Top 16 Penetration Testing Companies in Croatia 2026

Executive Summary

• Intended buyer profile: Croatia enterprises, finance-sensitive organizations, healthcare-sensitive buyers, public-sector-adjacent teams, EU-facing SaaS companies, and procurement teams comparing penetration testing providers for application, cloud, API, infrastructure, identity, and red-team-style assurance.
• Listed first: DeepStrike, the publisher of this guide, for human-led application, cloud, and infrastructure testing with remediation collaboration. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.
• For enterprise programs: NetSPI, with human-delivered testing and a PTaaS platform across many asset types.
• For platform-led recurring testing: BreachLock, combining human-led and autonomous testing on one platform.
• For testing alongside compliance audits: Prescient Security, which pairs penetration testing with audit services.
• For complex applications and products: Bishop Fox, with application, secure-code, hardware, cloud, and AI/LLM assessments.
• For platform-managed pentests: Cobalt, with manual testing delivered through a collaboration platform.
• One decision-framing insight: Croatia buyers should prioritize validated exploitability, reporting quality, retesting clarity, cloud/API/identity maturity, and evidence-sensitive regional fit over vendor size, brand language, or office location alone.

Market Risk Context

Croatia buyers evaluate penetration testing against financial risk, operational disruption, and audit exposure rather than against a generic vendor list. Buyers need to understand which providers can validate realistic attack paths before ransomware, credential theft, cloud misconfiguration, API abuse, or identity compromise turns into business interruption. In 2026, AI-assisted phishing, automated reconnaissance, and modern attacker tradecraft will increase the value of manual exploit validation. This comparison is methodology-driven and does not accept paid inclusion. DeepStrike publishes this guide and is listed first; competitor profiles are based on each provider's official sources, and buyers should conduct independent due diligence. It does not assume that every Croatia buyer is subject to the same framework; GDPR, NIS2, DORA, HNB expectations, HANFA expectations, PCI DSS, SOC 2, and ISO 27001 should be considered only where relevant to the buyer’s sector, contracts, systems, and audit boundary.

Comparing providers beyond Croatia? Our global list of top penetration testing companies covers firms that deliver testing across regions.

Related Balkan and Black Sea markets: Serbia and Bulgaria. To the north, see penetration testing companies in Hungary.

Definition

Penetration testing is a structured adversarial security assessment that combines automated vulnerability discovery with manual exploit validation to identify real-world attack paths, validate control effectiveness, and reduce breach probability.

Why Croatia Buyers Evaluate Penetration Testing Providers Differently

Croatia buyers often evaluate penetration testing through a mix of EU governance pressure, sector-specific assurance needs, and practical delivery constraints. Croatia transposed NIS2 through the Cybersecurity Act (NN 14/2024), while the Cybersecurity Regulation (NN 135/2024) defines implementation measures and risk-management requirements. Finance-sensitive, healthcare-sensitive, SaaS, public-sector-adjacent, and infrastructure-sensitive organizations may need reporting that is usable by risk, audit, procurement, and technical remediation teams. That does not mean every provider is automatically suitable for regulated work, and it does not mean every Croatia buyer is directly subject to every EU or local framework.

The main distinction is methodology. A provider with a local or regional presence may be easier to coordinate with, but local presence does not prove deep exploit validation. A cross-border specialist may offer stronger cloud, API, red-team, or PTaaS capability, but buyers should confirm language, data-handling, on-site, time-zone, and reporting expectations before contracting. For Croatia organizations with EU-facing operations, the strongest shortlist is usually built around evidence: manual testing depth, remediation clarity, retesting terms, cloud/API maturity, and the ability to produce audit-useful reports without overstating regulatory alignment.

Croatia Regulatory and Procurement Context

Croatia transposed NIS2 through the Cybersecurity Act (Zakon o kibernetičkoj sigurnosti), published in Narodne novine 14/2024 on 7 February 2024 and in force eight days after publication; the Cybersecurity Regulation (NN 135/2024) sets out the detailed measures. The Act names the Security and Intelligence Agency (SOA) as the central state body for cybersecurity, and incidents go either to the CSIRT at SOA or to the CARNET National CERT, depending on the sector. The Croatian National Bank (HNB), the Croatian Financial Services Supervisory Agency (HANFA), and the Croatian Civil Aviation Agency act as competent authorities where sector-specific laws apply.

For penetration testing buyers, the audit cycle matters most. Key entities must commission a cybersecurity audit at least once every two years, and important entities must complete a self-assessment on the same cycle (Articles 34 and 35). Under Article 32, audits are carried out by managed security service providers holding a national cybersecurity audit certificate or an equivalent EU certificate. The Act does not mention penetration testing, so a pentest report is evidence for that audit, not a replacement, and the auditor and the pentest provider can be different firms. Banks and other financial entities are also subject to DORA, applicable since 17 January 2025, which requires threat-led penetration testing at least every three years for financial entities identified by their supervisor. Test data that contains personal data falls under GDPR, supervised in Croatia by the data protection agency AZOP. Public bodies publish tenders, notices, and award decisions on the EOJN RH e-procurement platform.

How We Selected and Compared Penetration Testing Companies in Croatia in 2026

This comparison evaluates providers against procurement criteria relevant to Croatia buyers: manual versus automated depth, exploit chaining sophistication, red-team capability, cloud and API testing maturity, reporting quality, remediation clarity, retesting terms where evidenced, compliance mapping where evidenced, regulated-industry relevance where evidenced, and Croatia / EU / CEE / Balkan delivery feasibility. DeepStrike, the publisher of this guide, is a penetration testing provider and is listed first; the order of the list is not a score, and no provider paid for inclusion.

The methodology favors validated exploitability over scan-heavy output. Certifications, office locations, customer references, headcount, retesting policies, and compliance claims are included only when supported by the provider's official sources; where those sources are incomplete, the entry says so. Brand size alone is not treated as proof of technical depth.

How the Croatian shortlist was built: the candidate pool combined Croatian firms that publish offensive security services (Zagreb specialists, ICT integrators, compliance consultancies, and the Bjelovar-based PentestPad team) with international providers that sell testing remotely into the EU. Each entry was checked on 2–3 November 2026 against the provider's own service, about, and contact pages: published test types, addresses or office lists, ownership changes such as Marlink's acquisition of Diverto and Infigo joining the Allurity Group, and any stated certifications. Where a page could not be read or a detail was not published, the entry says what to confirm. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.

Evaluation Weights

Provider-level assurance and individual credentials are treated separately. Company accreditation, ISO certification, PCI assessor status, or other organisational assurance should not be confused with individual credentials such as OSCP, OSWE, CISSP, GIAC, or CREST practitioner certifications.

How to Choose the Right Penetration Testing Company in Croatia

Croatia’s security buyers should watch for common procurement missteps. First, avoid equating brand or scan tools with deeper coverage: ask if the vendor’s process includes manual exploit validation, not just automated scans. Beware “one-off” tests with no scheduled retesting – frequent change in cloud-native environments means vulnerabilities reappear fast. Check that junior testers aren’t doing the engagement alone; top providers disclose senior staff involvement or CREST-qualified teams. Ensure the scope covers all critical assets (apps, APIs, identity stores); underscoping can leave attack paths untested. Verify reporting quality: can the security team clearly use the findings for audit or remediation? Look for compliance alignment – e.g. mapping findings to ISO 27001, GDPR, or sector guidelines. A common trap is mistaking presence in a neighbor market for local fit; always confirm language support and on-site ability if required. Finally, don’t confuse PTaaS platforms with guaranteed depth – read contract details for manual verification. In summary, insist on transparency about methodology, retesting, and deliverables to truly compare penetration testing firms. For service detail, see DeepStrike's web application, mobile application, cloud, and continuous penetration testing pages.

Top 16 Penetration Testing Companies in Croatia (2026)

Quick Comparison: Which Provider Fits Which Need?

Short answer: Zagreb-based specialists (Infigo IS, Marlink Cyber, Nobium, Backtrack) suit buyers who want local testers; integrators (Span, Combis) suit buyers who want testing tied to existing IT or SOC services; compliance-led firms (Cyber Security d.o.o., Adventure Spirit) suit NIS2 work; global PTaaS providers suit recurring cloud and API testing.

1. DeepStrike: Application testing and remediation collaboration

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Croatia relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Croatian clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. Infigo IS: Croatian red team and offensive operations practice

Public offering: Infigo IS lists external and internal penetration tests, web and mobile application tests, specialised tests of IoT devices, smart meters, SCADA systems, mobile payment schemes, and wireless protocols, plus social engineering, code audit, and goal-based red team and offensive operations. Red team deliverables include an executive summary, a technical report with mitigation recommendations, and videos of critical vulnerabilities.

Croatia relevance: Infigo IS publishes its headquarters at Karlovačka cesta 24A, Zagreb, and states that it has offices in five countries. Its website also states that Infigo IS became part of the Allurity Group in April 2025 (https://www.infigo.hr/en/). Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Certifications: Infigo states that its team holds certifications from ISC2, ISACA, Offensive Security, and SANS, and that its CTO is a SANS Certified Instructor.

Official sources: https://www.infigo.hr/en/cybersecurity/red-team-offensive-operations/; https://www.infigo.hr/en/contact/

Buyer fit: Croatian enterprises and regulated organisations that want penetration testing and red teaming from a local specialist with regional reach.

What sets it apart in Croatia: among the Zagreb-headquartered firms listed here, Infigo publishes one of the broadest specialist test ranges, including SCADA systems, smart meters, and mobile payment schemes, and it now operates as part of the Allurity Group.

3. NetSPI: Enterprise programs across multiple asset types

Public offering: NetSPI describes human-delivered penetration testing supported by its PTaaS platform. Published scope includes web applications, APIs, mobile and thick-client applications, cloud, internal and external networks, wireless, hardware, mainframes, and AI/ML systems. Its workflow includes findings management, PDF reporting, and remediation testing.

Croatia relevance: NetSPI's contact page lists Minneapolis headquarters and offices in Portland, Kansas City, Toronto, London, and Pune, India; no office in Croatia is listed, so delivery would be remote. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Official sources: https://www.netspi.com/netspi-ptaas/; https://www.netspi.com/contact/

Buyer fit: Enterprise programs coordinating several asset classes, specialist teams, or business units.

What sets it apart in Croatia: it is the only provider on this list whose published scope includes mainframes, which is relevant to organisations running legacy core systems; delivery to Croatia would be remote.

4. Span: Security assessment within a large Croatian IT provider

Public offering: Span's official cyber security materials describe security assessment alongside protection, detection, and incident response solutions, including a managed security vulnerability assessment for SAP environments that covers infrastructure, operating system, database, and application layers. Confirm whether manual penetration testing and exploitation are included in a proposed scope.

Croatia relevance: Span is a Croatian IT services company based in Zagreb that also operates the Span Cyber Security Center for security training. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://www.span.eu/en/solutions-services/cyber-security/

Buyer fit: Large Croatian organisations that want security assessment connected to wider infrastructure, cloud, and managed IT services.

What sets it apart in Croatia: it is the only listed provider with a published SAP-specific vulnerability assessment, relevant to Croatian enterprises running SAP; its public pages emphasise assessment rather than exploitation, so confirm manual testing depth.

5. Backtrack Information Security: Zagreb offensive security boutique

Public offering: Backtrack Information Security lists penetration testing, vulnerability assessment, OSINT and threat intelligence, social engineering (phishing, vishing, physical, and pretexting scenarios), security awareness training, and cybersecurity consulting. Its published process runs from an initial meeting and scope definition through NDA and formal approval to execution and a structured report with actionable guidance.

Croatia relevance: Backtrack Information Security d.o.o. publishes an address at Adamičeva ulica 3, Zagreb. The company appears to be recently established, and its website still contains placeholder content; check its registration in the Croatian court register (sudreg.pravosudje.hr) and ask for references. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://backtrack-is.hr/; https://backtrack-is.hr/social-engineering

Buyer fit: Croatian product teams and SMEs seeking a hands-on local boutique for focused penetration tests and social engineering.

What sets it apart in Croatia: a small Zagreb boutique whose public offer leans on social engineering (phishing, vishing, physical, and pretexting scenarios) and OSINT; because it appears to be recently established, references matter more than usual.

6. LevelBlue (Trustwave SpiderLabs): Offensive security within a managed security provider

Public offering: LevelBlue's offensive security services, supported by its SpiderLabs research and response team, include penetration testing, red teaming, threat intelligence, threat hunting, vulnerability management, and data security. Findings from these services feed into its Fusion platform, and the offering sits within a wider managed security portfolio.

Croatia relevance: LevelBlue's offensive security page does not name a Croatia office and states that it uses onshore, offshore, and federally cleared staff. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Official sources: https://www.levelblue.com/solutions/offensive-security-solutions; https://www.levelblue.com/company/contact

Buyer fit: Organisations that want penetration testing and red teaming from the provider that runs, or could run, their managed security services.

What sets it apart in Croatia: it mainly suits organisations that already buy, or plan to buy, managed security from LevelBlue and want test findings in the same Fusion platform; it names no Croatian presence.

7. Cobalt: Pentest as a service platform

Public offering: Cobalt delivers pentest as a service (PTaaS): manual pentests of web applications, APIs, mobile apps, AI and LLM applications, external and internal networks, and cloud environments, plus cloud configuration reviews, red teaming, and secure code review. Testers from its vetted Cobalt Core community are matched to the client's technology stack, and its platform provides real-time collaboration, integrations such as Jira and GitHub, and tailored reports.

Croatia relevance: Cobalt lists its US headquarters in Boston and a UK office in Oxford; no office in Croatia is published, and testing is delivered remotely. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Official sources: https://www.cobalt.io/pentest; https://www.cobalt.io/contact-us

Buyer fit: Product and cloud-native teams that want platform-managed, remote pentests with ongoing retesting.

What sets it apart in Croatia: testers from its vetted community are matched to the client's technology stack, which suits Croatian SaaS and product teams that ship often; its nearest published office is in the UK.

8. Bishop Fox: Complex applications, infrastructure, and products

Public offering: Bishop Fox combines offensive security specialists with technology across application, mobile, secure-code, cloud, hardware, network, and AI/LLM assessments. Its catalog distinguishes consulting assessments from continuous exposure services and red-team engagements. Each specialty requires explicit scope and assigned expertise.

Croatia relevance: Bishop Fox lists headquarters in Tempe, Arizona, plus offices in San Francisco, London, and Barcelona (its EU office); no office in Croatia is listed. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Official sources: https://bishopfox.com/services/penetration-testing-services; https://bishopfox.com/contact

Buyer fit: Organisations with a complex application, infrastructure environment, or product requiring several offensive security specialties.

What sets it apart in Croatia: one of the few US specialists here with a published EU office (Barcelona), with hardware, secure-code, and AI/LLM assessments aimed at product companies rather than routine compliance testing.

9. Marlink Cyber (formerly Diverto): Zagreb offensive security within a managed security provider

Public offering: Marlink's cybersecurity page lists penetration testing as black-box, grey-box, or white-box assessments across applications, infrastructure, and identity systems, including web, API, mobile, external, internal, wireless, and Active Directory/Entra ID environments. It also offers red teaming (adversary emulation, social engineering, and red vs. blue exercises), purple teaming, and a managed 24/7 SOC covering IT and OT.

Croatia relevance: Marlink Cyber d.o.o. is listed at Vukasovićeva 1, Zagreb. Marlink acquired Zagreb-based Diverto in July 2024, diverto.hr now redirects to Marlink's cybersecurity page, and that page lists Zagreb among its SOC locations. Confirm which Marlink entity contracts and where the assigned testers are based, and define data handling and any subcontracting in the engagement agreement.

Official sources: https://marlink.com/solutions/possibility-portfolio/possibility-solutions/cybersecurity/; https://marlink.com/contact-us/

Buyer fit: Croatian and regional organisations, including OT operators, that want penetration testing and red teaming from a provider that can also run their managed SOC.

What sets it apart in Croatia: built on the acquired Zagreb firm Diverto, it combines a local offensive practice with an IT/OT SOC that lists Zagreb among its locations, which suits operators that want testing and monitoring from one provider.

10. Cyber Security d.o.o.: Pentesting alongside NIS2, OT, and forensics

Public offering: Cyber Security d.o.o. offers vulnerability assessment and penetration testing across infrastructure, applications, and networks as part of its operational security services, alongside digital forensics and incident response, SCADA/OT security, and NIS2, CRA, and Croatian Cybersecurity Act compliance services. It also describes itself as lead contributor to the EU-funded CURIUM project on Cyber Resilience Act compliance tooling.

Croatia relevance: Cyber Security d.o.o. publishes its registered office at Majstorska 5, Zagreb, and states that it was founded in 2021. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://cyber-security.hr/operational-security-services/; https://cyber-security.hr/

Buyer fit: Croatian organisations, including OT operators, that want penetration testing tied to NIS2 and Croatian Cybersecurity Act obligations.

What sets it apart in Croatia: it explicitly ties its services to the Croatian Cybersecurity Act, NIS2, and the CRA and adds forensics and incident response, which suits entities preparing for their first audit or self-assessment cycle.

11. PentestPad / Secure Block: Pentest platform and testing services

Public offering: PentestPad is a pentest reporting and project platform with branded report generation, imports from 20+ tools such as Burp Suite and Nessus, retesting, client whitelabel access, and self-hosted or cloud deployment. Its services page also lists continuous penetration testing, red teaming, cloud security review, attack surface monitoring, and ISO 27001 and PCI DSS compliance testing.

Croatia relevance: PentestPad is operated by Secure Block d.o.o., Ul. Petra Preradovića 1, Bjelovar, as named in its site footer and contact page (one services page refers to SecureBlock LLC). Confirm the contracting entity and the assigned team, and define data handling and any subcontracting in the engagement agreement.

Official sources: https://pentestpad.com/services; https://pentestpad.com/contact

Buyer fit: Security teams that want pentest workflow tooling, and buyers who want testing from the team behind it.

What sets it apart in Croatia: it is the only Croatian entry that sells pentest workflow software as well as testing, so buyers can license the platform for an in-house team or buy tests from the team behind it.

12. Combis: Security testing within an enterprise ICT provider

Public offering: Combis offers penetration testing, with the approach depending on how much information is available in advance, and security verification of web applications, mobile applications, network devices, and other services, followed by findings and recommended fixes. Its security portfolio also includes a SOC service (30SEC) and managed security.

Croatia relevance: Combis d.o.o. publishes its address at Radnička cesta 21, Zagreb. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://combis.hr/sigurnost/; https://combis.hr/kontakt/

Buyer fit: Large Croatian organisations that want security testing integrated with SOC, infrastructure, and managed ICT services.

What sets it apart in Croatia: a Zagreb ICT integrator with its own SOC service (30SEC), suited to buyers who want testing from an existing infrastructure partner; confirm how the testers stay independent of the teams that build or run your systems.

13. Prescient Security: Penetration testing alongside compliance audits

Public offering: Prescient Security lists compliance penetration testing, traditional penetration testing, web and mobile application testing, network and IoT testing, wireless testing, social engineering, red and purple teaming, code analysis, vulnerability management, and continuous testing, plus its Cacilian PTaaS platform. It also provides audit services for frameworks including SOC 2, ISO standards, PCI DSS, and FedRAMP.

Croatia relevance: Prescient Security lists headquarters in Nashville, Tennessee, and says it has senior auditors across the US, EMEA, and APAC, but names no European office. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Certifications: Prescient states that its affiliate Prescient Assurance LLC is a licensed CPA firm providing audit and attest services.

Official sources: https://prescientsecurity.com/penetration-testing-services; https://prescientsecurity.com/connect

Buyer fit: Organisations that want penetration testing coordinated with compliance audits from the same provider group.

What sets it apart in Croatia: its audit affiliate makes it most relevant to Croatian SaaS exporters that need SOC 2 or similar attestations for international customers, rather than to audits under the Croatian Cybersecurity Act, which require a certified cybersecurity auditor.

14. BreachLock: Human-led and autonomous testing on one platform

Public offering: BreachLock offers human-led PTaaS delivered by CREST-certified pentesters, autonomous AI-driven testing of web and network assets (Breach360) with exploit-backed findings, and a combined option on one platform with shared findings, retests, and reports. It also provides attack surface management, including dark web credential exposure detection, and remediation guidance.

Croatia relevance: BreachLock lists BreachLock Inc. in New York and BreachLock NL B.V. in Amsterdam; no office in Croatia is listed. Confirm which entity contracts. Define tester locations, permitted subcontracting, and GDPR-compliant data handling in the engagement agreement.

Certifications: BreachLock displays CREST and ISO 27001 among its certifications and accreditations.

Official sources: https://www.breachlock.com/products/ptaas; https://www.breachlock.com/about/contact/

Buyer fit: Growing companies that want recurring, platform-based testing that combines automated and expert-led coverage.

What sets it apart in Croatia: its Amsterdam entity gives an EU contracting option, and the mix of autonomous and human-led testing suits SMEs that want frequent coverage of web and network assets.

15. Nobium: Independent Zagreb security consulting

Public offering: Nobium's security practice offers black-box and white-box web application penetration testing, external and internal network infrastructure testing covering network equipment, servers, Active Directory, and wireless networks, social engineering (targeted phishing and baiting), and threat modelling and risk analysis.

Croatia relevance: Nobium d.o.o. publishes an address at Ulica Klementa Crnčića 18, Zagreb, and states that it was founded in 2002. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://sigurnost.nobium.hr/; https://www.nobium.hr/hr/kontakt.html

Buyer fit: Croatian SMBs and public organisations that want conventional web and infrastructure testing with threat modelling from an independent local firm.

What sets it apart in Croatia: an independent Zagreb firm founded in 2002 that pairs conventional web and infrastructure testing with threat modelling, suited to buyers who prefer a tester not tied to an integrator or managed-services contract.

16. Adventure Spirit Consulting: Pentesting within a GRC program

Public offering: Adventure Spirit Consulting offers penetration tests, vulnerability assessment, and red teaming as part of its security audits and testing service, covering scoping and rules of engagement, reconnaissance and OSINT, automated and manual vulnerability assessment, controlled exploitation, social engineering, and reporting with CVSS scoring, a management summary, a remediation plan, and retesting. It also provides NIS2, DORA, GDPR, and ISO compliance services and runs its own GRC platform.

Croatia relevance: Adventure Spirit d.o.o. is based in Zagreb and maps its testing service to measures in Annex II of the Croatian Cybersecurity Regulation. Confirm the assigned team and define data handling and any subcontracting in the engagement agreement.

Official sources: https://adventurespirit.hr/usluge/sigurnosni-auditi-i-testiranje/; https://adventurespirit.hr/en/

Buyer fit: Croatian regulated organisations that want penetration testing, remediation, and NIS2 or DORA compliance work in one engagement.

What sets it apart in Croatia: it maps its testing to Annex II measures of the Croatian Cybersecurity Regulation and sells NIS2, DORA, and GRC work alongside it, suited to entities that want test evidence and compliance work in one engagement.

Comparison Table

What Buyers in Croatia Get Wrong When Comparing Penetration Testing Firms

Most mistakes in Croatia come from mismatched expectations. First, treating a pentest as the Cybersecurity Act audit: key entities must commission an audit from a certified auditor every two years and important entities must self-assess, and a pentest report is evidence for that process, not a substitute. Second, assuming a Zagreb address means the testers are local: confirm where the assigned team sits, especially with providers that belong to international groups. Third, buying testing from the integrator that built or runs the environment without agreeing how independence is preserved. Fourth, ignoring data handling: findings and evidence can contain personal data covered by GDPR, so agree storage location and retention, especially on PTaaS platforms hosted outside Croatia. Finally, comparing quotes with different scopes: check that each covers the same assets, authenticated testing, manual exploit validation, and retesting.

Enterprise vs SMB — Which Type of Penetration Testing Company Do You Need in Croatia?

Short answer: enterprises and NIS2 key entities usually need broad, audit-ready testing across networks, applications, cloud, and identity, often with red teaming; SMEs usually need a focused, well-scoped test of their most exposed systems with clear retesting. Choose by scope, regulatory status, and internal capacity, not by vendor size.

Under the Cybersecurity Act, key entities face an audit every two years and important entities a self-assessment, so larger Croatian organisations usually need test evidence an auditor can use, while smaller suppliers may meet pentest requirements through customer contracts rather than the Act. Large organisations that already work with an integrator or managed security provider such as Span, Combis, or Marlink may prefer to add testing to that relationship, but should confirm the testers are independent of the team that runs their systems. SMEs and product teams often get better value from a focused scope with a local boutique (for example Nobium, Backtrack, or Adventure Spirit) or a PTaaS platform with included retesting. In both cases, ask for manual exploit validation, named senior testers, and agreed retest terms.

What Influences Penetration Testing Cost in Croatia?

Short answer: penetration testing cost in Croatia depends on scope, depth, and reporting needs rather than a national rate. The main drivers are the number and complexity of applications, networks, and cloud assets, authenticated testing, retesting, audit-ready reporting, on-site work, and tester seniority. Ask each provider for a scoped written quote.

Pricing varies by scope and method, driven mainly by those factors rather than a fixed country rate. Key cost drivers are: size of scope (number and complexity of apps, networks, cloud assets), and depth (whether testing includes chaining exploits). Authenticated testing (with credentials) and multi-factor setups cost more due to complexity. Testing APIs and modern single-page apps adds effort. Inclusion of retesting (verifying fixes) also increases cost, but adds value in assurance. Reporting requirements matter: an audit-ready compliance report (mapping to PCI/NIS2/SOC2 controls) can add to the price. On-site versus remote delivery can change coordination effort, scheduling complexity, and commercial terms. Croatia buyers should confirm whether on-site work is required or whether remote testing satisfies the scope. Tester seniority affects project effort and commercial structure, especially where deep manual exploit validation or red-team-style work is required. Cloud or hybrid scopes require testers skilled in AWS/Azure/AzureAD – specialized skills can raise cost. Organizational complexity (segmented networks, many third-party apps) also drives hours. Continuous testing subscriptions often spread costs over time, whereas one-off projects front-load effort. In summary, Croatia buyers should budget based on project complexity and compliance needs, rather than fixed “Croatia rates.”

FAQs

How much do penetration testing services cost in Croatia?

Cost depends on scope and depth, not a country's flat rate. Factors include the number of systems, type of testing (web, network, cloud, API), and whether retesting is included. Complex enterprise tests cost more than a small scope scan. Buyers should obtain detailed quotes based on their environment. Avoid press claims of fixed local rates; focus on defining exact requirements.

What is included in enterprise penetration testing?

An enterprise engagement typically covers broad scopes (external network, internal network, web apps, cloud, API, etc.), plus advanced phases like social engineering or full red-team simulations. It includes both automated scanning and manual exploitation, plus detailed reporting with risk analysis and mitigation guidance. Often it includes compliance mapping (e.g. to ISO 27001 or NIS2). Enterprise tests may come with retesting of critical issues as fixes are made.

Are certifications more important than tools?

For penetration testing, certified experts usually leverage tools but add human insight. Certifications (like OSCP, CREST CCT) indicate individual tester skill, which is critical for deep testing. Tools are helpful for automation, but human testers are better placed to find complex logic flaws and use real attacker techniques. Evaluate providers on team expertise (certifications) and process, not just on marketing of a particular tool.

How long does a pentest engagement take?

Duration depends on scope, access and reporting needs; as an illustration only, many engagements run 1–2 weeks per target area. A small web app test might take a few days; a full network + multiple apps pentest could take several weeks. Larger red-team projects can extend to months if part of a continuous program. Plan lead time: scoping and scheduling often precede testing. Ask each provider for a schedule covering planning, testing, reporting and retesting before contracting.

Is penetration testing required for compliance frameworks like GDPR, NIS2, DORA, etc.?

Applicability depends on sector, systems, contracts, and audit scope. GDPR, NIS2, DORA, HNB expectations, HANFA expectations, SOC 2, ISO 27001, and PCI DSS do not apply uniformly to every Croatian buyer. PCI DSS contains explicit penetration-testing requirements where cardholder-data environments are in scope. Other frameworks may make penetration testing commercially important as part of risk analysis, control validation, or audit evidence, but buyers should confirm exact obligations with legal, compliance, and assessor stakeholders.

How often should testing be performed?

There is no universal annual penetration-test requirement across every compliance framework. Testing frequency should follow the applicable framework, sector, risk profile, contracts, and material system changes. Many modern organizations also use quarterly or continuous testing for critical internet-facing assets. Any major change (new system launch, cloud migration, or after a breach) should trigger testing. Croatia buyers should align test frequency with risk and regulatory demands – e.g. NIS2 suggests periodic reviews of security controls.

Should Croatia buyers choose a local provider or a cross-border specialist firm?

It depends on priorities. Local firms can offer language convenience and potentially on-site support, but cross-border firms often bring wider technical expertise and mature processes. Croatia buyers should evaluate technical fit first: if the local vendor has certified experts and meets methodology needs, they can be good partners. Otherwise, choosing a global specialist with proven EU experience may be more effective. Always verify any local claims and ensure communication/logistics will work in practice.

For Croatian buyers, the practical shortlist depends on regulatory status and delivery needs. Entities facing a Cybersecurity Act audit need testing evidence that a certified auditor can use; DORA-scoped financial entities need a provider able to support supervisor-led threat-led testing; product and SaaS teams need cloud and API depth with retesting. Verify each provider's claims on its own pages, review a sample report, and confirm tester location and data handling before contracting.

About the Author

Technical Review: DeepStrike Offensive Security Team

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.