October 26, 2025
Updated: August 17, 2026
Portugal’s cybersecurity market is booming under NIS2, DORA, and GDPR. Compare DeepStrike’s manual-first PTaaS model with Claranet, S21sec, Probely, and local experts on methodology, pricing, and compliance readiness.
Mohammed Khalil
Portugal’s cybersecurity market is expanding under NIS2, DORA, GDPR, cloud adoption, and a fast-growing technology sector. This update keeps the original buyer-guide structure while refreshing the company list, regulatory context, ranking logic, and provider positioning for 2026.
Updated: August 2026. DeepStrike publishes this guide and remains #1 in this editorial ranking. Competitor profiles are based on publicly verifiable information, and buyers should independently confirm the legal entity, assigned testers, onsite capability, accreditation, data handling, retesting, and commercial terms before procurement.
| Rank | Company | Best For | Portugal Fit | Testing Model / Differentiator |
|---|---|---|---|---|
| 1 | DeepStrike | PTaaS, cloud/API, SaaS, developer remediation | Cross-border remote; no Portugal office evidenced | Manual-first PTaaS + continuous testing |
| 2 | Devoteam Cyber Trust (formerly INTEGRITY) | CREST-backed enterprise pentesting and persistent testing | Lisbon HQ / Portugal-based team | CREST-accredited pentesting + persistent testing + red team |
| 3 | Claranet Portugal | Enterprise testing, continuous pentesting, training, SOC | Strong Portugal presence | Pentest + red/purple team + NotSoSecure training |
| 4 | Thales / S21sec | Large enterprise, finance, telco, OT and critical infrastructure | Iberian/Portugal cyber presence | Offensive security + threat intelligence + SOC |
| 5 | VisionWare | Local Portuguese enterprise and public-sector security testing | Porto HQ + Lisbon office | Advanced intrusion testing + attack simulation |
| 6 | Ethiack | Autonomous ethical hacking and continuous validation | Coimbra-founded / Portugal-based | AI-driven continuous pentesting + human hacking events |
| 7 | PwC Portugal | Regulated enterprise, audit-linked offensive security and TLPT | Lisbon / local cyber team | Pentest + red team + threat intelligence + governance |
| 8 | Deloitte Portugal | Enterprise attack-surface, red team, resilience and large programs | Local Portugal practice | Pentest + ASM + incident response + cyber resilience |
| 9 | Probely | Continuous web/API scanning and developer workflows | Portuguese-founded | Automated DAST/AppSec platform; complements manual pentesting |
Penetration testing (pentesting) is an authorized, simulated cyberattack on a system, network, application, API, cloud environment, mobile app, or other defined scope to find security weaknesses before real attackers do.
Unlike basic vulnerability scans, penetration tests involve skilled ethical hackers using the same types of techniques attackers use to determine whether weaknesses can actually be exploited and what business impact could follow.
For Portuguese businesses, pentesting also supports security governance and compliance evidence. GDPR requires appropriate technical and organizational measures but does not create one universal annual pentest mandate. Portugal’s NIS2 framework now operates through Decree-Law No. 125/2025, which entered into force on 3 April 2026, while DORA imposes digital operational resilience testing requirements on in-scope financial entities.
Cyberattacks continue to rise in Portugal and across Europe. The CNCS 2025 risk-and-conflict reporting highlighted a significant increase in cyber incidents affecting the national cyberspace during 2024, including ransomware, DDoS, credential leaks, phishing, smishing, exploitation of vulnerabilities, and other forms of online fraud.
The current regulatory picture is also much clearer than in the earlier version of this article. Portugal’s new Cybersecurity Legal Regime transposes NIS2 and applies to essential, important, and relevant public entities across 17 sectors and public administration. The implementing regulation published in June 2026 gives the framework more operational detail.
In finance, DORA requires a risk-based digital operational resilience testing program. Certain financial entities must conduct advanced threat-led penetration testing at least every three years, while all in-scope financial entities face broader testing requirements proportionate to risk.
In short, a solid penetration test helps Portuguese companies find hidden vulnerabilities, strengthen defenses before attackers exploit them, and produce clearer evidence for management, auditors, customers, and regulators.
Pentests often reveal not just technical bugs such as SQL injection or SSRF but also authorization failures, identity attack paths, weak segmentation, cloud misconfiguration, detection gaps, and business-logic flaws. Skilled testers report not only what is wrong but also how to fix it.
| Evaluation Criterion | Weight |
|---|---|
| Manual penetration-testing depth and exploit validation | 25% |
| Verified provider assurance and tester credentials | 20% |
| Portugal presence, local relevance, or practical EU delivery | 15% |
| Web, API, cloud, identity, infrastructure, mobile, OT/IoT and red-team breadth | 15% |
| Reporting, remediation support, and retesting | 10% |
| Delivery model and buyer collaboration | 10% |
| Public evidence, case studies, and transparency | 5% |
Provider-level assurance and individual credentials are treated separately. CREST company accreditation, ISO certifications, PCI QSA status, GNS industrial-security credentials, or similar organizational assurance are not the same as individual certifications such as OSCP, OSWE, OSEP, CREST CRT/CCT, GIAC, CISSP, or CEH.
Where capabilities were not directly evidenced in current public materials, they were treated cautiously.
DeepStrike brings its manual-first Penetration Testing-as-a-Service (PTaaS) model to Portugal, serving technology, SaaS, fintech, cloud, and API-heavy organizations through a global delivery model.
Services
DeepStrike provides end-to-end offensive security testing, including:
Approach
Unlike automated scanners, DeepStrike emphasizes manual exploitation and realistic attack-path validation. The PTaaS workflow gives engineering teams visibility into findings and supports remediation collaboration through developer-focused workflows.
Portugal Relevance
DeepStrike is relevant to Portuguese organizations that prioritize cloud/API depth, PTaaS, developer collaboration, and recurring testing. No Portuguese office was evidenced in the reviewed public material, so buyers requiring onsite delivery, Portuguese-language reporting, or local data residency should confirm those conditions.
Key Strengths
Potential Limitations
Best For
SaaS, fintech, cloud-native organizations, APIs, and development teams that need testing aligned with frequent releases.
Devoteam Cyber Trust is one of the strongest Portugal-based providers in this update. The team was previously known as INTEGRITY and has operated from Portugal since 2009.
The company states that it is the only Portuguese company accredited by CREST for penetration-testing services, originally certified in November 2014. It also publishes persistent penetration-testing case studies, red-team case studies, PCI-DSS capability, ISO 27001 and ISO 9001 certifications, and Portuguese GNS credentials for handling classified information.
Services
Approach
The strongest differentiator is a mature persistent pentesting model integrated with customer change-management cycles. Devoteam Cyber Trust also publishes a case study where persistent testing reduced remediation time and improved vulnerability mitigation compared with the customer’s previous model.
Portugal Relevance
The Portugal-based team is headquartered in Lisbon and operates across more than 20 countries through the wider Devoteam Cyber Trust organization.
Key Strengths
Potential Limitations
Best For
Banks, financial entities, regulated enterprises, public-sector environments, and organizations needing strong assurance plus continuous testing.
Claranet remains one of the strongest large-provider options in Portugal. Its current Portuguese cybersecurity page explicitly lists Penetration Testing, Red and Purple Teaming alongside SOC & MDR, identity security, incident response, and wider managed security.
Claranet also publishes Portuguese material on continuous pentesting and red teaming, and its NotSoSecure training portfolio adds a strong education component.
Services
Approach
Claranet combines hands-on technical testing with enterprise-scale security operations, managed services, and training.
Clients & Fit
Claranet is especially relevant to larger organizations, regulated industries, public institutions, finance, telecom, and buyers that want one provider for pentesting, training, and managed cybersecurity.
Key Strengths
Potential Limitations
Best For
Large Portuguese organizations that want pentesting integrated with managed security, training, and continuous assurance.
S21sec was acquired by Thales in 2022 and remains part of Thales’ Iberian cyber footprint. Thales states that the acquisition strengthened its local presence across Iberia, and the group operates cybersecurity SOC capability in both Portugal and Spain.
The current Thales/S21sec offensive-security role descriptions explicitly cover external/internal infrastructure testing, web, mobile, API and Wi-Fi penetration testing, as well as PCI-related technical audits.
Services
Approach
Thales/S21sec combines offensive testing with threat intelligence, managed detection and response, and critical-infrastructure security.
Clients & Fit
The strongest fit is large regulated organizations in finance, telecom, utilities, defense, public infrastructure, and complex enterprise environments.
Key Strengths
Potential Limitations
Best For
Banks, telecoms, critical infrastructure, utilities, and enterprises requiring large-scale or specialist security assessment.
VisionWare is a 100% Portuguese cybersecurity company, founded in 2005, headquartered in Porto with an office in Lisbon.
Its current public material states that it evaluates cybersecurity maturity through advanced intrusion testing and attack simulations. The company also works across digital forensics, regulatory compliance, privacy, strategic intelligence, risk analysis, and physical/corporate security.
Services
Approach
VisionWare combines technical security validation with regulatory, forensic, and intelligence services.
Portugal Relevance
The company is locally headquartered in Porto and operates a Lisbon office, making it a strong domestic choice for organizations prioritizing Portuguese delivery.
Key Strengths
Potential Limitations
Best For
Portuguese enterprise, public-sector, regulated, and incident-sensitive organizations that value domestic delivery and broad security assurance.
Ethiack is a Portuguese offensive-security technology company with roots in Coimbra. It positions its platform around Autonomous Ethical Hacking, continuous attack-surface mapping, exploit validation, and human hacking events.
Its current platform uses the Hackian AI pentesting engine to map attack surfaces, execute exploitation routines, chain attack paths, and deliver proof-of-exploit for confirmed risks. Ethiack also supports human hacking events by elite ethical hackers, which is important because the service is not purely automated.
Services
Approach
Ethiack’s differentiator is continuous autonomous offensive security combined with human ethical-hacking expertise.
Portugal Relevance
Ethiack is strongly connected to Portugal’s cybersecurity ecosystem and has published research on the exposure of the 500 largest Portuguese companies.
Key Strengths
Potential Limitations
Best For
Large digital estates, SaaS, distributed attack surfaces, and organizations comparing continuous autonomous testing with periodic manual pentesting.
PwC Portugal now publishes a much clearer offensive-security offering than the older version of this article reflected. Its cybersecurity page explicitly lists pentesting, while its IT security material describes penetration testing across infrastructure, web platforms, Wi-Fi, firewalls and VPNs.
PwC Portugal also has a named Lead of Offensive Security whose public profile lists Red Team, TLPT, Pentest, ASM, CTI, OSINT and deep/dark-web expertise.
Services
Approach
PwC combines technical testing with audit, risk, regulatory and board-level assurance.
Portugal Relevance
PwC has a direct local Portugal cyber practice and publishes Portugal-specific NIS2 and DORA guidance.
Key Strengths
Potential Limitations
Best For
Banks, insurers, large enterprises, regulated organizations, and buyers requiring audit-ready technical-security evidence.
Deloitte Portugal’s Cyber Defence & Resilience portfolio explicitly lists penetration testing within Attack Surface Management alongside vulnerability management, malware analysis, threat hunting, and other offensive-security practices.
The value proposition is strongest for organizations that want penetration testing linked to incident response, resilience, crisis preparation, and wider enterprise cybersecurity.
Services
Approach
Deloitte uses pentesting as part of a broader enterprise risk and resilience program rather than as a standalone boutique service.
Portugal Relevance
Deloitte has a direct Portugal cyber practice and local partners responsible for cyber defense and resilience.
Key Strengths
Potential Limitations
Best For
Large enterprises and regulated organizations that need pentesting connected to broader risk, incident, and resilience programs.
Probely remains relevant to the Portugal market because it is Portuguese-founded and widely used by development teams, but its role should be described accurately.
Probely is primarily an automated web and API vulnerability-scanning / DAST platform, not a traditional manual pentesting consultancy.
Services
Approach
Probely provides continuous automated application-security testing integrated into development workflows.
Clients & Fit
It is particularly relevant to development teams, startups, SaaS companies, and organizations with frequent releases.
Key Strengths
Potential Limitations
Best For
Development teams that need continuous web/API security monitoring between periodic manual pentests.
| Provider | Core Services | Delivery Model | Typical Fit | Verified Positioning | Standout Strength |
|---|---|---|---|---|---|
| DeepStrike | Web/API, mobile, cloud, infrastructure, red team, PTaaS | Manual-first PTaaS | SaaS, fintech, cloud-native teams | Global remote provider | Deep manual testing + remediation workflow |
| Devoteam Cyber Trust | Pentest, persistent testing, red team, PCI, GRC | Managed/persistent + project | Finance, enterprise, regulated | CREST-accredited Portugal team | Strongest formal local pentest assurance |
| Claranet Portugal | Pentest, red/purple team, continuous testing, SOC, training | Enterprise managed services | Large enterprise/public sector | Strong Portugal presence | Security testing + managed security + training |
| Thales / S21sec | Pentest, red team, OT, SOC/MDR, threat intelligence | Enterprise | Critical infrastructure, telco, banking | Iberian/Portugal cyber presence | Scale + threat intelligence |
| VisionWare | Intrusion testing, attack simulation, forensics, compliance | Project/consulting | Portugal enterprise/public sector | Portuguese company since 2005 | Local specialist breadth |
| Ethiack | Autonomous pentest, EASM, human hacking | Continuous platform + human events | SaaS/large digital estates | Portuguese-founded | Continuous exploit validation |
| PwC Portugal | Pentest, red team, TLPT, threat intelligence, GRC | Enterprise assurance | Finance/regulatory/audit | Local Offensive Security leadership | Audit-ready offensive security |
| Deloitte Portugal | Pentest, ASM, vulnerability management, resilience | Enterprise consulting | Large enterprise | Local Portugal cyber practice | Pentest + resilience program |
| Probely | Automated web/API scanning | SaaS platform | Dev teams/startups | Portuguese-founded AppSec platform | Continuous developer feedback |
Selecting a penetration-testing company is about fit and trust as much as technical ability.
Penetration tests are usually custom quoted. Costs vary by number of applications or hosts, authenticated roles, cloud complexity, test depth, onsite requirements, compliance evidence, and retesting.
The earlier version of this article suggested a broad Portugal price range. This update does not present that as a national market benchmark because no sufficiently strong Portugal-wide pricing dataset was identified.
Instead, buyers should ask:
Local providers can offer onsite testing, Portuguese-language reporting, local procurement support, and knowledge of Portuguese regulation.
Global providers can bring specialist depth, larger technical pools, and experience across broader attack surfaces.
A hybrid approach can also work: some organizations use a local provider for recurring enterprise assurance and a specialist provider for deep cloud, API, red-team, or product-security work.
External pentests focus on public-facing systems such as websites, VPNs, firewalls, APIs, and cloud services to determine what an attacker outside the organization could compromise.
Internal pentests assume an attacker already has a foothold inside the network and test privilege escalation, lateral movement, Active Directory or identity weaknesses, segmentation, and access to sensitive systems.
Both can be important depending on the organization’s risk model.
Costs vary widely based on scope and delivery model. A narrow web-app test can cost far less than a multi-application, internal, cloud, identity, OT, or red-team engagement.
There is no strong Portugal-wide benchmark that should replace a scope-specific quote.
Both can be useful signals, but they mean different things. CREST can accredit providers and certify individuals, while OSCP is an individual hands-on offensive-security certification.
In Portugal, Devoteam Cyber Trust states that it is the only Portuguese company accredited by CREST for penetration-testing services.
Practical experience, scope relevance, reporting quality, and named tester credentials still matter.
GDPR does not explicitly mandate a universal penetration test. It requires appropriate technical and organizational security measures and processes for testing their effectiveness.
Portugal’s Decree-Law No. 125/2025 transposes NIS2 and applies from April 2026 to covered essential, important, and relevant public entities. The framework requires cyber-risk-management measures and stronger governance, but it should not be summarized as a universal pentest mandate for every organization.
DORA requires digital operational resilience testing for in-scope financial entities. Certain entities must perform threat-led penetration testing at least every three years.
In black-box testing, testers begin with little or no internal knowledge and simulate an external attacker.
In white-box testing, they receive deeper information such as source code, architecture documentation, and credentials.
Gray-box testing sits between the two and is often efficient for authenticated application and API testing.
There is no single universal schedule. Annual testing is common, but frequency should depend on regulatory requirements, customer commitments, system criticality, and change velocity.
Major releases, acquisitions, infrastructure changes, and cloud migrations can justify additional tests. Fast-changing SaaS and API environments may benefit from continuous or release-driven testing.
Portugal’s penetration-testing market is stronger and more mature than the earlier shortlist suggested. Devoteam Cyber Trust, Claranet Portugal, VisionWare, Ethiack, PwC Portugal, and Deloitte Portugal add strong local or Portugal-based capability, while Thales/S21sec remains a major Iberian enterprise option.
Probely remains useful in the article, but it should be presented as an automated AppSec platform rather than a substitute for manual penetration testing.
DeepStrike remains #1 in this publisher ranking for organizations prioritizing manual-first PTaaS, cloud/API attack-path validation, developer collaboration, and retesting. Portuguese buyers with strict local delivery, CREST assurance, Portuguese-language, classified-information, or large-enterprise managed-security requirements may reasonably prefer one of the strong local providers above.
The strongest shortlist comes from comparing methodology, assigned testers, exploit-validation depth, cloud/API maturity, reporting quality, retesting, and actual delivery fit rather than brand visibility alone.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in finance, healthcare, and technology sectors.
Technical Review: DeepStrike Offensive Security Team
Last Reviewed: August 2026
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
