Pentest Providers Switzerland 2026 at a Glance

Last updated: June 23, 2026

Pentesting in Switzerland

Switzerland, as an international financial center, places high demands on penetration testing. FINMA and international standards such as DORA require regular security assessments. Banks, insurers, the growing FinTech and crypto sector, and an export-driven industry all process highly sensitive data — which makes a technically sound penetration test that simulates real attacks, rather than just running an automated vulnerability scan, especially important.

Regulatory context for pentests in Switzerland

Rather than serving as a mere compliance checkbox, a pentest in Switzerland should demonstrate the actual resilience of your systems. Several frameworks shape the landscape:

• FINMA Circular 2023/01 "Operational risks and resilience – banks" (in force since January 1, 2024): Supervised banks and securities firms must demonstrate their operational resilience and ICT risk management. This includes identifying critical functions and regularly testing their robustness. Penetration tests are an established way to evidence exactly this technical resilience and vulnerability management.
• Revised Federal Act on Data Protection (revDSG, in force since September 1, 2023): Anyone processing personal data must take appropriate technical and organizational measures to ensure data security. Regular security testing and the remediation of identified gaps are a practical way to demonstrate this duty of care — particularly relevant for web applications, customer portals, and APIs.
• Relationship to the EU, DORA, and TIBER-EU: Switzerland is not part of the EU, so DORA and TIBER-EU do not apply directly here. Swiss financial institutions are, however, increasingly aligning with equivalent threat-led penetration testing approaches, and FINMA expects operational resilience to be tested. Anyone working cross-border with EU counterparties or running an EU subsidiary may fall within DORA's scope regardless — so a test program aligned with these standards is forward-looking even in Switzerland.

In practice, this means: decide up front which requirement the test addresses, and make sure the scope, methodology, and reporting format match it. A web app pentest supporting a revDSG record of compliance looks different from an infrastructure-wide test backing operational resilience under FINMA 2023/01.

Pentesting Providers in Switzerland

• Compass Security - Penetration testing, Rapperswil-Jona
• CRYPTRON Security GmbH - Penetration testing and Red/Purple Teaming
• InfoGuard AG - Cyber security and penetration testing, Baar
• modzero AG - Security research and application security, Zurich
• Oneconsult - Cybersecurity services, Zurich
• Red Team Partners - Red Teaming and pentesting, CREST-certified
• Redguard - Penetration testing, Bern
• scip AG - Security research and penetration testing, Zurich
• Terreactive AG - Managed security and penetration testing, Aarau

What to look for when choosing a provider

The Swiss provider landscape is dense — ranging from established, larger firms to highly specialized teams. These criteria help you find the right partner:

• Demonstrable technical depth. Look for recognized, hands-on certifications among the people doing the work (e.g., OSCP, OSEP, OSWE for offensive security; CREST at the organizational level) rather than management certificates alone. What matters is that testing is genuinely manual and exploitation-driven — not just a delivered tool scan.
• Fit of scope and methodology. A good provider first asks about your objective (web app, API, internal infrastructure, Active Directory, cloud, Red Teaming) and tailors the approach and test depth (black-, gray-, or white-box) accordingly. Recognized methodologies such as OWASP, OSSTMM, or the PTES provide a solid baseline.
• A clear, actionable report. The value of a pentest comes from the report: reproducible steps, a defensible risk rating, and concrete, prioritized recommendations. Ask for an anonymized sample report before you commit.
• Regulatory fit. If the test should address FINMA 2023/01, the revDSG, or DORA-equivalent requirements, the provider must understand those references and be able to structure the report accordingly.
• Independence and re-testing. Favor providers that test themselves (no pure resellers), disclose conflicts of interest, and offer a re-test after remediation — that is the only way to prove the gaps were actually closed.

→ All Pentesting Providers in the DACH Region
→ All Red Teaming Providers in the DACH Region
→ All Physical Security Providers in the DACH Region