Top Penetration Testing Companies in Luxembourg 2026

• Intended Buyer Profile: CISO/Risk teams and procurement in finance, government, telecom, and energy sectors seeking high-assurance pentesting.
• Listed first: DeepStrike, the publisher of this guide, for human-led application, cloud, and infrastructure testing with reproduction evidence, remediation guidance, and retesting.
• Best for Enterprise: PwC Luxembourg, Deloitte Luxembourg, or Thales Cyber Solutions Luxembourg, which combine local teams with broader advisory, compliance, or SOC services.
• Best for SMBs/SMEs: itrust consulting, a small local team offering a fixed-price external scan for SMEs alongside scoped penetration tests.
• Best for Compliance-Heavy Orgs: Linosec for DORA TLPT and SWIFT CSP assessments, or Thales Cyber Solutions Luxembourg, whose Luxembourg entity holds a PSF agreement.
• Cloud-First Environments: DeepStrike (listed first; publisher of this guide) and Deloitte Luxembourg, both of which publish cloud and API testing services.
• Decision Insight: Procurement should prioritize vendors with proven manual testing capability and clear reporting over scan-only tools. Look for recognized tester credentials (such as CREST or OSCP) and confirm that the delivery model, tester locations and data handling meet your regulatory obligations, such as DORA TLPT tester requirements and CSSF outsourcing rules.

Market Risk Context

In 2026, the global average cost of a data breach reached a record $4.99 million (IBM Cost of a Data Breach Report 2026). In Luxembourg that exposure is concentrated in finance: the CSSF's October 2026 financial-centre figures count 118 banks, 2,826 investment funds with EUR 6,790.70 billion in net assets, 56 support PFS (the IT and outsourcing providers the CSSF supervises), and about 52,000 people working for CSSF-supervised entities in Luxembourg. Banks, fund managers and insurers fall under DORA, so weak testing can turn into a supervisory finding as well as a breach. This guide compares providers on the services and methodology they document publicly; DeepStrike, the publisher, is listed first (see the disclosure below).

Comparing providers beyond Luxembourg? Our global list of top penetration testing companies covers firms that deliver testing across regions. Buyers who also operate in Belgium can compare penetration testing companies in Belgium, including TIBER-BE and NIS2 context.

Disclosure: DeepStrike publishes this list and lists itself first; list order is not a quality ranking. DeepStrike is a penetration testing provider, so weigh our entry the way you would any vendor's description of its own service, and compare scope, sample reports and references for every provider before you buy.

How We Selected the Top Penetration Testing Companies in Luxembourg in 2026

Our evaluation prioritized proven technical depth and evidence over brand alone. We assessed each provider’s published team certifications (e.g. OSCP, OSWE, CISSP, CREST). A premium was placed on manual exploit chaining and red-team sophistication: vendors that use human-led techniques to exploit complex attack paths were weighted more favorably in our selection than those relying mainly on automated scanning. We examined case studies and service descriptions for cloud and API testing maturity – essential for modern infrastructures. Reporting quality was judged by clarity of findings and remediation guidance. Inclusion of retesting and compliance mapping was considered where it was clearly evidenced in published service descriptions. We also considered industry fit (e.g. finance vs telecom vs industrial) and regional delivery feasibility, including local delivery capability versus cross-border execution. Overall, our methodology favors vendors who deliver validated exploit scenarios with actionable output, rather than those offering mostly surface-level vulnerability scans. We did not score providers: DeepStrike publishes this list and lists itself first, and the order of the entries below is not a quality ranking.

How this Luxembourg list was built: we started from providers that publish a Luxembourg office, a Luxembourg legal entity or a Luxembourg service page, and kept those whose own sites describe manual penetration testing; DeepStrike is included as the publisher. For each provider we read its official service and contact pages, checked support PSF status in the CSSF entity register, and compared its published services with Luxembourg drivers such as DORA and TIBER-LU, SWIFT CSP and NIS2. Checks were last run on 3 November 2026. This is desk research of public information, not hands-on testing of each provider.

Luxembourg Regulatory and Procurement Context

Luxembourg transposed NIS2 late: the Act of 5 May 2026 on measures to ensure a high level of cybersecurity came into force on 10 May 2026, according to the Institut Luxembourgeois de Régulation (ILR). The ILR is the competent authority for the large majority of NIS2 sectors. In-scope entities had to self-register with it by 10 July 2026 and must send a preliminary notification of significant incidents within 24 hours, and management bodies must approve and oversee risk-management measures (ILR press release, 6 July 2026). NIS2 asks for ways to assess whether those measures work rather than naming a test type, so a penetration test is evidence, not a box to tick.

Financial entities follow DORA instead. Luxembourg's DORA law of 1 July 2024 names the CSSF and the Commissariat aux Assurances (CAA) as the authorities applying DORA, which has applied since 17 January 2025 (CSSF). Threat-led tests run through TIBER-LU, launched jointly by the CSSF and the Banque centrale du Luxembourg (BCL) on 3 November 2021 and revised in an implementation document dated 20 June 2025 to align with DORA TLPT and the revised TIBER-EU framework (BCL). Since April 2025, ICT outsourcing by DORA entities is governed by DORA and CSSF Circular 25/882, while Circular 22/806 still covers ICT outsourcing by non-DORA entities (CSSF circular update).

In this guide, penetration testing means manual, exploit-validated testing of applications, networks or cloud environments. It is distinct from automated vulnerability scanning and from the intelligence-led red-team tests that TIBER-LU and DORA TLPT govern, so state in the tender which of the three you are buying.

Banks and other financial-sector clients often ask whether a provider that will see confidential data holds support PSF status, which the CSSF entity register shows; in this list, the register lists Thales Cyber Solutions Luxembourg. Incident coordination sits with CIRCL, the CERT for the private sector, communes and non-governmental entities, and with GOVCERT.LU for public bodies. We found no Luxembourg-specific accreditation scheme for penetration testing providers, so buyers usually rely on tester credentials, TIBER-EU procurement guidance and contract terms.

How to Choose the Right Penetration Testing Company in Luxembourg

In Luxembourg, start from the regime you report under. CSSF-supervised financial entities should check DORA TLPT and TIBER-LU experience, and support PSF status where testers will handle confidential data; NIS2 entities supervised by the ILR need evidence that their controls work. Then compare manual testing depth, tester credentials, sample reports and retest terms.

When selecting a vendor, beware of common pitfalls. Don’t mistake tool-driven scans for thorough penetration testing – automated results should be augmented by expert analysis. Confirm the scope is sufficiently broad (external/internal networks, all critical apps, cloud assets, APIs) and that business-logic flaws will be tested. Avoid under-scoping (e.g. ignoring mobile or IoT if in use). Insist on a final retest to ensure remediated issues are fixed. Ensure the team includes senior testers (OSCP, CEH, CISSP, or CREST-certified) rather than only juniors. Watch for over-reliance on proprietary platforms – a reputable provider will use proven tools but not be beholden to them. Verify that testing covers your regulatory requirements (for example, DORA, PCI DSS, or ISO 27001) rather than being a generic checklist. Consider whether local presence is important: on-site teams can facilitate network access and reduce latency, but remote/global firms may offer broader expertise. Balancing automation with hands-on expertise is key.

Top Penetration Testing Companies in Luxembourg (2026)

1. DeepStrike: Human-led testing with remediation collaboration

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Luxembourg relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Luxembourg clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. PwC Luxembourg: Penetration testing and red teaming within a Big Four practice

Public offering: PwC Luxembourg's Cybersecurity and Privacy practice lists penetration tests, red and purple teaming, security architecture, cloud security, third-party security assessment, and security awareness services. Its penetration tests cover attacks from the internal network, attacks from the internet against exposed infrastructure or employees (including phishing), and attacks on mobile devices and applications, or tailored combinations of these. Red team exercises simulate advanced attacks on predefined targets, including physical intrusion and social engineering, followed by workshops with incident response and monitoring teams.

Luxembourg relevance: PwC Luxembourg runs a local Cybersecurity and Privacy practice; the ethical hackers profiled on its 2026 Cybersecurity & Privacy Day speaker page describe penetration testing and adversary simulation for private companies, banks, European institutions, and public-sector entities. The pages reviewed do not state a company-level penetration testing accreditation; confirm the assigned team, tester locations, permitted subcontracting, and data handling in the engagement agreement.

Official sources: https://www.pwc.lu/en/advisory/digital-tech-impact/cyber-security/implementation-and-operations.html; https://www.pwc.lu/en/advisory/digital-tech-impact/cyber-security/cybersecurityday/speakers.html

Buyer fit: Large regulated organisations that want penetration testing and red teaming alongside broader cybersecurity advisory from a Big Four firm.

In the Luxembourg market: PwC Luxembourg combines its local ethical hacking team with red and purple teaming inside a Big Four advisory practice, which suits large regulated groups that want testing and remediation advice from one locally staffed firm. What to confirm: PwC's service page (checked 3 November 2026) does not describe TIBER-LU or DORA TLPT engagements, so ask for comparable threat-led references, and check auditor-independence rules if PwC audits your group.

3. Deloitte Luxembourg: Broad testing catalogue with vulnerability management

Public offering: Deloitte Luxembourg's vulnerability management services list web application and API, infrastructure (including Active Directory, VDI, VPN, and SWIFT networks), mobile, thick client, wireless, host-based, and IP telephony penetration testing, together with cloud security assessments for Azure, AWS, and Google Cloud. Adjacent services include vulnerability assessment and tooling support, secure code review, configuration review against CIS and NIST baselines, and red team attack simulation with phishing and social engineering.

Luxembourg relevance: Deloitte publishes these services on its Luxembourg website and names a Luxembourg partner as the contact for advisory and consulting. The page does not state a company-level testing accreditation; confirm the assigned team, tester locations, permitted subcontracting, and data handling in the engagement agreement.

Official sources: https://www.deloitte.com/lu/en/services/consulting-risk/services/vulnerability-management.html; https://www.deloitte.com/lu/en/contact/contact-us.html

Buyer fit: Large organisations that want a wide testing catalogue, including SWIFT network, thick client, and IP telephony testing, combined with vulnerability management support.

In the Luxembourg market: Deloitte Luxembourg also publishes a separate TIBER-LU service covering readiness support, TIBER-EU-compliant targeted threat intelligence, red teaming and mock TIBER-LU exercises run ahead of a mandated test, and its vulnerability management page references the EBA guidelines on ICT and security risk management. What to confirm: which TIBER-LU or TLPT role Deloitte would take in your engagement, and auditor-independence rules if Deloitte audits your organization.

4. Thales Cyber Solutions Luxembourg (formerly Excellium): Testing alongside a local SOC

Public offering: Thales Cyber Solutions Luxembourg, formerly Excellium Services, describes local consultancy teams, intrusion and application security testing, and a 24/7 Security Operations Centre in Luxembourg.

Luxembourg relevance: Thales says it acquired Excellium Services in 2022 and now employs over 250 people across two sites in Luxembourg, with local consultancy teams and a 24/7 Security Operations Centre (Thales Luxembourg page, checked 3 November 2026). The CSSF register lists Thales Cyber Solutions Luxembourg S.A. as a support PSF (IT systems and communication network operator for the financial sector) since July 2021. Confirm the delivering entity, tester locations, permitted subcontracting, and data handling in the agreement.

Official sources: https://www.thalesgroup.com/en/worldwide/luxembourg

Buyer fit: Regulated Luxembourg organisations that want penetration testing from a provider that also runs local SOC, incident response, and consulting services.

In the Luxembourg market: Thales Cyber Solutions Luxembourg is the former Excellium, and the CSSF entity register lists it as a support PSF, which matters to banks and other financial-sector clients that share confidential data with IT service providers. What to confirm: whether the Luxembourg entity or another Thales unit delivers the testing, and how test findings stay independent of any SOC service the same group runs for you.

5. itrust consulting: Local SME for audits and technical testing

Public offering: itrust consulting offers vulnerability assessments and penetration tests carried out onsite or remotely, with a detailed report covering strengths, weaknesses, and countermeasures. Its published areas of expertise include website testing using the OWASP framework, internal infrastructure, wireless networks, social engineering, reverse engineering, exploit development, mobile device testing, and SCADA systems for essential service providers. It also offers a fixed-price external vulnerability scan for SMEs and organisational audits against ISO 2700x, IEC 62443, PSF, CSSF, and CNPD requirements.

Luxembourg relevance: itrust consulting is a Luxembourg SME founded in 2007 whose local team performs the testing; it also runs the malware.lu CERT. Confirm the assigned testers, permitted subcontracting, and data handling in the engagement agreement.

Certifications: itrust consulting states it holds ISO/IEC 27001 and ISO/IEC 27701 certification, issued by Certi-Trust.

Official sources: https://www.itrust.lu/services/hacking/; https://www.itrust.lu/contact/

Buyer fit: Luxembourg SMEs, operators of essential services, and public bodies that want a small local team covering web, infrastructure, wireless, SCADA, and social engineering testing.

In the Luxembourg market: itrust consulting pairs technical testing with organizational audits and lists PSF, CSSF and CNPD requirements among its audit reference frameworks, which helps smaller regulated firms that want one local team for testing and compliance review. What to confirm: its hacking page does not mention DORA, TIBER-LU or NIS2, so ask how findings will be mapped to the regime you report under.

6. Linosec: DORA TLPT and SWIFT CSP specialist

Public offering: Linosec (Luxembourg Innovative Security) positions itself as a threat-led penetration testing specialist for financial institutions and enterprises, with TLPT services designed around DORA threat-led penetration testing requirements. It also lists penetration testing of web and mobile applications, network infrastructure, and cloud environments, plus SWIFT CSP assessments, incident response, security architecture review, security training and phishing simulations, and SIEM design.

Luxembourg relevance: Linosec publishes an address at 96 Avenue Gaston Diderich, L-1420 Luxembourg, and states it was founded in 2017. Confirm team size, tester locations, permitted subcontracting, and data handling in the engagement agreement.

Certifications: Linosec states that team members hold OSCP, CISSP, and ISO 27001 credentials.

Official sources: https://www.linosec.lu/

Buyer fit: Financial entities that need DORA TLPT or SWIFT CSP assessments from a Luxembourg-based specialist.

In the Luxembourg market: Linosec is a Luxembourg City firm founded in 2017 that leads with DORA TLPT and annual SWIFT CSP assessments, a direct match for CSSF-supervised financial entities. What to confirm: its homepage does not mention TIBER-LU, so ask for references from threat-led tests and how threat intelligence and red team roles are staffed under the DORA TLPT rules.

7. Swiss Post Cybersecurity (formerly Hacknowledge): Offensive security with a Luxembourg office

Public offering: Swiss Post Cybersecurity's offensive security solutions include penetration tests of web applications, internal and external networks, cloud environments, OT systems, and mobile applications, together with phishing and vishing tests, physical intrusion tests, assume-breach simulations, red teaming, and code and configuration review. It states that reports include clear, actionable recommendations for closing security gaps.

Luxembourg relevance: Swiss Post Cybersecurity lists a Luxembourg office at 9 Rue du Laboratoire, 1911 Luxembourg; the former Hacknowledge website now redirects to Swiss Post Cybersecurity. Confirm the contracting entity, tester locations, permitted subcontracting, and data handling in the engagement agreement.

Official sources: https://www.swisspost-cybersecurity.ch/solutions-offensive-security; https://www.swisspost-cybersecurity.ch/contact

Buyer fit: Organisations that want application, cloud, OT, and social engineering testing, up to red teaming and assume-breach simulations, from one provider with a Luxembourg office.

In the Luxembourg market: Swiss Post Cybersecurity serves Luxembourg from its office at 9 Rue du Laboratoire, with headquarters in Aarau, Switzerland, and offers OT, physical intrusion and vishing tests that need people on site. What to confirm: which entity signs the contract and where testers, test data and reports will be located, particularly if CSSF outsourcing rules apply to you.

Comparison Table

Enterprise vs SMB — Which Type of Penetration Testing Company Do You Need in Luxembourg?

Large banks, insurers and operators usually need a provider with capacity for multi-phase or threat-led tests, such as PwC Luxembourg, Deloitte Luxembourg or Thales Cyber Solutions Luxembourg. Smaller organizations often get better value from a local specialist such as itrust consulting, while Linosec suits financial-sector buyers with DORA TLPT or SWIFT CSP requirements.

Larger organizations typically favor providers that combine depth, reporting maturity, and regulatory alignment. In this list, PwC Luxembourg, Deloitte Luxembourg, and Thales Cyber Solutions Luxembourg are the strongest fit for complex enterprise environments because they combine a broader delivery scale with formal governance and compliance-oriented reporting.

Smaller or mid-sized organizations usually need tighter scope control, faster execution, and lower coordination overhead. In that context, itrust consulting is often a more practical fit, while Linosec is more suitable for finance-heavy organizations with DORA- or SWIFT-driven requirements.

Buyers should weigh manual depth against operational efficiency. DeepStrike suits organizations that want human-led application, cloud, and infrastructure testing with direct remediation collaboration, while Swiss Post Cybersecurity fits requirements that extend toward red-team style simulation and broader defensive integration. Cross-border delivery can work well for application, cloud, and API testing, but local presence may still matter for regulated, physical, or infrastructure-heavy scopes.

What Influences Penetration Testing Cost in Luxembourg?

Cost is mainly shaped by scope size, asset complexity, testing depth, authentication level, API and cloud exposure, reporting requirements, retesting expectations, compliance evidence needs, and whether delivery is remote or on-site. Manual exploit-led engagements usually cost more than scan-led assessments because they require deeper validation, broader analyst time, and more detailed reporting. Cloud, API, and regulated-scope testing also tend to increase effort because they expand scenario coverage and documentation requirements. Where precise local pricing is not consistently evidenced, buyers should focus on quote structure, scope assumptions, retesting terms, and deliverable quality rather than headline figures.

FAQs

• How much do penetration testing services cost in Luxembourg?

Pricing depends mainly on scope size, testing depth, asset complexity, authentication level, cloud and API exposure, reporting expectations, and retesting requirements. Because precise local pricing is not consistently evidenced across providers, buyers should request a scoped quote with clear assumptions, deliverables, and retesting terms rather than rely on generic market ranges.

• What is included in an enterprise penetration test?

A typical enterprise pentest covers both external and internal attack surfaces (PCI DSS requires both for in-scope environments), including networks, servers, web and mobile apps, and possibly wireless infrastructure. It involves vulnerability scanning and exploitation of key issues to demonstrate impact. Deliverables usually include an executive summary plus a detailed technical report with prioritized findings and remediation advice. Red-team engagements may add social engineering or physical intrusion tests as needed.

• Are certifications (CREST, OSCP) more important than tools?

Both matter, but certifications signal proven skill. In manual vs automated penetration testing, tools (e.g. Nessus, Burp, Metasploit) can quickly find surface flaws, but only skilled testers (with credentials like OSCP, OSWE, CISSP or CREST accreditation) can reliably exploit chains of vulnerabilities. Industry guidance emphasizes using qualified testers. In procurement, insist on seeing tester credentials or lab accreditation. A certified tester armed with basic tools will usually outperform an uncertified user of fancy tools.

• How long does a typical pentest engagement take?

Durations range from a few days to several weeks. A simple web app test might take 1–2 weeks total, while a large infrastructure assessment (hundreds of hosts, multiple apps) could take 4–6 weeks including planning and reporting. Regulated firms often align tests to an annual cycle. PCI DSS, for instance, expects internal and external tests at least annually. The complexity of the environment and availability of the vendor team are the main factors.

• Is penetration testing required for ISO 27001 and PCI DSS, DORA, or NIS2?

Requirements vary. PCI DSS explicitly mandates both internal and external penetration tests at least annually (Requirement 11.4). ISO 27001 does not mandate pentesting, but under a risk-based approach it is commonly expected where risk justifies it (certifiers expect testing when justified by risk). DORA has applied to EU financial entities since January 2025 and requires threat-led penetration testing (TLPT) at least every three years for entities designated by their competent authorities. NIS2 is a risk-management directive; it doesn’t specifically call out pentests, but it requires policies to assess the effectiveness of cybersecurity measures, which many entities meet with periodic testing. In practice, many organizations test yearly or after major changes to stay compliant.

• How often should penetration testing be performed?

Best practice is at least annually, and after significant system changes. For example, PCI DSS requires retests after any major infrastructure change. Some sectors (finance, energy) do tests semi-annually. Cloud environments or agile development may warrant more frequent scanning (quarterly). Always align test frequency to your risk level and regulatory guidance.

• Should we choose a local Luxembourg provider or an international firm?

Both have merits. Local providers (such as itrust consulting and Linosec) offer in-country knowledge, language support, and easier on-site access (useful for social engineering and physical tests). They often understand local regulations and threat context. Large international firms (such as PwC and Deloitte, both with Luxembourg practices) bring broader resources and threat intelligence but may involve longer procurement cycles. Cross-border delivery is common for pure network and application tests. Key considerations: data protection (ensure sensitive data stays in the EU), travel costs, and regional compliance nuances. In many cases, a hybrid approach (local partner coordinating global experts) works best.

For Luxembourg buyers, the shortlist usually narrows on regulation first: CSSF-supervised entities weigh DORA TLPT and TIBER-LU experience and support PSF status, NIS2 entities registered with the ILR need test evidence that their risk-management measures work, and smaller organizations often prefer a local specialist that can work on site. Whichever provider you choose, ask for a sample report, retest terms, named testers and a clear statement of where testing and data handling take place.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.