Top Penetration Testing Companies in Norway 2026

Updated: November 2026. Company profiles, Norway relevance, regulatory notes, and the shortlist were rechecked against current public information. DeepStrike publishes this guide and is listed first; buyers should independently verify legal entity, tester assignment, on-site capability, accreditation, data handling, and contract terms before procurement.

Comparing providers beyond Norway? Our worldwide list of penetration testing companies covers firms that deliver testing across regions.

Executive Summary

• Intended buyer profile: Norwegian enterprises, regulated organizations, public bodies, cloud-first SaaS firms, and cross-border groups that need procurement-grade assurance and technically credible testing depth.
• Listed first: DeepStrike, the publisher of this guide
• Best Norway-based enterprise offensive provider: mnemonic
• Best local red-team and penetration-testing scale: Netsecurity
• Best for IT/OT and critical infrastructure: DNV Cyber
• Best for specialist manual security testing: Defendable
• Best for Norwegian healthcare and regulated enterprise: EY Norway
• Best for formal European assurance breadth: NCC Group
• Best Nordic specialist cloud/product security: Reversec
• Best nationwide enterprise coverage: Atea Norway
• Best for audit-linked cyber threat operations: PwC Norway
• Decision-framing insight: In Norway, the most useful discriminator is rarely “local versus foreign.” It is whether the provider can prove manual exploit validation, explain business impact clearly to audit and risk stakeholders, and operate credibly across cloud, identity, API, OT, and cross-border delivery constraints.

Quick Comparison: Top Penetration Testing Companies in Norway

Market Risk Context

The global average cost of a data breach reached USD 4.99 million in IBM’s 2026 study, and AI-enabled malicious breaches averaged about USD 6 million. Those figures are global, not Norway-specific, but they remain useful context for evaluating whether penetration testing reduces real exploitability rather than merely satisfying a procurement checkbox. See the IBM 2026 Cost of a Data Breach announcement.

For neighboring Nordic markets, see Finland and Iceland.

For Norwegian buyers, this sits inside a mature digital environment with rising security-management expectations. Datatilsynet states that privacy protection in Norway follows European rules through the EEA context, while the Norwegian National Security Authority publishes ICT security principles intended for both public and private organizations and explicitly notes their relevance in ICT procurement.

Norway Regulatory and Procurement Context

The legal position has also changed since the earlier version of this article. Norway’s Digitalsikkerhetsloven and related regulation entered into force on 1 October 2025, implementing the original NIS Directive for covered providers of essential and digital services. NIS2 has not yet replaced that framework in Norwegian law; NSM and the Norwegian government state that NIS2 is expected to be introduced later. See the Norwegian government announcement and NSM guidance.

For finance-sensitive environments, the picture is firmer. Norway's DORA act and regulation took effect on 1 July 2025 and, for many supervised firms, replaced the earlier ICT regulation. Finanstilsynet decides which entities must carry out threat-led penetration testing (TLPT) and how often, while Norges Bank acts as the TLPT cyber team that coordinates tests and issues the completion certificate (Finanstilsynet DORA page). TIBER-NO, drafted jointly by Norges Bank and Finanstilsynet, remains a practical threat-led testing framework for relevant financial institutions.

Procurement adds its own conditions. Public bodies buy under Norway's public procurement rules and advertise tenders on Doffin, and NSM's national-control guidance makes tester location and data processing location a procurement question. Systems covered by the Security Act (sikkerhetsloven) may need security-cleared personnel. Datatilsynet supervises GDPR, so agree where test evidence is stored and whether reports must be delivered in Norwegian.

Providers were selected and compared using the selection criteria below, and this guide does not accept paid inclusion. DeepStrike publishes this list and lists itself first; list order is not a quality ranking. Competitor profiles are based on publicly verifiable information, and buyers should conduct independent due diligence.

Definition

Penetration testing is a structured adversarial security assessment that combines automated vulnerability discovery with manual exploit validation to identify real-world attack paths, validate control effectiveness, and reduce breach probability.

Why Norwegian Buyers Evaluate Penetration Testing Providers Differently

Norwegian buyers often screen providers more cautiously because security decisions are tied to governance quality as much as to technical execution. NSM’s ICT Security Principles are positioned as broadly relevant across public and private organizations and specifically useful when procuring ICT services, which raises the bar for methodology transparency and defensible reporting.

In parallel, NSM’s guidance on national control for ICT services argues that critical services should be evaluated with attention to dependence, control, and risk, which makes delivery model, subcontracting, and cross-border execution more material in Norway than on many generic vendor lists.

The sector mix matters as well. Finance buyers can face TIBER-NO and DORA-related testing expectations where relevant. Public-sector and infrastructure-sensitive organizations tend to apply higher caution around supplier governance. Healthcare, energy, maritime, offshore, and industrial buyers often need reporting that translates technical flaws into operational and business consequences, not just CVE lists.

For cloud-native and API-heavy organizations, the key concern is whether the vendor can validate identity abuse, privilege escalation, business-logic flaws, and cloud control gaps instead of producing scan-heavy output.

How We Selected the Top Penetration Testing Companies in Norway in 2026

How we selected these providers: The candidate pool covered Norwegian security specialists, Norwegian IT and consulting groups with a testing team, Big Four practices with Oslo teams, and Nordic or global offensive-security firms that sell into Norway. For each, we reviewed the provider's own service, office, and certification pages, plus NSM's quality scheme and CREST material where a provider cited them, and recorded only what the provider states. Profiles reflect desk research checked in November 2026, not hands-on testing.

The selection criteria put validated exploitability above raw finding volume. Selection favored providers whose reviewed material evidenced manual testing depth, exploit chaining, realistic attacker simulation, cloud and API maturity, reporting clarity, remediation usefulness, and re-testing provisions. Scan-heavy models, vague methodology language, or unclear evidence handling are noted as limits in the profiles. The percentages in the table below are a suggested buyer weight for your own evaluation; they were not used to score or order the providers in this list.

The assessment also favored evidence of modern delivery relevance: application and API testing, cloud configuration and IAM testing, identity-heavy environments, red or purple team capability, OT where relevant, and the ability to support audit-heavy environments with clear documentation. Where public material evidenced certifications or formal schemes such as ISO 27001, NCSC CHECK, CREST, PCI QSA, or NSM-related quality schemes, that improved confidence in process maturity.

Where a capability was implied in marketing language but not directly evidenced, it was treated as unproven.

Norway fit was assessed separately from raw technical depth. A provider could show strong offensive skill yet be a weaker Norway fit if local operating conditions were unclear, sector relevance was weakly evidenced, or cross-border delivery questions would create procurement friction. Conversely, a Norway-visible provider did not gain credit simply by being present in the market if manual exploit validation was not clearly evidenced.

Provider-level assurance and individual credentials are treated separately. CREST company accreditation, ISO certifications, NSM schemes, PCI assessor status, and similar organizational assurance are not the same as practitioner credentials such as OSCP, OSWE, OSEP, CREST CRT/CCT, GIAC, CISSP, or CEH.

This methodology therefore favors providers that can support enterprise, regulated, cloud, hybrid, OT, and public-interest environments without assuming that size alone implies technical superiority.

How to Choose the Right Penetration Testing Company in Norway

• Define the attack surface and objective. Decide whether you need external infrastructure, internal networks, web applications, APIs, cloud, Active Directory/Entra, mobile, OT, social engineering, physical testing, red teaming, TIBER/TLPT, or a combined scope. Common engagement types include web application testing, mobile application testing, continuous penetration testing, and red teaming as a service.
• Separate scanning from penetration testing. Ask how much of the engagement is manual and how testers validate exploitability, authorization flaws, business logic, identity abuse, and chained attack paths.
• Review the assigned testers. Company size and accreditations matter, but the actual people performing the test matter more for technical depth.
• Confirm rules of engagement. Define authorization, test windows, production restrictions, excluded systems, emergency contacts, stop conditions, and data-handling requirements.
• Check cloud and identity depth. For modern environments, verify that cloud, IAM, Kubernetes, CI/CD, Microsoft 365, Entra ID, and API testing are distinct capabilities rather than generic infrastructure scans.
• Review a sample report. Findings should be usable by developers, risk owners, and auditors and should explain exploit paths, evidence, business impact, and remediation.
• Confirm critical-finding escalation. Severe issues should be communicated during the engagement rather than waiting for the final report.
• Verify retesting terms. Confirm whether remediation validation is included, time-limited, or separately charged.
• Check Norway-specific delivery conditions. For regulated, infrastructure, or public-sector environments, confirm national-control considerations, subcontracting, tester location, evidence storage, language, and cross-border handling.
• Compare outcomes, not dashboards or headline price. PTaaS platforms can improve workflow, but they do not replace human exploit validation; scope, tester seniority, evidence quality, and remediation support matter more.

Top Penetration Testing Companies in Norway 2026

1. DeepStrike: Application, cloud, and infrastructure testing

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Norway relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Norwegian clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. mnemonic: Oslo-headquartered security provider with an offensive team

Public offering: mnemonic states more than 20 years of security and penetration testing experience and says its team can assess any information system, whether cloud, on-premise, or a physical device, citing examples such as online banking, mobile apps, e-voting systems, and automated metering. Its offensive team draws on the company's security operations centre, threat intelligence analysts, and research team, and it also publishes a separate red teaming service.

Norway relevance: mnemonic lists its headquarters in Oslo and further Norwegian offices in Stavanger and Trondheim, alongside offices in Stockholm, Copenhagen, Utrecht, London, and Palo Alto. Its penetration testing page does not describe reporting or retesting; agree both in the proposal. Define tester locations, data handling, and any subcontracting in the agreement.

Official sources: https://www.mnemonic.io/solutions/penetration-testing/; https://www.mnemonic.io/contact/our-offices/

Buyer fit: Norwegian enterprises and public bodies that want testing from a local provider with SOC and threat intelligence capability in-house.

What sets it apart in Norway: an Oslo-headquartered provider with offices in Stavanger and Trondheim and its own SOC and threat intelligence team, so test findings can feed directly into monitoring.

3. Netsecurity: Nationwide Norwegian testing and incident response

Public offering: Netsecurity offers internal, physical, web application, and OT penetration tests plus phishing and social engineering simulations, and a separate red team service. Scope is agreed through a joint mapping before the offer, engagements are stated to run from 10 to 1,000 hours, and the report gives concrete findings and a prioritized action list structured for audits and regulator documentation. The page states more than 1,000 tests for more than 230 customers over more than 10 years.

Norway relevance: Netsecurity lists its headquarters at Drammensveien 288, Oslo, with offices in Kristiansand, Grimstad, Stavanger, Bergen, and Trondheim, and its incident response team is approved under NSM's quality scheme for incident handling. Retesting is not described on the penetration testing page. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: Netsecurity states that its incident response team is approved by the Norwegian National Security Authority (NSM) under its quality scheme for incident handling.

Official sources: https://www.netsecurity.no/tjenester/penetrasjonstesting; https://www.netsecurity.no/kontakt-oss

Buyer fit: Norwegian enterprises, public bodies, and critical infrastructure operators that want physical, OT, and digital testing alongside incident response.

What sets it apart in Norway: the widest Norwegian office network among the testing specialists here, from Kristiansand to Trondheim, plus an NSM-approved incident response team.

4. DNV Cyber: CREST-accredited IT and OT testing

Public offering: DNV Cyber states that it is accredited by CREST for its penetration testing services and applies that practice to identifying and mitigating vulnerabilities across IT and operational technology environments. Testing sits alongside governance, detection and response, and incident response services within DNV's cyber business.

Norway relevance: DNV Cyber's pages carry a DNV AS copyright notice but do not publish a Norway street address for the cyber practice; confirm the delivering team and entity. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: DNV Cyber states that it is accredited by CREST for its penetration testing services.

Official sources: https://www.dnv.com/cyber/about/we-are-crest-accredited/; https://www.dnv.com/cyber/about/contact/

Buyer fit: Energy, maritime, industrial, and critical infrastructure operators that need penetration testing across IT and OT.

What sets it apart in Norway: CREST-accredited testing from the DNV group with an IT and OT focus that fits Norway's energy, maritime, and industrial operators.

5. Defendable: Oslo specialist with a broad testing catalogue

Public offering: Defendable offers application testing (manual, OWASP Top 10-based), source code review, mobile app and device testing, cloud assessments for Azure, AWS, and Google Cloud, external and internal penetration tests, physical testing, phishing, red team exercises, TIBER exercises under TIBER-NO, OT testing, and continuous APT simulation. Reports give detailed explanations and remediation advice, and critical findings are notified during testing.

Norway relevance: Defendable lists its office at Munkedamsveien 45B, Oslo. Retesting is not described on its security testing page. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: Defendable lists tester certifications including OSCP, OSWE, OSEE, OSCE, OSED, OSEP, GXPN, CISSP, OPST, CRTO, CRTO2, and CEH, and displays ISO 27001 and the NSM quality scheme for incident handling.

Official sources: https://defendable.no/security-testing; https://defendable.no/contact

Buyer fit: Organisations that want specialist testing across applications, cloud, physical, red team, TIBER, or OT from an Oslo team.

What sets it apart in Norway: one of the broadest published catalogues among Oslo specialists, including TIBER and OT testing, with ISO 27001 and the NSM quality scheme displayed.

6. EY Norway: Nordic Security Center in Oslo

Public offering: EY Norway's Nordic Security Center delivers security and penetration testing, red team attack simulation, vulnerability assessments, purple teaming and detection, and SOC advisory. EY publishes a case study of external penetration testing of national e-health services for Norsk Helsenett, in which testing was combined with detection validation alongside the client's SOC.

Norway relevance: EY states that the ISO 27001-certified Nordic Security Center is located at its Oslo office and has more than 25 technical security experts. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: EY states that its Nordic Security Center is certified to ISO/IEC 27001:2022.

Official sources: https://www.ey.com/no_no/insights/cybersecurity/slik-kan-penetrasjonstesting-brukes-til-noe-mer-enn-bare-en-test; https://www.ey.com/no_no/services/cybersecurity

Buyer fit: Healthcare, finance, and other regulated enterprises that want testing tied to detection validation and wider assurance.

What sets it apart in Norway: an ISO 27001-certified Nordic Security Center in Oslo that pairs testing with purple teaming and detection validation.

7. NCC Group: Global technical assurance and attack simulation

Public offering: NCC Group's penetration testing services cover network testing, web and mobile application testing with source code review, cloud and container security, hardware and embedded testing, blockchain, cryptography, and AI/ML testing, plus red, purple, and black team attack simulation. It combines automated tools with manual testing, offers continuous penetration testing for web applications, APIs, and mobile apps, and delivers reports through its Cyber Services Portal.

Norway relevance: NCC Group's office list shows European offices in Belgium, Spain, and the Netherlands and no Norway office, so testing for Norwegian clients is cross-border. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: NCC Group's site displays CREST membership and NCSC CHECK penetration testing marks.

Official sources: https://www.nccgroup.com/penetration-testing-services/; https://www.nccgroup.com/our-office-locations/

Buyer fit: Multinational and regulated organisations that need repeat testing across many asset types or regions.

What sets it apart in Norway: a CREST and CHECK accredited global bench with no Norway office, suited to multinational programmes where cross-border delivery is acceptable.

8. Reversec: Nordic offensive-security consultancy

Public offering: Reversec's penetration testing service covers applications, networks, cloud infrastructure, and mobile platforms, plus specialist areas such as generative AI and LLM applications, mainframes, Kubernetes, and hardware. Engagements follow scoping, delivery, reporting, and feedback, reports include contextualized findings, risk ratings, and remediation guidance, and Reversec offers retesting to validate fixes.

Norway relevance: Reversec lists offices in Sweden, Finland, Denmark, the UK, the US, Singapore, and Italy, and no Norway office, so testing for Norwegian clients is cross-border. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: Reversec states that it holds CREST, CHECK, CBEST, and TIBER accreditation, and that its consultants hold certifications including CREST Registered Penetration Tester and CHECK Team Leader.

Official sources: https://reversec.com/services/penetration-testing/; https://reversec.com/contact-us/

Buyer fit: Enterprises and finance-sensitive organisations that want research-led offensive testing with formal accreditations and retesting.

What sets it apart in Norway: it states CREST, CHECK, CBEST, and TIBER accreditation, relevant to Norwegian financial entities that may be selected for DORA TLPT, delivered from Nordic offices outside Norway.

9. Atea Norway: In-house red team within a national IT provider

Public offering: Atea describes itself as Norway's largest IT company, with IT security among its service areas. Its own site describes an in-house penetration testing team (Atea Red Team) whose work ranges from vulnerability scanning and application security testing to simulated attacks, alongside cyber threat intelligence and an incident response team.

Norway relevance: Atea's pentest and incident response staff are described as working across Norway, including Oslo. Its penetration testing service page could not be retrieved for this review, so confirm scope, team, and retest terms directly. Define tester locations, data handling, and any subcontracting in the agreement.

Official sources: https://www.atea.no/; https://www.atea.no/siste-nytt/jobbe-i-atea/bli-kjent-med-stian/

Buyer fit: Norwegian public and private organisations that already work with Atea and want testing alongside wider IT and incident response services.

What sets it apart in Norway: an in-house red team inside what Atea describes as Norway's largest IT company, convenient for organisations that already buy infrastructure from Atea.

10. PwC Norway: Cyber Threat Operations and threat-led testing

Public offering: PwC Norway offers penetration testing, red teaming, purple teaming (detection exercises), TIBER/TLPT, and operational technology testing. Testing is intelligence-led using PwC Global Threat Intelligence, its red team uses in-house tooling including its own command-and-control framework, and TIBER/TLPT work follows threat intelligence, red team test plan, testing, and reporting phases.

Norway relevance: PwC's Cyber Threat Operations team, which delivers penetration testing, red teaming, threat intelligence, and incident response, is led from Oslo, and PwC states it meets NSM's quality scheme for incident handling. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: PwC states that it meets the requirements of NSM's quality scheme for incident handling.

Official sources: https://www.pwc.no/no/tjenester/risk-advisory-services/cyber-security/etisk-hacking.html; https://www.pwc.no/no/tjenester/risk-advisory-services/cyber-security.html

Buyer fit: Financial institutions and regulated enterprises that need TIBER/TLPT or red teaming tied to threat intelligence and wider assurance.

What sets it apart in Norway: an Oslo-led Cyber Threat Operations team that lists TIBER/TLPT and states it meets NSM's incident-handling quality scheme.

11. Truesec: Offensive security linked to incident response

Public offering: Truesec's penetration testing service runs from a scoping meeting through intelligence-led offensive assessments, a feedback session that walks the client through the report, and support implementing recommended improvements. Its offensive catalogue also lists red and purple team exercises, continuous red teaming, a threat impact assessment, and external exposure assessments, drawing on its incident response and threat intelligence work.

Norway relevance: Truesec lists offices in Sweden, Denmark, Finland, and Germany and no Norway office, so testing for Norwegian clients is cross-border. Define tester locations, data handling, and any subcontracting in the agreement.

Official sources: https://www.truesec.com/service/penetration-testing; https://www.truesec.com/contact

Buyer fit: Nordic organisations that want penetration testing and red teaming connected to incident response and wider cyber defence services.

What sets it apart in Norway: a Nordic provider whose testing is tied to incident response, delivered from Sweden, Denmark, Finland, or Germany rather than from Norway.

12. Telenor Cyberdefence: Assessment alongside SOC and incident response

Public offering: Telenor Cyberdefence describes itself as a cloud-native cyber security service provider for the Nordic market with a 24/7 SOC. Its assessment services include pentesting of applications, networks, and infrastructure, plus Microsoft 365, Azure, and Entra ID security assessments, and it assesses against frameworks such as ISO 27001, NSM's ICT security principles, NIST CSF, and NIS2.

Norway relevance: Telenor Cyberdefence lists its office at Snarøyveien 30, Fornebu. Pentest scope, methodology, and retest terms are not detailed on its assessment page. Define tester locations, data handling, and any subcontracting in the agreement.

Official sources: https://www.telenorcyberdefence.com/services/assessment/; https://www.telenorcyberdefence.com/contact/

Buyer fit: Norwegian organisations that want testing coordinated with Microsoft cloud assessments, SOC, and incident response.

What sets it apart in Norway: a Fornebu-based provider that coordinates assessments with a 24/7 SOC and Microsoft cloud reviews, a fit for Microsoft-centric Norwegian organisations.

13. Bouvet: Development-linked manual penetration testing

Public offering: Bouvet's cyber services include vulnerability testing reviewed by its specialists, penetration testing described as targeted, mostly manual attack simulation that looks for how weaknesses can be chained, and attack surface analysis of externally exposed assets. It provides a risk assessment of findings with concrete recommendations and can work directly with development teams.

Norway relevance: Bouvet lists 16 offices in Norway, including Bouvethuset at Sørkedalsveien 8 in Oslo, plus one in Stockholm. Define tester locations, data handling, and any subcontracting in the agreement.

Official sources: https://www.bouvet.no/cyber; https://www.bouvet.no/om-bouvet

Buyer fit: Norwegian product and application teams that want penetration testing connected to the developers who fix the findings.

What sets it apart in Norway: 16 Norwegian offices and a development consultancy model, so mostly manual tests can be followed by the same firm's developers fixing findings.

14. Sopra Steria Norway: Security services within a large IT consultancy

Public offering: Sopra Steria Norway's security work spans strategy, zero-trust architecture, continuous vulnerability management, and compliance advisory, and its security career page lists penetration testing, vulnerability assessments, OT/SCADA, identity and access management, incident response, and forensic analysis among the team's work. It has been part of NSM's quality scheme for incident handling since 2021, renewed in October 2026.

Norway relevance: Sopra Steria states it handles incidents for many critical Norwegian organisations. Its Norwegian site does not publish a dedicated penetration testing service page, so confirm scope, team, and methodology directly. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: Sopra Steria states it has been part of NSM's quality scheme for incident handling since 2021, most recently recertified in October 2026.

Official sources: https://www.soprasteria.no/dette-kan-vi/fagomrader/sikkerhetstjenester; https://www.soprasteria.no/bli-en-av-oss/ledigestillinger/en-sikker-karriere

Buyer fit: Large Norwegian enterprises and public bodies that want penetration testing inside a broader security and transformation programme.

What sets it apart in Norway: an NSM incident-handling quality scheme member since 2021 that handles incidents for critical Norwegian organisations; it has no dedicated pentest page, so confirm offensive scope.

15. Synja: Oslo provider for SMB and mid-market testing

Public offering: Synja lists APT simulation, web application testing, external vulnerability assessment, source code review, mobile and cloud testing, external, internal, and physical penetration tests, phishing and vishing exercises, red team exercises, TIBER exercises, and OT testing. Its external pentest covers OSINT asset mapping, manual and automated scanning, and exploitation within scope, with a report for management and technical staff, a management summary, and a prioritized remediation list referencing OWASP and PTES.

Norway relevance: Synja gives its location as Oslo without a street address, and offers follow-up testing after delivery rather than a fixed retest commitment. Define tester locations, data handling, and any subcontracting in the agreement.

Certifications: Synja lists team certifications including CISSP, ISO 27001 Lead Implementer, and CEH.

Official sources: https://synja.no/tjenester/ekstern-pentest/; https://synja.no/kontakt/

Buyer fit: Norwegian SMB and mid-market organisations that want a local provider for scoped testing and follow-up advisory.

What sets it apart in Norway: an Oslo provider that explicitly targets SMB and mid-market buyers, a segment most larger providers here do not single out.

16. River Security: Oslo continuous penetration testing and offensive security

Public offering: River Security's main service, Active Focus, combines attack surface management with continuous penetration testing, threat intelligence, and expert monitoring of internet-facing assets. Its site also lists point-in-time penetration testing, assumed-breach testing that places testers inside the network to test detection and containment, product security testing of hardware, mobile apps, web apps, and network protocols, AI testing, and incident response.

Norway relevance: River Security AS publishes its address at Fridtjof Nansens plass 4, Oslo (Norwegian org. no. 925178810) and also lists a Stockholm address. It also delivers security testing sold by partners such as Sicra, so confirm the contracting and delivering entities, tester locations, and data handling in the engagement agreement.

Official sources: https://riversecurity.eu/active-focus/; https://riversecurity.eu/penetration-testing/; https://riversecurity.eu/contact/

Buyer fit: Norwegian organisations that want continuous testing of their external attack surface, with point-in-time, assumed-breach, or product tests added as needed.

What sets it apart in Norway: continuous testing of the external attack surface through Active Focus, rather than only annual point-in-time tests.

Comparison Table

What Buyers in Norway Get Wrong When Comparing Penetration Testing Firms

The most common error is equating brand size with better offensive depth. Large firms may bring more governance processes, but that does not guarantee deeper application, cloud, or identity testing. The second error is treating vulnerability scanning, PTaaS dashboards, and a real pentest as interchangeable. Dashboards can improve workflow, but they do not replace human exploit validation. The third error is ignoring the report itself.

In audit-heavy or regulated environments, the real buying outcome is not just a set of findings. It is whether engineering teams can remediate efficiently and whether risk owners can defend decisions later.

A separate Norway-specific mistake is assuming visible local presence automatically solves public-sector, regulated-sector, or technical fit. It may help with procurement comfort, but buyers still need to verify named technical staff, cloud and API maturity, retesting rules, and delivery governance for cross-border execution.

Enterprise vs SMB: Which Type of Penetration Testing Company Do You Need in Norway?

Large enterprises usually need one of two models. The first is a broad provider that can align testing to multiple stakeholders, formal assurance programs, and cross-border operating structures. The second is a specialist offensive firm that can focus on cloud, identity, API, application or OT attack paths without the delivery overhead of a larger consultancy. The right answer depends on whether the organization’s bottleneck is technical depth or governance coordination.

SMBs generally benefit less from full red-team theater and more from sharply scoped manual testing against internet-facing applications, APIs, cloud IAM, Microsoft 365, identity controls and remote access. In Norway, a local provider may be useful where change management, language, or in-person alignment matter. Cross-border execution is often entirely acceptable when the real need is specialist depth, clear reporting, and rapid retesting.

The key is to avoid paying for organizational scale when the real requirement is exploit accuracy.

What Influences Penetration Testing Cost in Norway?

No credible public source reviewed here supports a reliable Norway-wide price benchmark, so the buying decision should be framed through cost drivers rather than notional market averages.

The major drivers are scope size, target type, and delivery depth. Application and API work usually costs more than simple perimeter validation because business logic, auth flows, and chained paths require more manual time. Cloud testing complexity rises when IAM, Kubernetes, CI/CD, serverless, or multi-cloud are in scope.

Costs also change materially when buyers need retesting, attestation letters, technical readouts, custom reporting formats, TIBER/TLPT, OT safety controls, physical/social engineering, or cross-team coordination for enterprise assurance.

Onsite work, third-party integrations, and continuous testing models can also raise or reshape total spend.

FAQs

How much do penetration testing services cost in Norway?

There is no high-confidence public benchmark in the reviewed material for Norway specifically. In practice, cost is driven by scope, cloud/API complexity, manual depth, OT or physical requirements, retesting terms, reporting requirements, and delivery model.

What is included in enterprise penetration testing?

At enterprise level, buyers should expect more than scanning: scoped adversarial testing, exploit validation, prioritized findings, remediation guidance, and stakeholder-ready reporting. Higher-maturity providers may also offer red or purple team options, cloud and identity testing, OT testing, TIBER/TLPT and formal attestation artifacts.

Are certifications more important than tools?

No. Certifications and formal schemes help establish process quality and assessor credibility, but tools do not replace manual reasoning. The more procurement-critical question is whether the provider can validate exploit paths and communicate remediation clearly.

How long does a pentest engagement take?

It depends on scope. Focused application or infrastructure assessments may take several days to a few weeks, while advanced threat-led exercises can run across multiple weeks. TIBER/TLPT programs require substantially more coordination than a standard application pentest.

Is penetration testing required under GDPR, the Digitalsikkerhetsloven, NIS2, or DORA?

Not universally for every Norwegian organization. GDPR creates security obligations. Norway’s Digitalsikkerhetsloven, which entered into force on 1 October 2025, implements the original NIS Directive for covered organizations; NIS2 is expected to be introduced in Norwegian law later. DORA creates more explicit testing obligations for financial entities, including TLPT for certain critical functions. Applicability depends on sector, legal scope, risk and operating model.

Should Norwegian buyers choose a local provider or a cross-border specialist?

Choose local when onsite coordination, Norwegian-language communication, domestic governance familiarity, national-control concerns, OT/physical work or regulated procurement are material. Choose cross-border when the bigger requirement is specialist cloud, API, identity, product or threat-led offensive depth and those operational conditions can be controlled contractually.

Bottom Line

A credible shortlist for Norway should not be built around generic brand recognition. It should be built around evidence: manual testing depth, exploit-chaining realism, cloud and API maturity, identity and OT capability where relevant, reporting quality, retesting terms, and delivery conditions that fit Norwegian governance and cross-border operating realities.

The expanded 2026 market is materially stronger than the original six-company shortlist suggested. Norway-based providers such as mnemonic, Netsecurity, DNV Cyber, Defendable, EY Norway, Atea, PwC, Telenor Cyberdefence, Bouvet, Sopra Steria, Synja and River Security give buyers a much deeper local pool than the earlier version showed, while Reversec, NCC Group and Truesec remain legitimate Nordic/European cross-border options.

DeepStrike, the publisher of this guide, is listed first for organizations prioritizing human-led application, cloud, and infrastructure testing with direct remediation collaboration. Norwegian buyers with strict local-delivery, OT, public-sector, TIBER/TLPT or national-control requirements may reasonably prefer one of the strong Norway-based providers above.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in finance, healthcare, technology and other high-risk sectors.

Technical Review: DeepStrike Offensive Security Team