Solutions by sector

Fintech, tech and SaaS, health, energy and industrial. Every sector faces the same question in its own language: what would a real attacker do to us?

Fintech Pentesting and red team for banks, fintechs and payment firms: protect payments, APIs and customer data, with evidence for PCI DSS and DORA. View sector
Tech & SaaS Penetration testing for SaaS and tech companies: protect customer data, and get the evidence for SOC 2, ISO 27001 and security questionnaires. View sector
Health Penetration testing for hospitals, clinics and health-tech, done without disrupting care. Protect patient data and care continuity. View sector
Energy & Industrial Penetration testing for energy, utilities and industry, without touching live operations. Secure the path from IT to your OT systems. View sector

Frequently asked questions

What people ask us before the first call.

What changes is who you are measured against and what you have to prove. Whoever attacks a fintech is not after the same thing as whoever attacks an industrial plant, and their auditors do not ask for the same thing either. What changes is the scenario being simulated, which assets are treated as critical, and the format the evidence is delivered in. The technical work underneath is the same.

No. Fintech, tech and SaaS, health, and energy and industry are where most of the work has been done, not an admissions list. If your sector is not there, the useful starting point is the service rather than the sector: tell us what you want tested and on what.

It depends on the specific entity and not only on the sector, and the one who determines it is your competent authority. That is why you will not find a table here telling you what applies to you: it would be false. What there is instead is a page per standard for ENS, ISO 27001 and GDPR, plus the glossary, where NIS2 and DORA are explained without going into deadlines or articles. With your case in front of us, we look at it with you.

From whichever your question is clearer about. The sector page is for seeing what gets tested in your context and in what order of priority. The service page is for seeing what the work looks like from the inside. Both end up in the same place, so you cannot pick the wrong door.

It is the norm as soon as a company grows: a fintech that also sells its platform as SaaS, or an industrial manufacturer with its own customer portal. In that case the asset rules, not the org chart. It is ordered by where the data that hurts most to lose sits, and by which part gets you there fastest, which is almost never the part you would expect. Tell us both halves and we prioritise it with you.

Get your questions answered

A 30 minute session with our team to understand your situation, answer your questions and define the scope of what you need.

Book a session

Tell us about your project

Fields marked with * are required.

Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.