Penetration Testing Companies in Greece: 2026 Guide

Executive Answer

Choosing penetration testing companies in Greece starts with the systems and business risks you need tested. CENSUS, TwelveSec, ADACOM, and DeepStrike offer different starting points for a shortlist, but a provider name alone does not establish technical fit, local delivery, or regulatory suitability. Greek buyers should compare the proposed scope, responsible testers, evidence quality, data handling, and remediation support. This guide explains the relevant Greek and EU testing requirements, separates project testing from ongoing services, and gives security and procurement teams a practical way to request comparable proposals and judge the results.

Comparing providers beyond Greece? Our list of the top penetration testing companies worldwide covers firms that deliver testing across regions.

Which penetration testing companies in Greece should you compare?

Start with providers whose published services match your environment, then verify the team and contract behind the proposal. An application assessment, a network penetration test, and a financial-sector threat-led exercise solve different problems.

How we selected: we started from providers that publish penetration testing for Greek buyers, meaning firms with an Athens or Thessaloniki office, a Greek contracting entity, or a CREST marketplace listing for Greece, plus DeepStrike as publisher. We read each provider's own service, contact, and certification pages and the CREST marketplace, and checked Greece-specific signals: Greek office and entity, company accreditation, coverage that maps to JMD 1689/2025 Article 18 and DORA testing, OT/ICS capability, Greek-language reporting, and retest terms. Pages were first checked on September 6, 2026 and rechecked on 3 November 2026. This is desk research of public material, not a commissioned test of each firm's delivery quality or an exhaustive market survey. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.

1. DeepStrike: Application testing and remediation collaboration

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Greece relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Greek clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. CENSUS S.A.: CREST-accredited, research-led security testing in Athens

Public offering: CENSUS describes three service lines: cybersecurity engineering, which includes security assessment and validation across cloud, device, web, and mobile; vulnerability research using fuzzing, reverse engineering, and code analysis; and a Tiger Team offering scoped engagements (bespoke penetration testing, red teaming, and purple teaming) as well as continuous engagements that range from compliance work to live crisis simulations.

Greece relevance: CENSUS lists its Athens office at 128 A. Siggrou Ave., Athens 117 45, alongside offices in Vilnius, London, Abu Dhabi, and Dubai, and its CREST marketplace entry lists Greece as its country. Confirm the contracting entity, tester locations, and data-handling terms in the agreement.

Certifications: The CREST marketplace lists CENSUS S.A. with CREST Penetration Testing accreditation and ISO 27001 and ISO 9001 company certifications.

Official sources: https://census-labs.com/; https://census-labs.com/contact; https://marketplace.crest.org/census-s-a/

Best fit: Organizations that need research-led application, device, or cloud security testing and want a CREST-accredited provider based in Athens.

Limitation / what to confirm: The public site describes its services at a high level; request the methodology, a sample report, and retest terms, and confirm the Greek contracting entity and the consultants assigned.

In this market: It combines a Tiger Team adversarial testing service with a vulnerability research line (fuzzing, reverse engineering, code analysis), names banking, maritime, automotive, and telecommunications among its sectors, and is the CREST-listed Greek provider in this shortlist.

3. TwelveSec: Application, infrastructure, and OT security assurance

Public offering: TwelveSec's assurance services cover application penetration testing and source code review (automated SAST and DAST plus manual review) for web, desktop, and mobile applications, system penetration testing of networks and services, VoIP and Wi-Fi testing, vulnerability assessment, red teaming, and assessments of OT/ICS and IoT environments. Its site also lists threat-led penetration testing, incident response, security training, and secure SDLC services.

Greece relevance: TwelveSec publishes a Greek (+30) phone number for contact but does not list a street address on its contact or headquarters pages. Confirm the contracting entity, tester locations, reporting language, and data-handling terms in the agreement.

Certifications: TwelveSec lists ISO 27001, ISO 27701, ISO 9001, ISO 22301, ISO 20000-1, and Cyber Essentials certifications, and personnel certifications including OSCP, OSWE, OSEP, OSCE, CEH, CISA, and CISM.

Official sources: https://twelvesec.com/ts-services/; https://twelvesec.com/contact-us/

Best fit: Organizations that want application, infrastructure, and OT or IoT security testing, together with source code review, from one consultancy.

Limitation / what to confirm: No street address, reporting format, or retest terms are published; confirm the contracting entity, named testers, reporting language, and fix verification.

In this market: Its services page lists TIBER-EU-aligned TLPT and DORA compliance services alongside PLC/RTU and control-application assessments, which suits Greek banks and energy or industrial operators.

4. ADACOM: Security assurance from Athens and Thessaloniki offices

Public offering: ADACOM's Cyber Security Assurance services list penetration testing and vulnerability assessment, red teaming, purple teaming, infrastructure and network testing, web and mobile application testing (including APIs and desktop applications), social engineering testing, and cloud environment testing for AWS, Microsoft Azure, and Google Cloud Platform. Its red team description includes a findings report with attack scenarios and recommendations, plus remediation validation.

Greece relevance: ADACOM's contact page lists its Athens headquarters at 25 Kreontos Str., 104 42 Athens, and a Thessaloniki office in Thermi, with further offices in Cyprus and Bahrain. ADACOM is part of IDEAL Holdings, an Athens-listed group. Confirm where the assigned testers work, whether on-site access and Greek-language reporting are included, and how data is handled in the agreement.

Certifications: ADACOM lists certifications including ISO/IEC 27001:2022, ISO/IEC 27701, ISO 9001:2015, ISO 22301, and ISO/IEC 20000-1.

Official sources: https://www.adacom.com/cyber-security/assurance; https://www.adacom.com/company/contact-us

Best fit: Greek organizations that want penetration testing coordinated with a broader security program from a provider with Athens and Thessaloniki offices.

Limitation / what to confirm: Retest detail is published only for red and purple teaming, and its assurance page does not mention DORA, NIS2, or TLPT; confirm deliverables, fix verification, and how the test maps to JMD 1689/2025.

In this market: Part of Athens-listed IDEAL Holdings with offices in Athens and Thessaloniki, it suits buyers in northern Greece or those that want testing alongside managed security services.

What regulations and standards drive penetration testing in Greece?

The obligation depends on the entity, applicable framework, and systems in scope. Establish those first; a generic claim that a provider is “NIS2 compliant” does not explain what your organization must test.

Greek NIS2 implementation: the national detail matters

Greece implemented NIS2 through Law 5160/2024. Joint Ministerial Decision (JMD) 1689/2025, Article 18, specifies external penetration tests at least annually for covered essential and important entities. Essential entities additionally carry out internal tests at least annually. The provisions also address testing following serious cybersecurity incidents and validation of corrective measures. Confirm your classification and applicable sector rules before defining the engagement. Greek national cybersecurity requirements, Article 18.

The National Cybersecurity Authority's legislative index is the starting point for checking the national framework and subsequent instruments. A penetration test supplies evidence for part of an organization's security program; it does not discharge all governance, incident-management, or other obligations. Greek cybersecurity legislation.

Procurement context: the Greek provider market is small. It runs from Athens-based specialists (CENSUS, TwelveSec) to larger Greek groups that sell testing next to managed security services (ADACOM, part of IDEAL Holdings) and international firms that deliver remotely. Public-sector and many regulated buyers prefer Greek-language deliverables and a Greek or EU contracting entity, so state reporting language, on-site needs in Athens, Thessaloniki, or the islands, and data handling under GDPR, which the Hellenic Data Protection Authority supervises, in the request for proposal.

DORA for covered financial entities

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since January 17, 2025. Its Articles 24–25 address a risk-based testing program; Article 26 establishes advanced threat-led penetration testing, or TLPT, for designated entities, normally at least every three years subject to supervisory adjustment. A routine application pentest and a regulator-governed TLPT are different procurements. Financial-sector buyers should establish which regime and testing obligations apply before commissioning work. DORA's testing provisions.

PCI DSS, GDPR, and ISO/IEC 27001

Under the defined approach in PCI DSS v4.0.1, Requirements 11.4.2 and 11.4.3 call for applicable internal and external penetration testing every 12 months and following significant infrastructure or application changes. Requirement 11.4.4 addresses correction and repeat testing. Establish the relevant cardholder-data scope and assessment requirements; a vulnerability scan is not interchangeable with a penetration test. PCI DSS v4.0.1, Requirement 11.4.

GDPR Article 32 requires security appropriate to the processing risk and a process for regularly evaluating the effectiveness of security measures. Penetration testing can support that work, but Article 32 does not prescribe one annual pentest for every business. GDPR Article 32.

ISO/IEC 27001:2022 concerns an information security management system and risk treatment. When buying testing for an ISO program, ask how the scope and findings support the organization's risk assessment, selected controls, and remediation decisions. A penetration-test report is not itself ISO certification. ISO/IEC 27001:2022.

What types of pentesting services do companies offer?

Choose the test by the risk question it must answer. Counting domains or IP addresses alone does not describe the complexity of user roles, business processes, trust boundaries, or connected services.

For web applications, include important workflows and application programming interfaces, not just the public login page. The right web application assessment scope should identify the roles, integrations, and business rules that need testing.

For mobile software, include both the app and its backend assumptions. A mobile application penetration test should make clear which platforms, builds, accounts, and server components are included.

OWASP's Mobile Application Security Verification Standard provides a useful reference for discussing mobile security controls. Ask the provider which applicable controls and test cases it will examine, rather than treating a logo as proof of coverage. OWASP MASVS.

Cloud work needs an explicit distinction between reviewing configuration and validating an attack path. A cloud penetration testing scope should define permitted accounts, identities, services, and operational constraints.

Red teaming is useful when the objective includes detection and response, but it does not automatically replace a detailed assessment of every application. Social engineering, physical access, and production-impacting activity require their own explicit authorization and safeguards.

How do internal and external penetration tests differ?

External tests begin outside the organization's network boundary and examine agreed internet-facing systems. Internal tests begin from an agreed internal foothold, such as a low-privilege account or network connection, and assess what that access could enable.

That starting position is separate from black-box, gray-box, or white-box testing. An external application test can include credentials and documentation; an internal assessment does not have to begin with administrator access. Define both the starting point and the information provided to testers in the statement of work.

For networks spanning offices, cloud services, and remote workers, identify the actual trust boundaries instead of assuming that every asset inside an office is trusted. This internal versus external testing comparison explains how the scopes complement one another.

How does manual testing compare to automated scanning?

Automated tools help discover assets, identify known weaknesses, and repeat checks at scale. Manual analysis adds context: whether a finding is exploitable under the agreed conditions, how application-specific rules behave, and whether several weaknesses form a meaningful attack path.

Ask the provider to separate scanner observations from confirmed findings and to record limitations. Neither a large vulnerability count nor the phrase “fully manual” establishes quality on its own. Our manual versus automated testing guide explains where each approach contributes.

A useful assessment validates impact with the minimum evidence needed. For example, a tester can use two authorized test accounts and synthetic records to demonstrate an access-control failure without collecting unrelated customer data. The report should distinguish what was demonstrated from a wider consequence that remains inferred.

What is PTaaS versus traditional pentesting?

A traditional engagement is usually a defined assessment with an agreed scope, testing window, report, and remediation follow-up. Penetration Testing as a Service, or PTaaS, adds an ongoing delivery and collaboration model, but providers differ in how much testing is actually included.

Compare testing effort, coverage, change triggers, reporting, and retesting rather than the subscription name. The PTaaS versus traditional pentesting comparison is useful when deciding between a scheduled project and continuing support.

For a team releasing frequently, agree which changes warrant targeted testing and when the broader baseline scope will be reassessed. A continuous testing program should make those decisions visible; it should not imply that every deployment is instantly or completely tested.

Record how security findings enter the engineering workflow and who owns follow-up. Ask about the retest window, number of permitted cycles, exclusions, and treatment of newly introduced vulnerabilities.

What factors influence penetration testing costs in Greece?

There is no fixed price list that can reliably represent every Greek engagement. The cost depends on the scope and the work needed to assess it. A small external network review and a multi-role application, API, mobile, and internal-network engagement are not comparable purchases.

For Athens, Thessaloniki, Crete, or a distributed organization, request the same scope from each provider. Include:

• Applications, API families, mobile platforms, cloud environments, and network boundaries.
• User roles, tenant boundaries, critical workflows, and available documentation.
• Agreed testing effort, calendar window, and named specialist requirements.
• Production safeguards, permitted hours, and emergency contacts.
• On-site access, travel, reporting language, currency, and tax treatment.
• Report contents, technical walkthrough, remediation support, and retesting terms.

Ask suppliers to identify exclusions and additional charges. Comparing an initial headline price can be misleading if one proposal omits authenticated testing, reporting time, or remediation validation.

DeepStrike's published testing plans distinguish one-shot and continuous engagements. Use the current scoped proposal to establish the commercial terms; a generic international price range is not a verified Greek market benchmark.

How should you compare proposals and accept the results?

Use a Scope–Evidence–Closure review before signing and again when accepting the report. This is a practical procurement framework: it checks whether the work promised, the risk demonstrated, and the remediation status can be traced to one another.

NIST SP 800-115 remains a useful planning reference for technical security assessments, including interpreting findings and developing mitigation strategies. It is guidance for building an assessment process, not proof that a vendor has covered every risk. NIST's testing and assessment guide.

For an access-control finding, a strong report identifies the two permitted test roles, the synthetic record, the expected restriction, and the observed server behavior. Closure means checking the corrected authorization decision and recording the result in the tested environment. Re-running a generic scanner would not by itself establish that the business rule is fixed.

Request a redacted sample report before purchase. Look for concrete evidence and remediation guidance, then ask how urgent findings are communicated during the engagement. Avoid using a “clean” report as the sole measure of success: limitations, untested areas, and unresolved risk must remain visible.

FAQ

Can a provider test systems in Athens, Thessaloniki, or Crete remotely?

Many application and internet-facing assessments can be delivered through agreed remote access. Internal, wireless, physical, or restricted-environment work may need a local presence or a securely arranged testing foothold. Confirm delivery location, access, travel, time zone, and reporting language in the proposal; a country landing page does not prove an office exists there.

Should I require CREST accreditation or individual tester certifications?

Company accreditation and personal qualifications answer different questions. Check the exact company and relevant accreditation category, then ask who will perform your test and what experience they have with your technology. Match any mandatory credential requirement to the contract or applicable assurance scheme; do not substitute a badge for a review of scope and report quality.

What should I provide before the test begins?

Prepare an asset inventory, architecture summary, important business workflows, user roles, and relevant API documentation. Agree written authorization, exclusions, third-party permissions, stop conditions, and emergency contacts. Provide credentials through an approved secure channel and use synthetic data where practical.

Can I share the penetration-test report with customers?

Arrange sharing rights and permitted recipients in advance. A full technical report can reveal exploitable details, so consider whether a redacted report or completion letter serves the customer's assurance need. Keep the tested scope, dates, limitations, and unresolved issues clear in any shared version.

Does my cloud provider's security testing cover my application?

Do not assume it does. Ask which responsibilities remain with your organization, including application logic, customer-managed identities, configuration, and integrations. Your engagement should identify the permitted customer-controlled assets and relevant third-party testing conditions.

Can a PTaaS subscription satisfy a required periodic assessment?

Only the work performed and its evidence can answer that question. Check that the agreement covers the required systems, methodology, frequency, independence where applicable, reporting, and remediation verification. Targeted checks after releases may complement a broader assessment without satisfying its entire scope.

Conclusion

The right penetration testing companies in Greece are those whose proposal matches your systems, assurance requirements, and ability to remediate findings. Use the shortlist to begin due diligence, confirm the applicable Greek or sector-specific rules, and compare scope, evidence, and closure on equal terms. Choose the engagement that makes its coverage and limitations clear and gives your engineers findings they can act on.

Request a scoped DeepStrike proposal covering your assets, access assumptions, testing effort, deliverables, and retesting requirements.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.