Top Penetration Testing Companies in Latvia (2026)

Organizations comparing penetration testing companies in Latvia should look beyond a company name or localized landing page. A defensible shortlist should confirm what the provider actually tests, whether it has a Latvia-based operation or delivers remotely, who the assigned testers are, how data is handled, what the report contains, and whether remediation and retesting are included. This 2026 list covers both Latvia-based and international providers serving Latvian buyers, using public evidence from official company websites reviewed in November 2026 and clear limitations rather than invented scores or national price benchmarks.

Comparing providers beyond Latvia? Our worldwide list of penetration testing companies covers firms that deliver testing across regions.

In the Baltics, see also Lithuania and Estonia.

DeepStrike publishes this article and includes itself in the list. DeepStrike is listed first as a disclosed editorial placement, not because of an independent award, market-wide vote, or claim that it is the right provider for every buyer. The remaining providers are ordered by the strength and relevance of the public evidence available for this procurement task. List order is not a quality ranking.

TL;DR: Verify the provider's actual Latvia relationship, active testing scopes, assigned tester qualifications, written authorization process, data-handling terms, reporting quality, remediation support, and retest deliverable. For regulated or critical environments, also verify whether Latvian or EU rules impose specific tester, independence, or testing requirements for your entity and system.

How we selected penetration testing companies serving Latvia

A company qualified for consideration when current public evidence showed an active penetration-testing or closely related offensive-security service, a credible operating business, a relevant relationship to Latvia, and enough scope detail to support a fair buyer-oriented profile. Directory listings alone were not enough.

We used three relationship categories:

1. Latvia-headquartered or Latvia-registered provider
2. International provider with a verified Latvian legal entity or staffed office
3. International remote provider with explicit evidence of serving Latvia or the EEA

A Latvia URL, a Riga mention in a directory, or the ability to accept an inquiry does not by itself establish a local office, local-language delivery, staffed presence, or Latvian contracting entity. Buyers should confirm the contracting party, assigned team, delivery language, on-site availability, time zone, insurance, and data-handling terms in the statement of work.

DeepStrike is listed first as a disclosed editorial placement. The same evidence categories and buyer-verification standard still apply to DeepStrike, including its main limitation for this market: it has no Latvian office or Latvian legal entity and delivers testing remotely.

Sources and check date: Each profile was built from the provider's own service, contact, and certification pages and, where published, its Latvian company registration number. We checked them in November 2026; this is desk research, not hands-on testing of each provider. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.

Comparison of top penetration testing companies in Latvia

Provider profiles

1. DeepStrike: Human-led testing with remediation collaboration

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Latvia relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Latvian clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. OffSeq (SEQ SIA): Riga-based offensive security and DORA TLPT

Public offering: OffSeq lists API security testing, mobile app security testing, AI and LLM security, security audits, and red team and adversary emulation services. Its cloud line covers cloud security posture assessment and Kubernetes and container security, and it offers DORA threat-led penetration testing (TLPT) and DORA compliance and resilience testing. The site describes attacker-led testing with clear evidence and practical remediation guidance for organizations across the EU.

Latvia relevance: OffSeq is operated by SEQ SIA (Reg. No. 40203410806), which lists its address at Lastadijas 12 k-3, Riga, with a Latvian phone line and a Latvian-language site. Confirm named testers, permitted subcontracting, and data-handling terms in the agreement.

Certifications: OffSeq states its team holds credentials including OSCP, OSEP, OSWE, OSED, OSCE3, GXPN, GPEN, GWAPT, CISSP, CISA, CISM, and PECB ISO/IEC 27001 Senior Lead Auditor and Lead Pen Test Professional; individual holders are not named.

Official sources: https://offseq.com/en/services/; https://offseq.com/en/contact/

Buyer fit: Latvian and EU organizations, including financial entities preparing for DORA, that want application, cloud, and adversary-simulation testing from a Riga-based specialist.

What sets it apart in Latvia: the only Riga-registered provider here that publishes a DORA threat-led penetration testing offer, relevant to Latvian banks and payment firms.

3. Possible Security (I SIA): Latvian penetration testing and red teaming

Public offering: Possible Security lists penetration testing, red teaming, assumed breach testing, and vulnerability research. Its penetration testing page covers web and mobile applications, servers and cloud infrastructure, and internal and external networks, following a five-step process from scoping and discovery through controlled exploitation, risk-based reporting, and a debrief. It states that testing follows OWASP and NIST frameworks plus in-house tools, with a written report that prioritizes remediation steps.

Latvia relevance: The site names the operating company as I SIA (Reg. No. 44103127405, Latvian VAT number) and describes Possible Security as an IT security service provider since 2013, but it does not publish a street address. Confirm the contracting entity, tester locations, and data-handling terms in the agreement.

Official sources: https://possiblesecurity.com/penetration-testing; https://possiblesecurity.com/contact-us

Buyer fit: Latvian organizations that want locally registered testing across applications, cloud and server environments, and networks.

What sets it apart in Latvia: a Latvian testing specialist operating since 2013 that publishes assumed breach testing and vulnerability research, not only standard pentest scopes.

4. Cyber Circle: Penetration testing alongside an accredited CSIRT

Public offering: Cyber Circle lists penetration testing and red teaming under its proactive services. Penetration testing covers infrastructure and its components, networks, mobile and web applications, and source code review, while red teaming simulates adversary behavior to assess attack likelihood, vectors, and impact on sensitive data. The company also provides incident response, digital forensics, and malware analysis through its CSIRT.

Latvia relevance: Cyber Circle Ltd. identifies Latvia as its headquarters, but the pages reviewed do not publish a street address. Confirm the contracting entity, assigned testers, and data-handling terms in the agreement.

Certifications: Cyber Circle states its CSIRT is an accredited team in the Trusted Introducer European CSIRT community.

Official sources: https://www.cybercircle.eu/proactive; https://www.cybercircle.eu/

Buyer fit: Organizations that want offensive testing from a provider that also handles incident response and forensics.

What sets it apart in Latvia: a Trusted Introducer accredited CSIRT alongside testing, useful for entities under the National Cyber Security Law that need incident handling as well as testing.

5. Squalio: Riga IT provider with application and infrastructure testing

Public offering: Squalio's penetration testing service covers static and dynamic web applications, client portals and APIs, mobile apps, internal systems such as ERP and CRM, and on-premises and cloud infrastructure including servers, networks, and IoT devices; OT/ICS is also mentioned. In grey-box tests, testers map business-logic attack vectors and exploit them manually and with their own scripts before running automated tools, and every automated finding is reviewed by hand. Reports include a management summary, CVSSv3-scored findings, reproduction steps, remediation recommendations, and a prioritized remediation roadmap.

Latvia relevance: Squalio lists its address at Krišjāņa Valdemāra Street 21-19, Riga, and penetration testing sits within a wider IT services and software licensing business. Confirm which team performs the tests, permitted subcontracting, and data handling in the agreement.

Official sources: https://squalio.com/services/penetration-testing; https://squalio.com/about-us/contacts

Buyer fit: Organizations with mixed estates, including ERP, CRM, cloud, and IoT, that want testing from a Riga-based IT provider.

What sets it apart in Latvia: one of the few Latvian providers here that names ERP, CRM, IoT, and OT/ICS in its testing scope.

6. OptiCom: Riga IT integrator with penetration testing

Public offering: OptiCom's penetration tests simulate both an external attacker and an employee with limited access, follow ISO 27001 recommendations, and can be run as black-, white-, or grey-box tests. Its published steps run from planning and reconnaissance through the attack, analysis and reporting, and recommendations, and each test is agreed individually with defined times, techniques, and targets. The company also offers vulnerability diagnostics, DDoS tests, a SOC service, and NIS2-related services within a wider IT integration portfolio.

Latvia relevance: SIA OPTICOM (Reg. No. 40003231409), founded in 1994, lists its address at Duntes iela 3, Riga. Confirm who performs the testing, permitted subcontracting, and data handling in the agreement.

Certifications: OptiCom states it holds ISO 27001:2022 and ISO 9001:2015 certification and that its penetration tests are performed by a Certified Ethical Hacker (CEH) specialist.

Official sources: https://www.opticom.lv/en/services/penetration-tests; https://opticom.lv/en

Buyer fit: Organizations that want infrastructure-focused penetration testing within a wider IT integration or NIS2 relationship.

What sets it apart in Latvia: a Riga integrator operating since 1994 with ISO 27001 certification, suited to infrastructure tests bought alongside IT services; check the tester qualification rules in Regulation No. 397 if they apply to you.

7. IT Centrs: Latvian security consultancy with intrusion testing

Public offering: SIA IT Centrs, founded in 2000, provides information systems security consulting, audits, testing, and training, including penetration (intrusion) testing carried out by consultants with security audit and consulting experience. It also runs information security and ethical hacking courses.

Latvia relevance: SIA IT Centrs (Reg. No. 40003481064) lists its address at Rūpnieku iela 8, Piņķi, in the Riga area. Confirm current testing depth, named testers, and data-handling terms in the agreement.

Certifications: IT Centrs lists consultant certifications including CISA, CRISC, CISSP, an ISO 27001 Lead Auditor qualification, and CEH.

Official sources: https://www.itcentrs.lv/itc/pakalpojumi; https://www.itcentrs.lv/

Buyer fit: Latvian organizations that want penetration testing combined with security audits and staff training from a long-established local consultancy.

What sets it apart in Latvia: an audit-led consultancy operating since 2000, a fit when penetration testing must sit next to security audits and staff training.

8. CITM Advisory: Riga-based application testing

Public offering: SIA CITM Advisory performs cybersecurity (intrusion) testing of web, mobile, API, and desktop applications against standards including OWASP WSTG 4.2, ASVS 4.0, MSTG, OSSTMM 3, and NIST. It also offers red teaming and cyber resilience checks alongside IT management consulting.

Latvia relevance: SIA CITM Advisory (Reg. No. 50203395091) is based in Riga, though the pages reviewed do not publish a street address. Confirm the contracting entity, assigned testers, and data handling in the agreement.

Certifications: CITM lists team certifications including OSCP, CPTE, CEH, CISA, CISSP, CISM, and ISO/IEC 27001 Lead Auditor.

Official sources: https://www.citm.lv/pakalpojumi; https://www.citm.lv/pieteikties

Buyer fit: Software teams that want a Riga-based option for web, mobile, API, or desktop application testing.

What sets it apart in Latvia: application testing mapped to named standards (OWASP WSTG, ASVS, MSTG, OSSTMM) with a published Latvian service catalogue.

What serving Latvia means in practice

“Serving Latvia” can describe materially different buying relationships. A Latvia-registered provider may contract locally and staff work from Latvia. An international provider may have a verified Latvian legal entity or office. A remote provider may serve Latvian organizations without any local legal entity or staff.

Procurement should therefore ask for the legal company name on the contract, registered address, invoicing entity, assigned tester location, working language, availability for on-site testing, time-zone coverage, cyber/professional liability insurance where required, and an emergency contact path.

Data handling is equally important. Confirm what production data testers can access, whether credentials or evidence leave the EEA, where screenshots and logs are stored, who can access them, retention periods, deletion commitments, and whether subprocessors are involved. These terms should be explicit in the contract or data-processing documentation rather than inferred from marketing language.

How to choose a penetration testing provider in Latvia

Start with the asset and attack surface. A web application, mobile app, cloud tenant, external network, internal Active Directory environment, API, wireless environment, or OT system needs different authorization boundaries, safety controls, and skills. DeepStrike's web application testing guidance is one example of why application-specific scope matters.

Then ask how the provider combines automation with manual testing. Scanners are useful for coverage and repeatability, but buyers should understand what testers manually validate, how they test authentication and authorization logic, how chained issues are handled, and how false positives are removed.

Evaluate the assigned team, not only the brand. Request the names or qualification profile of the people who will actually test the environment, especially where a regulation, contract, or internal policy imposes experience, certification, or independence requirements.

Define written authorization and rules of engagement before testing begins. The agreement should identify targets, exclusions, source IPs where appropriate, test window, prohibited techniques, production-safety controls, social-engineering boundaries, data-access limits, stop conditions, and emergency contacts.

For cloud testing, confirm which cloud accounts, subscriptions, tenants, identities, and third-party services are in scope. A provider's cloud penetration-testing capability does not eliminate the need for customer- and cloud-provider-specific authorization.

Reporting should serve both remediation and governance. Ask for reproducible evidence, affected assets, attack preconditions, severity rationale, business impact, remediation guidance, and an executive summary that does not hide technical detail. Confirm how critical findings are escalated during the test rather than waiting for the final report.

Retesting should be defined in writing. Clarify which findings can be retested, the time window, whether new regressions are in scope, what evidence is required, how many cycles are included, and what the final retest deliverable says. Where continuous testing is useful, compare it with a continuous penetration-testing model rather than assuming a subscription is automatically better.

Finally, match the engagement to language, on-site, regulatory, and commercial constraints. Procurement should document assumptions, exclusions, change-control rules, travel/on-site costs, report language, data-transfer terms, and whether the provider can satisfy any sector-specific tester or independence requirement.

Latvia cybersecurity requirements that may affect testing

Latvia's National Cyber Security Law entered into force on September 1, 2024 and implements NIS2 within Latvia for defined categories rather than every business in the country. Buyers should use the current consolidated law and competent-authority guidance to determine whether their entity and systems are covered.

Supervision sits with the National Cyber Security Centre (NCSC) at the Ministry of Defence, which is also the NIS2 single point of contact. Organisations that qualify as essential or important service providers had to notify the NCSC no later than 1 April 2025 using an electronically signed registration form. CERT.LV remains the national CSIRT that handles incidents, and the Constitution Protection Bureau supervises critical ICT infrastructure separately. Personal data that testers see falls under GDPR, supervised in Latvia by the Data State Inspectorate.

Latvia's Cabinet Regulation No. 397, Minimum Cyber Security Requirements, entered into force on July 2, 2025. In the consolidated text reviewed for this update, Clause 131 addresses penetration testing for Class A information systems, including testing before commissioning and at least once every three years during operation. That rule is system- and entity-specific; it is not a three-year pentest mandate for every Latvian company. Buyers should recheck the current Regulation No. 397 text before relying on clause numbers.

The reviewed text also contains tester qualification and independence conditions in Clause 132 for specified covered entities. Where those provisions apply, procurement should verify the assigned tester, not merely a company logo or generic certification page. Critical ICT infrastructure has additional conditions and competent-authority oversight, so ordinary external-testing requirements should not be generalized to that category.

NIS2 establishes cybersecurity risk-management and incident-reporting obligations for covered entities, but it does not create one universal named penetration-testing cadence for every organization. Use the NIS2 Directive together with Latvia's national implementation.

DORA applies to defined financial entities and their ICT risk framework. Threat-led penetration testing applies to selected entities under the DORA framework and delegated rules; an ordinary web or network pentest is not automatically equivalent to TLPT. Buyers in scope should review the DORA Regulation and the applicable TLPT rules with qualified counsel or the competent authority.

GDPR Article 32 is risk-based and refers to a process for regularly testing, assessing, and evaluating security measures where appropriate. It does not prescribe one universal penetration-test frequency. PCI DSS, ISO/IEC 27001, customer contracts, insurers, and sector rules may create additional assurance expectations, but each source should be applied according to its actual scope.

This article is procurement guidance, not legal advice. If applicability is uncertain, obtain qualified Latvian legal/compliance advice or confirmation from the competent authority before turning a regulatory summary into a testing requirement.

What affects penetration testing scope and cost in Latvia

There is no defensible single national price band for penetration testing in Latvia. Cost depends on the work actually authorized and the evidence expected from the provider.

The largest drivers usually include:

• number and type of applications, APIs, hosts, cloud accounts, or sites;
• architecture complexity and number of authenticated user roles;
• web, mobile, cloud, network, wireless, social-engineering, or OT/ICS scope;
• production versus non-production constraints;
• depth of manual testing and exploit validation;
• integrations and third-party dependencies;
• on-site work, travel, and language requirements;
• regulatory or contractual evidence requirements;
• report format and executive/technical deliverables;
• remediation workshops and retesting;
• urgency and fixed test windows; and
• whether the engagement is one-time, recurring, continuous, or threat-led.

Use a provider's current quote rather than a country-wide benchmark. DeepStrike's penetration-testing pricing page can be used to understand its own engagement terms, while a broader penetration-testing cost guide can help buyers identify common scoping variables. Neither should be treated as a Latvia market price index.

Buyer evidence checklist

Before signing a statement of work, request and verify:

• legal company name and contracting entity;
• statement of work tied to a current asset inventory;
• written authorization to test;
• exact scope, exclusions, and test window;
• assigned tester or team qualification profile;
• independence evidence where required;
• insurance evidence where required;
• data-processing, storage, transfer, retention, and deletion terms;
• testing methodology and asset-specific test cases;
• sanitized sample report where available;
• severity model and proof/evidence expectations;
• critical-finding escalation path;
• remediation support and communication workflow;
• retest scope, window, number of cycles, and final deliverable;
• limitations of any attestation or completion letter; and
• references or independent assurance where relevant.

For additional procurement checks, use a dedicated provider-selection framework and document the decision criteria before comparing proposals.

Frequently asked questions

How do I verify that a penetration testing company actually operates in Latvia?

Check the legal entity, registered address, contracting party, and staffed local presence from first-party or official records. A Latvia landing page or local keyword is not enough. Also confirm who will perform the work and whether delivery is local, on-site, or remote.

Does Latvia require penetration testing every three years?

Not for every company. The reviewed Cabinet Regulation No. 397 text includes an at-least-once-every-three-years requirement for Class A information systems within its defined scope. Determine whether the rule applies to your entity and system before adopting that cadence.

What qualifications may an external tester need under Latvia's minimum cybersecurity requirements?

The reviewed Regulation No. 397 text includes qualification and independence conditions for specified covered entities. The exact current clause, entity category, alternatives, and exceptions should be verified in the consolidated text. Procurement should validate the assigned tester's evidence, not assume the provider automatically qualifies.

Can a remote provider test a Latvian company's systems?

Yes, remote delivery can be technically workable when authorization, access, time zone, data handling, contracting, language, and any sector-specific tester requirements are satisfied. Remote availability does not prove local presence or local data residency.

How much does penetration testing cost in Latvia?

There is no reliable single Latvia-wide figure. Price depends on asset count, architecture, authenticated roles, test depth, cloud/mobile/network scope, production constraints, reporting, remediation, retesting, language/on-site needs, and urgency. Compare quotes using the same statement of work.

Is vulnerability scanning the same as penetration testing?

No. Scanning can identify potential weaknesses at scale, while a penetration test should involve human analysis and controlled validation within an authorized scope. Buyers should ask how automated findings are manually validated and how exploitability and business impact are demonstrated.

Do NIS2 or GDPR automatically require a penetration test?

No universal rule says every organization must perform the same penetration test on the same schedule. NIS2 and GDPR are scope- and risk-dependent. National law, sector rules, PCI DSS, contracts, or internal risk treatment may create more specific obligations.

Conclusion

Choosing a penetration testing company in Latvia is primarily an evidence problem. Confirm what the provider can test, what its relationship to Latvia actually is, who will perform the work, what rules apply to your environment, how data and production safety are handled, and what reporting and retesting you will receive.

DeepStrike should be considered alongside other qualified providers using the same procurement standard. If its delivery model fits your scope, request a technical scoping discussion and a proposal that names the assets, assumptions, testing approach, reporting, and retest terms.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.