Penetration Testing Companies in Switzerland 2025 (Reviewed)

• Threat landscape: In 2023, a cyberattack hit Swiss organizations every 8½ minutes, fueling pentesting demand.
• DeepStrike joins Swiss market: Global PTaaS leader compared alongside top local firms.
• Key competitors: Compass Security, InfoGuard, USP Swisscom, SwissNS, Connect i, cyllective, Oneconsult, Dreamlab, immunIT.
• Coverage: Web, mobile, cloud, IoT, and network pentesting using OWASP, OSSTMM, NIST frameworks.
• Costs: Typical pentests range CHF 5,000 40,000+, depending on scope and complexity.
• Credentials: Look for CREST, OSCP certifications, strong Swiss/EU compliance expertise, and transparent reporting.
• Why it matters: Skilled testers uncover flaws before criminals do, helping Swiss firms meet compliance and reduce breach risk.

What Is Penetration Testing?

Penetration testing pentesting is an authorized, simulated cyberattack on your systems to uncover vulnerabilities before real hackers can exploit them. Pentesters use the same tools and tactics as attackers for example, they try to exploit web apps using OWASP Top 10 and CWE tests, trick employees with phishing or test network devices.

Firms may perform external tests attacking Internet facing assets or internal tests mimicking an insider or compromised device. Some tests are black box tester starts with no insider info or white box full access to code/credentials depending on the audit scope.

In Switzerland, pentesting is often combined with compliance checks, many testers map findings to FINMA, ISO 27001, NIST CSF or Swiss DPA requirements. For example, FINMA Circular 2023/1 explicitly urges financial firms to have vulnerability management, security monitoring, and regular penetration testing as part of their cyber defenses.

In practice, pentests cover everything from servers and firewalls to web/mobile applications and even physical access if needed. For Swiss companies, pentesting is a proactive risk management tool that validates security controls and can be a requirement for insurers or regulators.

Why Penetration Testing Matters in 2025

Cyberthreats are intensifying worldwide, and Switzerland is no exception. Recent Swiss stats highlight a steep rise in incidents in just six months 2023, 34,789 incidents were reported, with phishing attempts skyrocketing that’s roughly an attack every 8 1⁄2 minutes.

High profile breaches in finance, health and tech underscore that Swiss businesses hold valuable data banks, hospitals, even the government and must defend it. At the same time, regulations are tightening. Switzerland’s revised Data Protection Act FADP aligns with GDPR, and FINMA’s new circulars demand rigorous IT security.

Pentesting helps meet these standards. A thorough pentest will check that Swiss DPA controls like access restrictions are in place and that incident response plans work.

Beyond compliance, pentesting is simply good security practice in 2025. For example, criminal techniques like ransomware and zero days evolve constantly, and regular pentests or a continuous penetration testing platform ensure defenses adapt.

New tech cloud, IoT, mobile expands the attack surface, so pentesters use frameworks like OWASP Mobile Top 10 and NIST SP 800 115 to keep up. Ultimately, a pentest provides executive teams with clear, risk ranked findings and fixes before hackers strike.

As one expert puts it, penetration testing is vital for Swiss businesses to identify exploitable vulnerabilities, protect sensitive data, and demonstrate compliance with the Swiss DPA, FINMA, and ISO 27001.

Leading Swiss Penetration Testing Firms

Switzerland’s market includes both local boutiques and international providers. Below are notable companies in no particular order that serve Swiss clients or are based in Switzerland

DeepStrike Manual PTaaS for Swiss Enterprises

• Services: Provides Penetration Testing as a Service (PTaaS) covering:
  • Web applications (tested against OWASP Top 10 & CWE)
  • Mobile apps (Android/iOS)
  • Cloud environments
  • Infrastructure (external/internal)
  • Red Team & social engineering simulations Engagements emphasize manual, hacker style testing integrated into DevOps workflows. The Pentesting Dashboard enables clients to track vulnerabilities and remediation in real time.
• Certifications & Compliance: Reports tailored to meet compliance with SOC 2, ISO 27001, HIPAA, PCI DSS, and other international standards.
• Clients: Though U.S. based (Delaware HQ), DeepStrike serves clients globally, including Swiss fintechs and multinational enterprises evaluating both local and international vendors.
• Pricing: Offers project based pentests as well as subscription based continuous testing, with tiered packages for different business sizes.
• Key Strength: Known for manual thoroughness and continuous PTaaS transparency. Frequently uncovers complex vulnerabilities missed by automated scanners, delivering realistic attack simulations and clear business risk reporting.

DeepStrike may be U.S. based, but its manual first PTaaS model and real time dashboard make it an attractive choice for Swiss fintechs and enterprises seeking global quality testing that integrates with modern DevOps pipelines.

Compass Security Veteran CREST Accredited Pentesters

• Services: Provides comprehensive penetration testing across:
  • External & internal networks
  • Web & mobile applications (including e commerce platforms and banking portals)
  • Red teaming & social engineering
  • Industrial and OT systems Engagements follow OWASP and OSSTMM methodologies to ensure depth and rigor.
• Certifications & Compliance: One of Switzerland’s few CREST accredited pentesting providers, demonstrating adherence to globally recognized standards. Also aligned with ISO 27001 and other enterprise security benchmarks.
• Clients: Trusted by Swiss banks, e-commerce firms, universities, and industrial operators, with a reputation for combining technical depth with academic partnerships.
• Pricing: Project based engagements, often structured around enterprise requirements for regulated sectors such as finance and critical infrastructure.
• Key Strength: With 25+ years of experience, Compass blends seasoned expertise with innovation, supported by close ties to Swiss universities. Their CREST accreditation underscores rigorous methodology and international credibility.

Compass Security is one of Switzerland’s most established pentest providers, offering enterprise grade testing and red teaming across digital and industrial systems. Their CREST accreditation and 25 year track record make them a go to choice for Swiss financial, industrial, and academic clients seeking high assurance testing.

InfoGuard Full Scope Enterprise Pentesting & Red Teaming

• Services: Offers comprehensive penetration testing across:
  • External networks (internet facing systems, firewalls, mail servers)
  • Internal networks (simulating insider threats)
  • Applications including e banking portals, e shops, and mobile apps Also provides red teaming, phishing simulations, and continuous auditing. Pentests are modular, spanning from passive reconnaissance to targeted attack simulations.
• Certifications & Compliance: Explicitly follows OWASP, OSSTMM, and ISO 27001 standards. Backed by a 250+ employee security organization, giving scale and credibility.
• Clients: Works with banks, large enterprises, and government organizations across Switzerland that require both technical assurance and compliance ready reporting.
• Pricing: Typically project based, with modular engagements allowing organizations to tailor scope (e.g., application focused vs. network wide). Continuous auditing is available as a long term service.
• Key Strength: Known for its enterprise scale and rigor, InfoGuard combines methodical frameworks (OWASP, OSSTMM, ISO) with realistic attack simulations. Their ability to cover both enterprise IT and critical applications makes them a strong choice for regulated industries.

InfoGuard AG is a Zurich area cybersecurity leader offering modular, standards based pentests across networks, systems, and applications. With 250+ experts and a strong reputation in Swiss finance and government, InfoGuard delivers enterprise class testing and red teaming grounded in international standards.

Dreamlab Technologies Holistic Pentesting with 360° Methodology

• Services: Provides penetration testing from an intruder’s perspective, guided by the OSSTMM framework and a proprietary 360° methodology. Coverage includes:
  • Networks & infrastructure (firewalls, routers, SCADA/ICS systems)
  • Web & mobile applications
  • IoT, POS systems, and industrial technologies
  • Physical and human resources, including process and communication testing Also offers threat intelligence and large scale data analysis to complement offensive testing.
• Certifications & Compliance: Applies OSSTMM standards with 25+ years of consultancy experience. Reporting supports ISO 27001, PCI DSS, and NIS2 compliance.
• Clients: Works with industrial operators, enterprises, and government organizations across Switzerland and internationally. Trusted for critical infrastructure engagements and holistic risk assessments.
• Pricing: Engagements are custom scoped, reflecting the breadth of testing (apps, networks, ICS, IoT, human/physical factors). Larger enterprises often opt for multi phase or ongoing programs.
• Key Strength: Known for Swiss precision and holistic depth. Their 360° methodology evaluates not just technical systems but also people, processes, and communications, providing security insights beyond traditional pentests.

Dreamlab Technologies is a Swiss consultancy with 25+ years of expertise, offering comprehensive, OSSTMM driven pentesting across networks, applications, industrial systems, and human factors. Their holistic 360° approach and research driven offensive work make them a standout for complex, high stakes environments.

United Security Providers Swisscom Owned Enterprise Pentesting

• Services: Offers penetration testing and security consulting as part of a broader cybersecurity portfolio. Pentests simulate realistic cyberattacks across:
  • Servers and networks (internal & external)
  • Web and mobile applications
  • Cloud environments
  • IoT and OT devices (including industrial machinery) Tests are followed by detailed vulnerability reports with mitigation guidance.
• Certifications & Compliance: Works under Swiss regulatory frameworks including FINMA (banking) and FADP (data protection). Backed by Swisscom’s enterprise security standards.
• Clients: Primarily regulated DACH region enterprises (banking, healthcare, telecom, and government), with a strong presence in sensitive sectors requiring local assurance.
• Pricing: Project based, often tied to ongoing Swisscom security contracts for large enterprises.
• Key Strength: USP’s strength lies in being a Swisscom owned provider with deep ties to the DACH enterprise market. Combines local trust, regulatory alignment, and wide technical scope.

United Security Providers (USP) is a Bern based, Swisscom owned cybersecurity firm offering comprehensive pentesting and consulting for highly regulated industries. With coverage across IT, cloud, IoT/OT, and industrial systems, and alignment to Swiss regulatory frameworks, USP is a trusted choice for enterprises needing local, compliant assurance.

SwissNS Offensive Pentesting with Hacker Mindset

• Services: Provides on demand penetration tests by certified white hat hackers, covering:
  • Enterprise IT and networks (external & internal)
  • Web and application security
  • Wireless and VPN access
  • Cloud assets and BYOD devices Tests go beyond perimeter checks, using advanced threat intelligence and manual exploitation to simulate real attackers.
• Certifications & Compliance: Team includes certified penetration testers (e.g., OSCP, CEH). Reports align with industry standards such as OWASP, NIST, and ISO 27001.
• Clients: Works with Swiss enterprises, SMBs, and IT service providers seeking deep manual assurance that goes beyond automated vulnerability scans.
• Pricing: Engagements are on demand and project based, scoped to the depth of exploitation required (networks, apps, cloud, VPN, BYOD).
• Key Strength: Known for its hacker’s mindset swissns emphasizes manual penetration and deep exploitation rather than surface level scanning. Reports highlight real, exploitable weaknesses, helping organizations focus defense where it matters most.

SwissNS is a Lucerne based offensive security firm offering practical, manual pentests across networks, apps, cloud, and user endpoints. Their attacker style approach and detailed exploit reporting make them a strong option for Swiss businesses seeking clear, actionable security insights.

Connect i Agile Pentest as a Service Provider

• Services: Offers Pentest as a Service (PTaaS) with tailored simulations of real world attacks. Coverage includes:
  • External & internal networks
  • Web applications, APIs, and mobile apps
  • Cloud environments (AWS, Azure, GCP misconfiguration testing) Tests emphasize human driven pentesting supported by automation, including phishing and exploit simulations in controlled conditions.
• Certifications & Compliance: Staffed by certified penetration testers (e.g., OSCP, CREST level). Reports support compliance with ISO 27001, PCI DSS, and GDPR requirements.
• Clients: Serves Swiss mid market and enterprise clients, often acting as an agile partner by combining pentesting, consulting, and DevOps integration.
• Pricing: Provides subscription based PTaaS packages for continuous testing, as well as bespoke project engagements.
• Key Strength: Positioned as a flexible, agile partner Connect it stands out for integrating pentest results into DevOps workflows, making findings actionable for modern development teams.

Connect i is a Prévérenges based IT and security provider offering PTaaS across networks, apps, and cloud environments. With its focus on human driven testing, DevOps integration, and clear reporting, Connect i is a strong choice for Swiss organizations seeking an agile pentest partner.

cyllective AG Offensive Security Boutique

• Services: Focuses exclusively on offensive security, offering:
  • Network and infrastructure pentests
  • Web and mobile application testing
  • Cloud security audits (AWS, Azure, GCP, Kubernetes)
  • Red team exercises Engagements emphasize deep manual testing to uncover vulnerabilities missed by automated scans.
• Certifications & Compliance: Staffed by experienced testers holding OSCP, CISSP, and other advanced certifications. Reporting supports ISO 27001, PCI DSS, and GDPR compliance.
• Clients: Works with enterprises and mid sized Swiss organizations seeking a flexible, highly technical vendor for specialized offensive engagements.
• Pricing: Project based, with scope tailored to client infrastructure and depth of manual testing required.
• Key Strength: Known for its attacker grade techniques and hacker mindset. cyllective delivers actionable vulnerability reports prioritized by business impact, making it a go-to boutique for organizations demanding pure offensive expertise.

cyllective AG is an independent Lucerne based boutique focused entirely on offensive security and red teaming. With a team of experienced ethical hackers, they provide highly technical, manual first pentesting for Swiss firms that need specialized expertise beyond automation.

Oneconsult AG Broad Scope Pentesting Across IT & OT

• Services: Provides comprehensive penetration testing across a wide cyber scope, including:
  • Application security testing (web, mobile, enterprise apps)
  • Network infrastructure testing (corporate and data center)
  • Cloud security testing (AWS, Azure, GCP)
  • IoT & OT/industrial security testing (SCADA, DCS, manufacturing controls, avionics) Oneconsult is known for analyzing any networked system from corporate IT to niche technologies.
• Certifications & Compliance: Uses advanced tools and expert methodologies, delivering reports aligned to ISO 27001, PCI DSS, FINMA, and healthcare compliance requirements.
• Clients: Frequently engaged by finance, healthcare, manufacturing, and critical infrastructure operators across Switzerland. Recognized for tackling complex, high stakes environments.
• Pricing: Engagements are project based, with custom scoping for specialized systems such as avionics, SCADA, or industrial IoT.
• Key Strength: Known for handling complex and niche systems. Oneconsult combines deep technical expertise with the ability to uncover vulnerabilities in critical infrastructure and specialized technology environments.

Oneconsult AG is a Zug/Zurich based consultancy offering broad spectrum penetration testing across applications, networks, cloud, IoT, and OT systems. Their expertise in critical infrastructure and niche technologies makes them a strong choice for regulated and high assurance industries in Switzerland.

immunIT Rigorous Pentesting for French Speaking Region

• Services: Provides penetration testing and red teaming aligned with global standards. Coverage includes:
  • External network pentests (firewalls, mail servers, web servers)
  • Internal network pentests (with limited or no initial access)
  • Application testing (web apps, APIs)
  • Red team campaigns & social engineering Supports black box, grey box, and white box testing depending on client needs.
• Certifications & Compliance: Methodologies follow OSSTMM, PTES, and OWASP standards. Reporting ensures consistency and supports compliance with ISO 27001, PCI DSS, and GDPR.
• Clients: Serves Swiss enterprises and public organizations, with particular strength in the French speaking region (Romandy). Known as a trusted boutique shop near Geneva.
• Pricing: Project based, with variable scoping based on testing depth (black/grey/white box) and coverage needs.
• Key Strength: Recognized for methodical, standards driven testing. immunIT’s structured process reconnaissance, exploitation, reporting ensures thorough and repeatable assurance for clients needing precision and reliability.

immunIT is a Nyon based bilingual consultancy offering rigorous pentests and red teaming per world renowned standards (OSSTMM, PTES, OWASP). With its structured methodology and regional presence, immunIT is a trusted specialist for organizations in French speaking Switzerland.

How to Choose a Penetration Testing Provider

Selecting the right pentest partner is as important as the testing itself. Here are key factors:

• Certifications and Experience: Look for testers with credentials like OSCP, OSWE, CEH, CISSP, CREST for companies. Many Swiss contracts require auditors to have ISO 27001 or CREST accreditation. Check that the firm has experience in your industry and knows Swiss/EU regulations FINMA, GDPR/FADP, PCI DSS, etc.. For example, Compass Security prominently notes its CREST status, and DeepStrike and others mention SOC 2 or ISO compliance.
• Scope and Methodology: Ensure they cover your needs. If you need web app and API security, see that the firm references OWASP/ASVS testing. For networks, look for NIST SP 800 115 or OSSTMM usage. The providers above all test web/mobile including OWASP Top 10 and networks. Check if they test cloud configurations AWS/Azure/GCP and IoT/OT if you have those. Verify they offer both external and internal testing and discuss social engineering if desired. Asking difference between internal and external penetration tests in your RFP is good internal tests simulate an insider threat, which some firms like Compass and immunIT specifically mention.
• Testing Model: Decide between one off audits or continuous pentesting. Some modern providers including DeepStrike offer Pentest as a Service PTaaS or continuous testing platforms where new code/deployments are automatically tested. Others focus on classic point in time engagements. If you deploy DevOps frequently, continuous models can catch fresh bugs. The providers above vary, DeepStrike and SwissNS mention on demand testing, immunIT and Compass suggest yearly or on change tests, Connect i and others can integrate with agile release processes.
• Reporting and Support: Good pentest reports rank issues by risk and include proof of concept. Check if the firm provides remediation guidance and retesting. DeepStrike, for example, promises unlimited retesting. See if they offer a dashboard or interactive portal as DeepStrike does or integrate with your ticketing Jira, Slack, etc.. Ask for sample reports or case studies to gauge clarity. The above firms usually include remediation steps, USP and Oneconsult emphasize mitigation advice.
• Cost and Value: Pentest prices vary widely. In Switzerland, basic web or network tests start around CHF 5,000 and can exceed CHF 40,000 for complex, multi week projects. This matches typical industry ranges, small local pentests at low end, large banks at high end. Evaluate pricing models some charge by tester day, others by fixed scope, and PTaaS firms often use subscription or credits. For details see our internal penetration testing pricing models Switzerland guide. Keep in mind cheaper is not always better, depth matters. Often, the value is in the team’s skill and the report quality, not just the lowest bid.
• References and Reputation: Look for customer reviews or referrals. Companies like Compass, InfoGuard and USP have long Swiss track records. Check platforms like Clutch or industry awards. Our DeepStrike About Us shows testimonials from tech firms, and a number of the above are recognized in Swiss cybersecurity circles. If possible, ask vendors for similar sector case studies e.g. finance or healthcare pentests.

By checking these factors against your needs, you can shortlist the best Swiss or international pentest providers. As one FAQ on Swiss pentesting advises, prioritize firms with CREST or OSCP certified experts, transparent methodologies, and strong reporting. Ensure they have proven experience in regulated industries.

Penetration Testing Costs & Pricing Models in Switzerland

Pentest pricing depends on scope, assets, and compliance needs. As noted above, Swiss pentests typically range from CHF 5K to 40K+. A small web app test might be CHF 5 10K, whereas an enterprise wide audit networks, cloud, apps, plus manual testing could easily exceed CHF 40K. Regulated sectors banking, healthcare, government often fall at the higher end due to deeper requirements.

Pricing models include:

• Fixed Price Projects: Common for single pentests, especially with Swiss firms. You define the scope e.g. external network of 50 hosts and 2 web apps and get a flat fee. This is simple but ensure scope is precise very low fixed prices may indicate a limited test.
• Time and Materials Day Rate: Some companies bill by the day or tester. For example, a 5 day external pentest at CHF 2,500/day might cost ~CHF 12,500. This scales with effort if the scope grows.
• Pentest as a Service Subscription/Credits: Newer platforms e.g. DeepStrike, Cobalt, BreachLock allow ongoing testing via monthly fees or credit bundles. You pay for continuous scanning and periodic manual reviews, often with unlimited retests included. This is gaining traction in agile teams.
• Retesting & Support: Clarify if retests are included and how many rounds. DeepStrike offers free unlimited retesting for fixes. Others may allow one retest per issue or charge extra for extensive follow ups. Also ask if basic vulnerability scanning comes bundled, some include a final scan or if incident response consulting is offered.

In Swiss engagements, value is key. A thorough manual pentest with expert OSCP certified testers delivers more actionable results than a cheap automated scan. Consider the long term ROI fixing a critical flaw found in a CHF 30K test could save millions in breach costs. For detailed budgeting,.

Penetration testing is no longer optional in today’s threat landscape, especially in a high value market like Switzerland. The firms above from long established Swiss experts Compass, InfoGuard, Oneconsult, etc. to innovative boutiques cyllective, Dreamlab provide the offensive security services Swiss organizations need.

They help you simulate attacks on networks, apps, cloud and beyond to find critical weaknesses first. Investing in pentesting often CHF 5K 40K+ protects against far costlier breaches and ensures compliance with FINMA, ISO 27001 and data protection laws.

Ready to strengthen your defenses? The threats of 2025 demand more than awareness, they require readiness. If you're looking to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike is here to help. Our team of practitioners provides clear, actionable guidance to protect your business.

Explore our penetration testing services to see how we can uncover vulnerabilities before attackers do. Drop us a line we’re always ready to dive in.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

FAQs

• What is penetration testing, and how is it different from a vulnerability assessment?

Penetration testing pen test is a simulated attack carried out by ethical hackers to exploit vulnerabilities in your systems, it goes beyond scanning and attempts actual breaches. In contrast, a vulnerability assessment inventories potential flaws using automated tools and rates their severity without necessarily exploiting them. Pentests using frameworks like OWASP, NIST SP 800 115 or PTES will actively probe web apps, networks and devices, often including manual exploitation and social engineering. Vulnerability scans might flag an outdated service, whereas a pen tester will try to log in through it and then see what data can be exfiltrated. Both valuable assessments are broader but shallower, whereas pentests provide deeper, real world insight into your security gaps.

• Why do Swiss businesses need penetration testing?

Swiss companies are under growing cyberthreats and regulatory scrutiny. As of 2023, Switzerland saw a cyber attack roughly every 8½ minutes. Pentesting reveals hidden holes in web/mobile apps, networks, cloud, etc. before attackers find them. It also helps meet compliance for example, FINMA financial regulator expects regular security testing, and the Swiss Data Protection Act encourages appropriate technical measures which pentesting satisfies. By conducting a pentest, organizations protect client data, financial assets, and reputation. One industry source notes pentesting is vital for Swiss businesses to identify exploitable vulnerabilities, protect sensitive data, and demonstrate compliance with Swiss data protection and FINMA rules.

• How much does a penetration test cost in Switzerland?

Costs vary by scope. Basic tests e.g. a small website often start around CHF 5,000. More comprehensive audits covering many IPs, apps, or including manual internal tests can exceed CHF 40,000. For context, Astra Security reports penetration testing in Switzerland generally costs between CHF/EUR 5,000 and 40,000+, depending on scope, asset type, and compliance requirements. Smaller web or network tests are at the lower end, while complex enterprise projects in regulated sectors can exceed the above. Prices also depend on who performs it, boutique Swiss firms might charge more per day than offshore providers, but bring deep local expertise.

• How do I choose the best penetration testing company in Switzerland?

Prioritize vendors with proven expertise and transparency. According to security analysts, Prioritize firms with CREST or OSCP certified experts, transparent methodologies, and strong reporting. Ensure they have proven experience in regulated industries, understand Swiss/EU compliance requirements, and provide actionable remediation guidance. In practice, ask about their certifications OSCP, CREST, CISSP, ISO 27001 etc., sample reports, and experience in your sector e.g. finance, healthcare. Check they can test all required assets web, mobile, cloud, OT, etc.. Also confirm project management will there be a single point of contact? How are timeframes and deliverables defined? Good firms will often provide a quotation or RFP guidance see our penetration testing RFP writing guide for tips. Lastly, client reviews or case studies like a banking pentest example can give confidence.

• Is penetration testing required under Swiss law or regulations?

While no Swiss law explicitly mandates pentests in every case, they are strongly implied in many contexts. For instance, the Swiss FINMA Circular 2023/1 for banks/insurers recommends regular security testing including penetration tests. The revised Swiss DPA aligned with GDPR expects organizations to implement adequate technical measures pentesting, and is widely recognized as a reasonable measure. In regulated sectors finance, healthcare, energy, standards like ISO 27001 or PCI DSS do require periodic pentesting, effectively making it mandatory. So, for many Swiss companies, especially those subject to FINMA or handling personal data, pentesting is treated as a practical necessity to demonstrate diligence.

• What’s the difference between an internal and external penetration test?

An external penetration test targets an organization’s outward facing assets websites, servers, firewalls, etc. Testers have no initial network access, mimicking an outside hacker. They look for vulnerabilities in public IPs, web portals, VPN gateways, email servers, and so on often with black box methods. An internal penetration test, by contrast, simulates an attack from inside the network e.g. a compromised workstation or malicious insider. Testers typically have some user level access or physical presence. Internal tests find issues like weak domain permissions, insecure Wi Fi, and lateral movement paths. Many Swiss firms run both external tests guard against remote breaches, and internal tests ensure that an attacker who got past the firewall can’t easily take over the network. For more, see our guide on internal vs external penetration tests.

• Are there CREST accredited penetration test providers in Switzerland?

Yes. CREST accreditation is a mark of high quality pentesting. For example, Compass Security clearly labels itself a CREST approved Penetration Test Provider. Other firms including international ones like DeepStrike often maintain similar accreditations. The CREST directory lists several Swiss based members. Choosing a CREST accredited company means their processes and reports meet international standards. It’s a good trust signal, but absence of CREST doesn’t always mean poor quality, many highly skilled Swiss testers are OSCP certified or ISO/IEC 27001 accredited. We advise balancing accreditations with experience and references when selecting a provider.