Top Penetration Testing Companies in Portugal 2026

Portugal’s cybersecurity market is expanding under NIS2, DORA, GDPR, cloud adoption, and a fast-growing technology sector. This guide describes penetration testing providers serving Portuguese organisations, based on their official public information.

Comparing providers beyond Portugal? Our global list of top penetration testing companies covers firms that deliver testing across regions.

For other Southern European markets, see Malta and Cyprus.

Updated: November 2026. DeepStrike publishes this list and lists itself first; list order is not a quality ranking. Competitor profiles are based on publicly verifiable information, and buyers should independently confirm the legal entity, assigned testers, onsite capability, accreditation, data handling, retesting, and commercial terms before procurement.

Executive Summary

• Market context: Portugal’s digital economy and regulatory changes continue to increase demand for professional penetration testing and compliance validation.
• Listed first: DeepStrike, the publisher of this guide, for human-led application, cloud, and infrastructure testing with reproduction evidence and remediation guidance.
• Strong Portugal-based specialists: Devoteam Cyber Trust, Claranet Portugal, VisionWare, Ethiack, and PwC Portugal.
• Enterprise-scale options: Thales/S21sec and Deloitte Portugal add broader governance, critical-infrastructure, and cyber-resilience capability.
• Developer tooling: Probely remains highly relevant for automated web/API security testing, but it should be treated as an AppSec platform rather than a substitute for a full manual pentest.
• Regulatory update: Portugal completed NIS2 transposition through Decree-Law No. 125/2025, with the new Cybersecurity Legal Regime entering into force on 3 April 2026. The implementation regulation, Regulation No. 756/2026, was published on 22 June 2026.
• Risk context: IBM’s 2026 Cost of a Data Breach Report puts the global average breach cost at $4.99 million. This is a global benchmark, not a Portugal-specific average.
• Key takeaway: The best provider is not always the largest or most local. Buyers should compare manual testing depth, exploit validation, cloud/API coverage, reporting quality, retesting, and procurement fit.

Quick Comparison: Top Penetration Testing Companies in Portugal

What Is Penetration Testing?

Penetration testing (pentesting) is an authorized, simulated cyberattack on a system, network, application, API, cloud environment, mobile app, or other defined scope to find security weaknesses before real attackers do.

Unlike basic vulnerability scans, penetration tests involve skilled ethical hackers using the same types of techniques attackers use to determine whether weaknesses can actually be exploited and what business impact could follow.

For Portuguese businesses, pentesting also supports security governance and compliance evidence. GDPR requires appropriate technical and organizational measures but does not create one universal annual pentest mandate. Portugal’s NIS2 framework now operates through Decree-Law No. 125/2025, which entered into force on 3 April 2026, while DORA imposes digital operational resilience testing requirements on in-scope financial entities.

Why Penetration Testing Matters

Cyberattacks continue to rise in Portugal and across Europe. The CNCS Riscos & Conflitos 2025 report (6th edition, September 2025) found that incidents registered by CERT.PT rose 36% in 2024 to 2,758, in a year marked by phishing and smishing, vulnerability exploitation, DDoS, large credential leaks and high-impact ransomware.

Portugal’s new Cybersecurity Legal Regime transposes NIS2 and applies to essential, important, and relevant public entities across 17 sectors and public administration. The implementing regulation published in June 2026 gives the framework more operational detail.

In finance, DORA requires a risk-based digital operational resilience testing program. Certain financial entities must conduct advanced threat-led penetration testing at least every three years, while all in-scope financial entities face broader testing requirements proportionate to risk.

In short, a solid penetration test helps Portuguese companies find hidden vulnerabilities, strengthen defenses before attackers exploit them, and produce clearer evidence for management, auditors, customers, and regulators.

Pentests often reveal not just technical bugs such as SQL injection or SSRF but also authorization failures, identity attack paths, weak segmentation, cloud misconfiguration, detection gaps, and business-logic flaws. Skilled testers report not only what is wrong but also how to fix it.

Portugal regulatory and procurement context

Who supervises what (checked 3 November 2026): The Centro Nacional de Cibersegurança (CNCS) is the main competent authority under Decree-Law No. 125/2025, and CERT.PT, which the CNCS operates, is the national CSIRT. The CNCS's Regulation No. 756/2026, published on 22 June 2026, sets how entities register, self-identify, and notify incidents through its MyCiber electronic platform. The CNCS also publishes a national cybersecurity reference framework (QNRCS) that organisations can use to structure their controls.

Financial and classified work: DORA has applied since 17 January 2025, and financial entities answer to their sectoral supervisor: the Banco de Portugal, the insurance supervisor ASF, or the securities regulator CMVM. Projects that involve classified information can require National Security Office (GNS) accreditation, which is why some Portuguese providers publish it.

Data and language: Personal data captured during testing falls under the GDPR and Portugal's data protection authority, the CNPD. Public-sector and regulated buyers may require Portuguese-language reports and domestic or EU storage of test evidence, so state both in the request for proposal.

How We Selected the Top Penetration Testing Companies in Portugal

These are suggested buyer weights for your own evaluation; providers in this guide were not scored against them. DeepStrike publishes this list and lists itself first; list order is not a quality ranking.

Provider-level assurance and individual credentials are treated separately. CREST company accreditation, ISO certifications, PCI QSA status, GNS industrial-security credentials, or similar organizational assurance are not the same as individual certifications such as OSCP, OSWE, OSEP, CREST CRT/CCT, GIAC, CISSP, or CEH.

Where capabilities were not directly evidenced in current public materials, they were treated cautiously.

How we built this Portugal list: We looked for providers with a Portuguese office or registered entity that publish penetration testing or security testing services, plus one automated scanning platform with a Lisbon office included for contrast, and checked their service, office, and certification pages on 3 November 2026. Portugal's market includes Lisbon and Porto specialists, an Iberian group, Big Four practices, and two product companies with Portuguese offices (Ethiack and Probely); each entry states which it is. We did not test the providers ourselves.

Top Penetration Testing Companies in Portugal

DeepStrike publishes this list and lists itself first; list order is not a quality ranking, and the remaining providers are not ordered by score.

1. DeepStrike: Application, cloud, and infrastructure testing

Public offering: DeepStrike's penetration testing services describe human-led testing across applications, cloud environments, and infrastructure, supported by a findings and collaboration platform. Its public process covers planning, reconnaissance, vulnerability discovery, controlled exploitation, reporting, and technical support. Published reports include reproduction steps, remediation guidance, and root-cause information; the proposal should define exact coverage and commercial terms.

Portugal relevance: Founded in 2016, DeepStrike LLC is headquartered in Newark, Delaware, has 11–50 employees, and also publishes a business address in Dubai, UAE (IFZA Business Park). It delivers testing remotely for Portuguese clients; define tester locations, permitted subcontracting, and data-handling restrictions in the engagement agreement.

Team certifications: OSCP, OSWE, OSEP, OSWP, GXPN, GWAPT, eCPPT, eMAPT, eWPT, CREST CPSA, CRTP, CRTE, and Microsoft Azure Security Engineer Associate, as shown on DeepStrike's services page.

Official sources: Pricing , Contact Us

Buyer fit: Engineering teams that need application, cloud, or infrastructure testing with direct remediation collaboration.

2. Devoteam Cyber Trust (formerly INTEGRITY): CREST-accredited Lisbon pentesting

Public offering: Devoteam Cyber Trust's offensive security services cover one-off penetration testing and persistent penetration testing (KEEP-IT-SECURE-24), red and purple teaming, AI and autonomous pentesting, source code review, Active Directory, mobile application, and cloud penetration testing, with recommendations and support to mitigate identified issues. It also offers ISO 27001, NIS2, DORA, PCI, and SWIFT compliance consulting, managed security, and third-party cyber risk management.

Portugal relevance: Devoteam Cyber Trust lists its headquarters at Torre Fernão de Magalhães, Avenida D. João II, Parque das Nações, Lisbon, and says it is present in 18 more countries across EMEA. Confirm whether the assigned testers are Lisbon-based and agree data-handling and subcontracting terms in the contract.

Certifications: Devoteam Cyber Trust states it is the first Portuguese company accredited by CREST for penetration testing services (since November 2014), holds ISO 27001, ISO 27701, and ISO 9001 certifications, GNS accreditation for handling classified information, and Bancontact and EPI payment-app assessment accreditations.

Official sources: https://www.integrity.pt/offensive-security.html; https://www.integrity.pt/contacts.html

Buyer fit: Banks, regulated enterprises, and public bodies that want a CREST-accredited Portuguese provider with persistent testing and compliance support.

What sets it apart in Portugal: A Lisbon-headquartered provider whose penetration testing accreditation appears on CREST's marketplace and which also states GNS accreditation for classified work.

3. Claranet Portugal: Penetration testing within managed cybersecurity

Public offering: Claranet Portugal's cybersecurity offering lists penetration testing, red and purple teaming, and continuous red teaming and pen testing, alongside SOC and MDR as a service, cyber intelligence and risk management, identity security, 360 security and compliance assessments, and DPO and CISO support services. It also runs a separate talent and training area.

Portugal relevance: Claranet lists Portuguese offices in Lisbon (Beato Innovation District) and Porto, as part of a group with offices in the UK, France, Italy, and other countries. Confirm the assigned testing team, its location, and data-handling terms in the agreement.

Official sources: https://www.claranet.pt/cyber-security/; https://www.claranet.pt/contactos/

Buyer fit: Large Portuguese organisations that want penetration testing integrated with managed detection, compliance, and wider IT services.

What sets it apart in Portugal: An international managed services group with Lisbon and Porto offices that offers continuous red teaming and pentesting alongside SOC and MDR.

4. S21sec (Cyber Solutions by Thales): Iberian SOC, audits, and penetration tests

Public offering: S21sec's website presents it as Cyber Solutions by Thales, after Thales completed its acquisition of S21sec in October 2022. The site describes a portfolio of compliance and governance audits, threat detection, and penetration tests, organised into consulting, protection, detect-and-respond, and training services. It states that Thales operates Security Operations Centres in Madrid and Porto for southern Europe, fed by its own threat intelligence.

Portugal relevance: The official site references a Porto SOC alongside Madrid operations. Confirm whether the offensive testing team for your engagement is Portugal-based, Spain-based, or blended, and define data-handling terms in the agreement.

Official sources: https://www.s21sec.com/en/

Buyer fit: Financial institutions, critical-infrastructure operators, and public bodies that want penetration tests alongside intelligence-led detection and response.

What sets it apart in Portugal: An Iberian Thales business with a Porto SOC, suited to buyers who want penetration tests from the same supplier as their detection and response. For S21sec's operations in Spain and other providers across the border, see our list of top cybersecurity companies in Spain.

5. VisionWare: Portuguese cybersecurity firm with intrusion testing

Public offering: VisionWare's cybersecurity services include perimeter security assessment (pentest), internal network and systems assessment, application security including code review, and social engineering maturity assessments, alongside ISO/IEC 27001 audits, a SOC and CSIRT, NIS2 and cyberspace legal regime support, digital forensics, privacy, risk intelligence, and a training academy.

Portugal relevance: VisionWare describes itself as a 100% Portuguese company operating since 2005, headquartered in Porto with an office in Parque das Nações, Lisbon, and branches in Cape Verde. Confirm the assigned testers, test-day allocation, and data handling in the agreement.

Official sources: https://www.visionware.pt/ciberseguranca; https://www.visionware.pt/contactos

Buyer fit: Portuguese enterprises and public bodies that want domestic delivery of testing combined with compliance, forensics, and incident response.

What sets it apart in Portugal: A Portuguese-owned firm operating since 2005 from Porto and Lisbon that combines testing with forensics and incident response.

6. Ethiack: Autonomous pentesting with human validation

Public offering: Ethiack's platform uses Hackian, an agentic AI pentesting engine that maps attack surfaces, runs exploitation routines, chains attack paths, and provides proof-of-exploit for confirmed risks. It also offers attack surface management, adversarial exposure validation, agentic pentest as a service that pairs Hackian with expert human validation, risk-based vulnerability management, and compliance reporting for NIS2, DORA, SOC 2, ISO 27001, and PCI.

Portugal relevance: Ethiack S.A. lists its registered office at Instituto Pedro Nunes, Coimbra, Portugal. Clarify how much human-led testing is included, where testers are located, and how findings data is stored.

Official sources: https://ethiack.com/platform; https://ethiack.com/legal/privacy-policy

Buyer fit: Organisations with large or fast-changing attack surfaces that want continuous automated testing with human validation between periodic manual pentests.

What sets it apart in Portugal: A Coimbra-based company built around an agentic AI pentesting engine with human validation, closer to continuous testing than a traditional consultancy engagement.

7. PwC Portugal: Pentesting within integrated cybersecurity services

Public offering: PwC Portugal's cybersecurity page describes integrated services including a 24/7 SOC, threat intelligence, pentesting, incident response, security engineering, and governance, risk, and compliance. The firm also publishes a Portugal cybersecurity team page listing its cybersecurity and privacy leadership.

Portugal relevance: PwC Portugal runs a local cybersecurity practice with published Portugal-based leadership. Confirm the assigned technical team, manual test-day allocation, and data-handling terms in the engagement letter.

Official sources: https://pwc.pt/cybersecurity; https://www.pwc.pt/pt/temas-actuais/cybersecurity/equipa.html

Buyer fit: Banks, insurers, and large regulated organisations that want pentesting connected to SOC, incident response, and GRC services.

What sets it apart in Portugal: A Big Four practice that links pentesting to a 24/7 SOC, threat intelligence, and GRC services.

8. Deloitte Portugal: Attack surface management and cyber resilience

Public offering: Deloitte Portugal's Cyber Defence & Resilience services include attack surface management, which covers malware analysis, threat hunting, vulnerability management, penetration testing, and other offensive security practices, plus crisis and incident response with scenario-based exercises. Its wider cyber practice covers cyber operate, strategy and transformation, digital trust and privacy, and enterprise security.

Portugal relevance: Deloitte publishes these services on its Portugal site. Confirm the Portugal-based team, tester assignment, exploit-validation depth, and data-handling terms in the agreement.

Official sources: https://www.deloitte.com/pt/pt/services/consulting/services/cyber-defense-resilience.html

Buyer fit: Large enterprises and regulated organisations that want penetration testing as part of incident response and resilience programs.

What sets it apart in Portugal: Penetration testing is delivered inside Deloitte's attack surface management and cyber resilience services rather than as a standalone offer.

9. Probely (Snyk API & Web): Automated web and API scanning

Public offering: Probely, now presented as Snyk API & Web, is an automated web application and API vulnerability scanner that discovers APIs and web apps, tests them for vulnerabilities, prioritises findings, and gives remediation guidance, with developer, DevOps, and compliance use cases. It is a scanning platform rather than a manual penetration testing service.

Portugal relevance: The site lists a Lisbon office (Praça Duque de Saldanha) alongside San Francisco and London. Confirm where scan data is processed and stored, and plan manual testing separately for business logic and complex authorization flaws.

Official sources: https://probely.com/

Buyer fit: Development teams that want continuous automated web and API scanning between periodic manual penetration tests.

What sets it apart in Portugal: An automated web and API scanner with a Lisbon office, now presented as Snyk API & Web; it complements manual pentesting rather than replacing it.

Comparison of Top Providers

How to Choose the Right Provider

Selecting a penetration-testing company is about fit and trust as much as technical ability.

1. Define scope and methodology. Identify the assets that matter: web apps, APIs, cloud, networks, mobile, identity, OT, or physical/social-engineering scope.
2. Separate manual pentesting from scanning. Ask how testers validate exploitability, authorization flaws, business logic, privilege escalation, and attack chains.
3. Check company assurance and tester credentials separately. CREST company accreditation is not the same thing as an OSCP or other individual certification.
4. Review sector experience. Finance, healthcare, public-sector and critical-infrastructure environments may need different reporting and evidence.
5. Check compliance and reporting. Ask for sample reports and confirm whether findings map cleanly to your NIS2, DORA, PCI DSS, ISO 27001, or customer-assurance needs.
6. Confirm delivery model and communication. Determine whether you get interim findings, a live dashboard, a final report, debrief sessions, Slack/Jira integration, or another collaboration model.
7. Verify retesting. Ask whether remediation validation is included, time-limited, or separately charged.
8. Check local versus cross-border requirements. If onsite work, Portuguese-language reporting, classified information, or domestic data handling matter, verify them explicitly.
9. Compare scope, not only price. A low quote may be appropriate for a narrow scope, while a higher quote may include more manual test days, multiple roles, or deeper evidence.
10. Plan follow-up testing. Major releases, cloud migrations, acquisitions, and fast-moving applications may justify recurring or continuous validation.

Pricing and Value

Penetration tests are usually custom quoted. Costs vary by number of applications or hosts, authenticated roles, cloud complexity, test depth, onsite requirements, compliance evidence, and retesting.

This guide does not present a national price benchmark because no sufficiently strong Portugal-wide pricing dataset was identified.

Instead, buyers should ask:

• How many manual testing days are included?
• Which tester seniority is allocated?
• Are APIs, cloud, identity, mobile, and internal networks separate scopes?
• Is retesting included?
• Are critical findings escalated during the test?
• Is executive reporting included?
• Is onsite work extra?
• Does the provider include a live dashboard or only a final report?

Local vs Global

Local providers can offer onsite testing, Portuguese-language reporting, local procurement support, and knowledge of Portuguese regulation.

Global providers can bring specialist depth, larger technical pools, and experience across broader attack surfaces.

A hybrid approach can also work: some organizations use a local provider for recurring enterprise assurance and a specialist provider for deep cloud, API, red-team, or product-security work. Teams that release frequently can also compare recurring models such as penetration testing as a service (PTaaS).

Common Myths

• One pentest is enough. New code and infrastructure changes create new risks.
• Automated scanning equals pentesting. It does not. Scanning is useful, but manual attack-path validation adds depth.
• CREST and OSCP mean the same thing. They do not. CREST can accredit companies and certify individuals; OSCP is an individual practitioner certification.
• Compliance proves security. A compliant environment can still have exploitable weaknesses.
• The largest vendor is always the best. Provider scale does not automatically mean deeper testing.
• The cheapest provider is always the best value. Compare scope, tester seniority, evidence quality, communication, and retesting.

Frequently Asked Questions

What is the difference between internal and external penetration testing?

External pentests focus on public-facing systems such as websites, VPNs, firewalls, APIs, and cloud services to determine what an attacker outside the organization could compromise.

Internal pentests assume an attacker already has a foothold inside the network and test privilege escalation, lateral movement, Active Directory or identity weaknesses, segmentation, and access to sensitive systems.

Both can be important depending on the organization’s risk model.

How much does a pentest cost in Portugal?

Costs vary widely based on scope and delivery model. A narrow web-app test can cost far less than a multi-application, internal, cloud, identity, OT, or red-team engagement.

There is no strong Portugal-wide benchmark that should replace a scope-specific quote.

Should my company use CREST-accredited or OSCP-certified testers?

Both can be useful signals, but they mean different things. CREST can accredit providers and certify individuals, while OSCP is an individual hands-on offensive-security certification.

In Portugal, Devoteam Cyber Trust states that it is the first Portuguese company accredited by CREST for penetration-testing services.

Practical experience, scope relevance, reporting quality, and named tester credentials still matter.

Do I need penetration testing for GDPR, NIS2, or DORA?

GDPR does not explicitly mandate a universal penetration test. It requires appropriate technical and organizational security measures and processes for testing their effectiveness.

Portugal’s Decree-Law No. 125/2025 transposes NIS2 and applies from April 2026 to covered essential, important, and relevant public entities. The framework requires cyber-risk-management measures and stronger governance, but it should not be summarized as a universal pentest mandate for every organization.

DORA requires digital operational resilience testing for in-scope financial entities. Certain entities must perform threat-led penetration testing at least every three years.

What is the difference between black-box and white-box testing?

In black-box testing, testers begin with little or no internal knowledge and simulate an external attacker.

In white-box testing, they receive deeper information such as source code, architecture documentation, and credentials.

Gray-box testing sits between the two and is often efficient for authenticated application and API testing.

How often should penetration testing be done?

There is no single universal schedule. Annual testing is common, but frequency should depend on regulatory requirements, customer commitments, system criticality, and change velocity.

Major releases, acquisitions, infrastructure changes, and cloud migrations can justify additional tests. Fast-changing SaaS and API environments may benefit from continuous or release-driven testing.

What internal resources do I need for a pentest?

1. Define the test scope, URLs, IPs, applications, APIs, or cloud accounts.
2. Provide test credentials where authenticated testing is planned.
3. Assign technical and business contacts.
4. Confirm testing windows and escalation contacts.
5. Review findings with the provider.
6. Remediate according to risk and business impact.
7. Retest important findings to confirm closure.

Bottom Line

Portugal has a mature penetration-testing market. Devoteam Cyber Trust, Claranet Portugal, VisionWare, Ethiack, PwC Portugal, and Deloitte Portugal add strong local or Portugal-based capability, while S21sec (Cyber Solutions by Thales) remains a major Iberian enterprise option.

Probely (Snyk API & Web) is an automated AppSec scanning platform that complements, rather than replaces, manual penetration testing.

DeepStrike, the publisher of this guide, is listed first for organizations that want human-led application, cloud, and infrastructure testing with direct remediation collaboration. Portuguese buyers with strict local delivery, CREST assurance, Portuguese-language, classified-information, or large-enterprise managed-security requirements may reasonably prefer one of the strong local providers above.

The strongest shortlist comes from comparing methodology, assigned testers, exploit-validation depth, cloud/API maturity, reporting quality, retesting, and actual delivery fit rather than brand visibility alone.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in finance, healthcare, and technology sectors.

Technical Review: DeepStrike Offensive Security Team