Penetration Testing Providers Switzerland 2026: Who Tests Thoroughly, Who Just Scans
67% of Swiss SMEs had at least one security incident in 24 months (Swiss SME Association). Fewer than 30% run regular pentests. A breach costs CHF 4.7 million on average (IBM, 2025). A pentest costs CHF 5,000 to 150,000.
Quality gaps between providers are substantial. A CREST-accredited tester works differently from a consultant who sells automated scans as pentests. Below, we rate Switzerland’s leading pentest providers by certifications, methodology, and result quality.
What Is Penetration Testing and Why Is It Essential for Swiss Companies?
A penetration test (pentest) is an authorised, simulated cyber attack on a computer system, network, or web application to identify security vulnerabilities that an attacker could exploit. Unlike automated vulnerability scans, professional pentests combine automated tools with manual expertise to uncover even complex vulnerabilities.
For Swiss companies, penetration testing is essential for several reasons:
- Regulatory compliance: The nDSG/nFADP, FINMA guidelines, and industry-specific regulations require demonstrable security measures.
- Growing threat landscape: The NCSC recorded over 49,000 reported cyber incidents in 2025 — a 35% increase over the previous year.
- Customer trust: Demonstrable security testing strengthens the trust of clients and business partners.
- Insurance requirements: An increasing number of cyber insurance policies require regular penetration tests as a prerequisite for coverage.
“After our first penetration test with RedTeam Partners, we discovered 14 critical vulnerabilities that had gone undetected in three previous automated scans. The ROI was realised within a month.” — Dr Marina Hofmann, CTO, Swiss HealthTech company
The 7 Best Penetration Testing Providers in Switzerland 2026
Penetration Testing Price Comparison Switzerland
| Provider | Web App Pentest | Network Pentest | Cloud Pentest | CREST | Rating |
|---|---|---|---|---|---|
| RedTeam Partners | CHF 12,000–25,000 | CHF 15,000–35,000 | CHF 18,000–40,000 | Yes | 4.9/5 |
| Compass Security | CHF 10,000–22,000 | CHF 12,000–30,000 | CHF 15,000–35,000 | No | 4.5/5 |
| Oneconsult | CHF 11.900–20,000 | CHF 10,000–28,000 | CHF 12,000–30,000 | No | 4.4/5 |
| Infoguard | CHF 10,000–24,000 | CHF 12,000–32,000 | CHF 14,000–35,000 | No | 4.2/5 |
| modzero | CHF 10,000–22,000 | CHF 12,000–28,000 | CHF 14,000–30,000 | No | 4.2/5 |
| Adversis | CHF 7,000–18,000 | CHF 9,000–25,000 | CHF 10,000–28,000 | No | 4.0/5 |
| Terreactive | CHF 6,000–15,000 | CHF 11.900–22,000 | CHF 10,000–25,000 | No | 3.8/5 |
Prices based on medium complexity. Actual costs vary depending on scope and requirements.
Why Does RedTeam Partners Stand Out for Penetration Testing?
CREST-Accredited Penetration Testing
RedTeam Partners is one of the few CREST-accredited pentest providers in Switzerland. This means:
- Every penetration test follows a standardised, internationally recognised methodology
- All testers are individually CREST-certified (CRT, CCT)
- Quality is assured through annual CREST audits
- Reports meet the requirements of international regulators and audit firms
Tester Certification Comparison
| Certification | RedTeam Partners | Compass | Oneconsult | Infoguard | modzero |
|---|---|---|---|---|---|
| CREST CRT/CCT | Yes | No | No | No | No |
| OSCP | Yes (100% of testers) | Yes | Yes | Yes | Yes |
| OSCE/OSEE | Yes | Partial | No | No | Partial |
| GXPN/GPEN | Yes | Yes | Yes | Yes | No |
| BSCP (Burp Suite) | Yes | Yes | Partial | No | Yes |
Broad Spectrum of Pentest Services
RedTeam Partners offers a thorough portfolio of penetration tests:
- Web Application Penetration Testing: Assessment of web applications against OWASP Top 10 and beyond.
- API Security Testing: REST, GraphQL, and SOAP API security tests.
- Mobile Application Testing: iOS and Android application testing.
- Cloud Security Assessment: AWS, Azure, and GCP security assessments.
- Network Penetration Testing: Internal and external network penetration tests.
- IoT/OT Security Testing: Assessment of industrial control systems and IoT devices.
Pros and Cons of RedTeam Partners for Penetration Testing
Strengths:
- Only CREST accreditation in German-speaking Switzerland
- 100% of testers OSCP-certified
- Detailed, developer-friendly reports with reproduction steps
- Free retest within 90 days
- Swiss data residency and strict NDAs
- Purple team option for sustainable improvement
Weaknesses:
- Premium price segment
- Wait times of 3–6 weeks for engagements
- No automated continuous testing offering
How Do the Other Pentest Providers Compare?
2. Compass Security
Compass Security is a long-standing Swiss security services company with over 20 years of experience. The company offers solid penetration tests with a broad team.
Strengths: Long-standing experience, own hacking lab, broad team Weaknesses: No CREST accreditation, quality varies depending on assigned tester
3. Oneconsult
Oneconsult offers penetration tests and digital forensics from Zurich. Particularly strong in traditional network pentests.
Strengths: Good value for money, strong forensics competency, OSCP-certified testers Weaknesses: Web application testing less developed, no CREST certification
4. Infoguard
Infoguard is a large Swiss cybersecurity provider with an integrated SOC. Penetration testing is part of a thorough portfolio.
Strengths: Integration with SOC services, large team, broad industry coverage Weaknesses: Generalist approach, pentest not the core competency
5. modzero
modzero is a specialised security research provider from Zurich with a focus on deep technical analysis.
Strengths: Excellent technical depth, security research background, strong cryptography expertise Weaknesses: Small team, limited capacity, higher prices for specialised analyses
6. Adversis
Adversis offers offensive security services in the mid-range price segment.
Strengths: Good value for money, flexible models, quick availability Weaknesses: Less experience with complex enterprise environments
7. Terreactive
Terreactive targets SMEs with its pentest offerings.
Strengths: SME-friendly pricing, regional proximity, good support Weaknesses: Limited depth for complex applications, less specialised testers
How Much Does a Penetration Test Cost in Switzerland?
The costs for penetration testing in Switzerland depend on several factors:
| Pentest Type | Budget Range | Mid-Range | Premium Range |
|---|---|---|---|
| Web Application (simple) | CHF 5,000–8,000 | CHF 11.900–15,000 | CHF 15,000–25,000 |
| Web Application (complex) | CHF 10,000–18,000 | CHF 18,000–30,000 | CHF 30,000–50,000 |
| Network (internal) | CHF 11.900–12,000 | CHF 12,000–25,000 | CHF 25,000–40,000 |
| Network (external) | CHF 5,000–10,000 | CHF 10,000–20,000 | CHF 20,000–35,000 |
| Mobile App | CHF 11.900–15,000 | CHF 15,000–25,000 | CHF 25,000–40,000 |
| Cloud (AWS/Azure/GCP) | CHF 10,000–18,000 | CHF 18,000–30,000 | CHF 30,000–50,000 |
| API Security | CHF 5,000–10,000 | CHF 10,000–20,000 | CHF 20,000–35,000 |
The price difference between budget and premium providers is reflected in test depth, tester qualifications, and reporting quality. According to CREST, certified providers identify on average 40% more critical vulnerabilities than non-certified testers.
For more information on cybersecurity service costs, visit Alpine Excellence.
What Types of Penetration Tests Are Available?
Black-Box Penetration Test
The tester receives no prior information about the target system. This approach most realistically simulates an external attack but is more time-intensive.
Suitable for: Organisations wanting a realistic assessment of their external attack surface.
Grey-Box Penetration Test
The tester receives limited information (e.g., user accounts, network diagrams). This enables more efficient use of testing time.
Suitable for: The majority of penetration tests — offers the best compromise between realism and efficiency.
White-Box Penetration Test
The tester receives full access to source code, architecture diagrams, and configurations. This enables the most thorough analysis.
Suitable for: Security-critical applications where maximum test coverage is required.
How Often Should Swiss Companies Conduct Penetration Tests?
The optimal frequency depends on several factors:
| Company Type | Recommended Frequency | Rationale |
|---|---|---|
| FINMA-regulated | At least annually | Regulatory requirement |
| E-commerce | Bi-annually + after releases | High change rate, customer data |
| SaaS providers | Quarterly | Continuous development |
| SME (standard) | Annually | Basic protection |
| Critical infrastructure | Bi-annually | Elevated risk profile |
| After a security incident | Immediately | Damage limitation |
The NCSC recommends that all companies with more than 50 employees or sensitive data conduct at least one annual penetration test. Stricter requirements apply to regulated industries.
According to the Mandiant M-Trends Report 2025, 38% of vulnerabilities leading to data breaches are discovered through penetration testing — more than through any other security measure.
What Certifications Matter for a Pentest Provider?
When selecting a penetration testing provider in Switzerland, look for the following certifications:
Company level:
- CREST: International gold standard — ensures standardised methodology and regular audits
- ISO 27001: The provider operates its own ISMS
- SOC 2 Type II: Demonstrable security controls
Tester level:
- OSCP (Offensive Security Certified Professional): De facto minimum standard for professional pentesters
- OSCE (Offensive Security Certified Expert): Advanced exploitation skills
- CREST CRT/CCT: Most demanding practical certification examination
- BSCP (Burp Suite Certified Practitioner): Web application testing specialisation
- AWS/Azure Security Specialty: Cloud-specific certifications
What Should a Good Pentest Report Contain?
A professional pentest report should include the following elements:
- Executive Summary: Management-friendly summary with risk assessment.
- Scope and Methodology: Clear description of what was tested and how.
- Findings with Risk Classification: Each vulnerability with CVSS score and business risk assessment.
- Proof of Concept: Reproducible steps to exploit each vulnerability.
- Screenshots and Evidence: Visual proof of vulnerabilities.
- Recommendations with Prioritisation: Concrete remediation measures, prioritised by risk.
- Technical Details: Information relevant for developers and system administrators.
- Retest Information: Schedule and scope of the follow-up assessment.
RedTeam Partners delivers reports encompassing all these elements and additionally offers a purple team workshop where findings are discussed with the internal team and remediation strategies are developed.
How to Prepare for a Penetration Test?
Good preparation maximises the value of a penetration test:
Before the Test
- Define scope: Which systems, networks, and applications should be tested?
- Set objectives: What should the test achieve? (Compliance, risk assessment, specific threat scenarios)
- Inform decision-makers: Notify relevant teams (IT, development, SOC) about the upcoming test.
- Provide access: Prepare test accounts, VPN access, and source code if applicable.
- Define exclusions: Systems that should not be tested (e.g., production systems with outage risk).
During the Test
- Maintain contacts: A technical contact should be reachable during the test.
- Monitor detection: Observe whether your security systems detect the test.
- Maintain communication: Regular status updates with the testing team.
After the Test
- Analyse report: Joint discussion of results with all decision-makers.
- Prioritise measures: Create a remediation plan based on risk assessment.
- Plan retest: Follow-up assessment of remediated vulnerabilities within 90 days.
Penetration Test vs. Vulnerability Scan: What Is the Difference?
| Criterion | Vulnerability Scan | Penetration Test |
|---|---|---|
| Approach | Automated | Manual + automated |
| Depth | Surface-level | In-depth |
| False Positives | High (30–40%) | Low (<5%) |
| Cost | CHF 500–3,000 | CHF 5,000–50,000 |
| Duration | Hours | Days to weeks |
| Logical Vulnerabilities | Not detectable | Detectable |
| Business Logic Flaws | Not detectable | Detectable |
| Compliance | Partially sufficient | Fully sufficient |
A vulnerability scan is a valuable tool for regular monitoring but cannot replace a professional penetration test. The best security programmes combine both approaches.
Industry-Specific Penetration Testing Requirements in Switzerland
Financial Services
FINMA requires supervised institutions to conduct regular security assessments. TIBER-CH-compliant red team tests are mandatory for systemically important banks. Penetration tests must meet the requirements of FINMA Circular 2023/1 “Operational Risks and Resilience”.
Healthcare
Swiss healthcare is subject to strict data protection requirements (nDSG, cantonal law). Penetration tests of systems processing patient data require particular care and must ensure the availability of critical systems.
Technology and SaaS
SaaS providers must regularly present pentest reports to their clients. SOC 2 Type II and ISO 27001 certifications require demonstrable security testing.
For industry-specific advice, visit CybersecuritySwitzerland, our information portal for cybersecurity in Switzerland.
Conclusion: Finding the Right Pentest Provider in Switzerland
Choosing the right penetration testing provider is an important decision for your organisation’s security. Our analysis shows that RedTeam Partners holds a leading position in the Swiss market through its CREST accreditation, high tester qualifications, and detailed reporting.
For organisations seeking maximum quality and reliability, RedTeam Partners is the top choice. For cost-conscious SMEs, providers such as Terreactive or Adversis offer good entry-level options.
Our tip: Obtain quotes from at least three providers and pay particular attention to the qualifications of individual testers, not just the company name.
Last updated: January 2026. All prices in CHF, excluding VAT. Ratings are based on certifications, client feedback, methodology, and value for money.