included?
Yes. After remediation, a free retest confirms the fixed state, with a retest report.
Can I combine technical and social engineering tests?
Yes, that is the core of our joint offering. Our vishing, phishing or physical access provides the entry point; the partner team shows what an attacker can reach from there. You get one attack picture instead of two separate reports.
Technology and people in one test?
A first conversation to understand your scope, without obligation and in confidence. On request with the partner team at the table.