Cybersecurity consulting firms

Global testing and certification firm, recognised by the PCI SSC for PTS POI and HSM evaluation, with labs in the UK and China.

IBM is a technology company that sells software, infrastructure, and consulting services.

Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.

Inspection firm that audits carmakers' security management for R155 type approval and certifies suppliers to ISO/SAE 21434.

German inspection group assessing vehicles and makers against UN R155, R156, ISO/SAE 21434 and ISO 24089.

GMV Innovating Solutions is a technology group that provides solutions, services and products across many sectors.

Vector Informatik provides software, hardware and services for building, testing and operating software-defined systems.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

CREST and CHECK-accredited European managed services provider delivering penetration testing with deep infrastructure and cloud hosting expertise.

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

Australia and New Zealand's largest pure-play cybersecurity firm with offices in every major ANZ capital. CREST ANZ accredited and IRAP-listed for Australian Government testing.

US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise.

The only organisation worldwide with a full suite of CREST accreditations. 250+ cybersecurity specialists operating in 55+ countries across pen testing, red teaming, and incident response.

Global cybersecurity consultancy with CREST, CHECK, and CBEST accreditation, renowned for deep technical research and penetration testing services.

London-based cybersecurity provider, now part of Kroll, delivering CREST-accredited penetration testing, managed detection and response, and incident response with a 550-strong cyber team.

Airbus group cybersecurity consultancy with ANSSI PASSI qualification. Aerospace, defence, and critical infrastructure penetration testing across Europe.

Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.

Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.

Miami-based cybersecurity firm with 300+ employees and deep healthcare/HIPAA expertise. Delivering pen testing since 2000.

Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.

UK compliance and cybersecurity consultancy, formerly IT Governance, offering CREST and NCSC CHECK penetration testing alongside governance, risk and compliance services.

Jones IT provides managed IT services, cybersecurity, and compliance support to businesses in the San Francisco Bay Area.

Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.

Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.

Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.

CREST-accredited Canadian pen testing firm with a 95% manual-first approach. All testers hold OSCP minimum certification. Zero false positive guarantee.

The UK's largest independent security testing firm, renowned for IoT/OT research, CBEST red teaming, and CHECK/CREST-accredited penetration testing across all sectors.

US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with external, internal, web application, wireless and PCI DSS penetration testing plus CMMC Level 1 and 2 readiness work.

Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.

Poland's longest-running independent pen testing firm with 50+ consultants. Specialises in application security, cloud testing, and red teaming.

Australian CREST-accredited cybersecurity consultancy formed from the 2021 Privasec, Naviro, AvertRo, and Theta merger. Risk-led offensive security with strong APRA and Essential Eight programme work.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

Swiss cybersecurity firm with major Singapore operation. CREST accredited, CSA-licensed in Singapore. Manual exploitation focus with the proprietary MAD reporting platform.

CREST-accredited UK cyber security and data protection consultancy offering penetration testing, ISO consultancy, and managed SOC services from offices across the UK and Ireland.

Ethical hacking team within Orange Cyberdefense with a 20+ year track record. Known for building industry-standard security tools and groundbreaking research.

Adversary-focused security firm created by former DoD red team operators. Creators of BloodHound. CREST-accredited for penetration testing, red teaming, and purple team assessments.

InterIntra is an Australian managed IT and cyber security provider.

CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.

Community-driven penetration testing firm known for free security education, open-source tools, Wild West Hackin' Fest, and practical offensive security services.

Toronto-based CREST-certified pen testing firm focused on Canadian financial services. OSCP and OSEP certified testers; OSFI, PCI DSS, and SOC 2 specialism.

Dubai-based cybersecurity firm providing pen testing and security consulting across the GCC with expertise in critical infrastructure.

CREST-accredited Birmingham-based cyber security consultancy delivering penetration testing, social engineering assessments, and Cyber Essentials certification for public and private sector clients.

Mexico-based cybersecurity firm delivering pen testing services across Latin America with international standards alignment.

Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.

Top 10-ranked US pen testing firm with proprietary Real Time Dynamic Testing methodology. Three-tier service model from standard to maximum-depth custom testing.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments.

CREST-certified and PCI QSA penetration testing consultancy in London, delivering offensive security and compliance services across 25+ countries with research-driven expertise.

Award-winning Cheltenham-based cybersecurity consultancy with NCSC CHECK Green Light status and CREST approval, specialising in defence, government, and critical national infrastructure security.

Manchester-based independent cybersecurity consultancy with over 20 years of experience delivering CREST and CHECK-accredited penetration testing, red teaming, and compliance certification services.

UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.

Award-winning CREST-certified managed cyber security and IT support provider with offices in Bristol, London, and Manchester, specialising in penetration testing and Microsoft security technologies.

Johannesburg-based infosec consultancy operating since 2002. One of Africa's oldest pen testing firms with deep technical expertise.

Italian cybersecurity group that absorbed Swascan, offering offensive security and vulnerability assessment through its Cyber Competence Center.

Berlin-based web, browser, and cryptography auditors founded by Dr. Mario Heiderich, trusted by ExpressVPN, NordVPN, 1Password, and Bitwarden.

CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.

CREST-accredited information security and GRC consulting firm near Dallas. Pairs full-scope penetration testing with governance, risk, and compliance advisory and security training.

Potenza Services is a veteran-owned firm based in Tampa, Florida, founded in 2012.

Boutique UK penetration testing consultancy in Milton Keynes specialising in manual, expert-led security assessments across web applications, APIs, cloud, and mobile platforms.

Israeli-headquartered global cybersecurity consultancy with a UK presence, specialising in penetration testing and TIBER-EU red team exercises for Fortune 500 companies.

CREST-accredited UK penetration testing consultancy based in Shropshire, delivering web application, API, infrastructure, cloud, mobile, and AI/LLM testing. A small specialist team, with a retest included in every engagement.

CREST-accredited Manchester-based cyber security firm delivering penetration testing, managed security services, and compliance consultancy across the UK, Europe, and the USA.

Alcott Enterprises is a managed IT service provider and cybersecurity company based in Los Angeles.

altaniche is a security practice that helps organisations adopt AI safely.

Alvor provides a security architecture management and compliance platform.

AppGate provides zero trust network access and fraud protection software for enterprises and government agencies.

Gothenburg consultancy testing ECUs, vehicle buses, telematics and OTA pipelines, and advising on R155 and ISO 21434.

Employee-owned research firm testing embedded systems, including vehicle infotainment, telematics units and CAN networks.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

BARR Advisory helps organisations establish, manage, and audit cybersecurity and compliance programmes.

BeforeCrypt is a ransomware recovery and incident response provider.

Detroit firm offering a vehicle security engineering platform alongside automotive penetration testing and defensive security services.

Bondgate IT is a managed service provider founded in 1998.

ISO/IEC 27001 certification audits and information security training from the UK national standards body, which also certifies quality, safety and medical devices.

UK security consultancy doing threat modelling, training and research for connected vehicles, IoT and mobile products.

Cyberhaven provides a data security platform that traces data lineage to protect information across human and AI workflows.

Cybertrust is a Japanese company that provides trust services and security products.

cycura provides Microsoft tenant security consulting and managed security services for businesses.

Decurity is a web3 security firm based in Dubai.

DEFION Security is an independent security partner that has operated since 2005.

DEKRA is a global provider of testing, inspection and certification services.

Computer and IT infrastructure maker whose PowerProtect Data Manager software and Data Domain appliances back up data, detect ransomware and speed recovery.

Cyber advisory and managed security services, including managed extended detection and response, cloud security, digital identity and threat intelligence, from a global professional services network.

Makes automated ECU and vehicle security test tools and hardware, and carries out automotive penetration testing.

Bosch subsidiary selling ESCRYPT HSM firmware, intrusion detection, risk analysis tools and a managed vehicle SOC.

Exclusive Networks is a global cybersecurity specialist that distributes and supports security solutions through partners.

Korean supplier of ECU security software, security gateways, TARA, testing and R155 and 21434 consulting.

Engineering services group whose FEV.io arm runs TARA, ISO 21434 work, secure lab testing and vehicle pentests.

Forefront IT Security Services presents itself as a virtual cyber security team for organisations in the United Kingdom.

Gtd is a technology and telecommunications company with an international presence across seven countries.

Heelr is a marketplace connecting organisations with verified cybersecurity professionals and providers.

Hexens audits smart contracts and provides offensive security for blockchain and Web3 projects.

UK vehicle engineering and test centre offering threat modelling, CSMS support and security testing for vehicles.

Beijing supplier of vehicle security gateways, intrusion detection, HSM firmware, a vehicle SOC platform and compliance consulting.

Infysec provides cyber security services, training, and research and development.

Integris provides managed IT, cybersecurity, AI and cloud services to small and midsize businesses.

Testing and certification group that helps vehicle makers and suppliers work towards ISO/SAE 21434 compliance.

Johanson Group is a CPA firm providing security and compliance audits.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

LDL Security is a Brazilian cybersecurity company that specialises in penetration testing, red team exercises and compliance.

US engineering consultancy offering ISO 21434 consulting, TARA, security verification and automotive cybersecurity training.

Lorikeet Security provides penetration testing, incident response, and security leadership services.

MDP Data Protection sells a compliance platform called Simply and a method called the Continuous Compliance Operating System (CCOS).

MDSI is an IT services company based in La Réunion.

Tokyo firm assessing vehicle ECUs and connected services, with automotive security consulting, PSIRT support and training.

Netrio provides managed IT, cybersecurity, cloud, and connectivity services to mid-market enterprises.

Provides managed IT support, cybersecurity services and custom software to small businesses.

nFlo is a Polish technology company based in Warsaw.

nuHarbor provides cybersecurity services and managed security operations to organisations across government, healthcare, finance and enterprise.

Ontinue provides managed detection and response services for Microsoft security customers.

German Cyber Resilience Act compliance and embedded security specialist. 16+ years in IoT and embedded Linux, delivering CRA readiness, compliance engineering, and legal certification for products with digital elements.

Paris research firm auditing ECUs, ADAS, in-vehicle networks and OTA updates, and selling software protection for ECU firmware.

Open source software company whose Advanced Cluster Security product protects Kubernetes and container workloads, alongside Red Hat Enterprise Linux and OpenShift.

RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams.

Reversec provides cybersecurity consulting services, including penetration testing and resilience development.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

UK automotive consultancy that runs vehicle penetration tests, threat assessments and anti-theft testing for carmakers.

SecureNET Systems provides IT outsourcing and cybersecurity services to small and medium businesses in Bucharest and Ilfov.

Dutch security evaluation lab, part of SGS, recognised by the PCI SSC for PTS device evaluation and accredited for EMVCo and Common Criteria.

Sherlock provides security audits and bug bounties for onchain systems and Web3 protocols.

SIBERLOCK is a cybersecurity and consultancy firm based in Turkey.

German security lab in Bonn, recognised by the PCI SSC for PTS device evaluation, plus German payment terminal schemes.

Sygnia provides cyber incident response, readiness, and managed detection and response services to enterprises worldwide.

TestPros is an independent IT compliance firm that has been testing since 1988.

Web-based software that automates vehicle threat analysis and risk assessment, plus vulnerability tracking and consulting.

Provides managed IT services including security, cloud desktops, networks and AI deployment support.

Z-JAK Technologies is a Louisville-based provider of managed IT and cybersecurity services for small and midsize businesses, typically with 5 to 150 employees.

Athena Agentic provides a unified cyber operations platform that automates detection, response, and hardening.

Korean supplier of in-vehicle security software, V2X and Plug&Charge PKI, security testing tools and R155 consulting.

Indian consultancy helping vehicle makers gain UN R155, R156 and AIS-189 approval, with TARA tools and penetration testing.

Cloudrise provides security services to enterprises and technology partners.

COSIC provides expertise in digital security and industrial cryptography, conducting research and education.

Indian firm offering vehicle and ECU penetration testing, R155 and 21434 consulting, plus a vehicle SOC.

IRONVALD provides autonomous cybersecurity defence for critical infrastructure and industrial control systems.

Littlefish provides managed IT services, cyber security, digital solutions, and data and AI services to organisations.

Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud.

Cybersecurity consulting, transformation and managed security services covering risk and compliance, secure business enablement and cyber resilience, from a global IT services company.

Optiv advises, deploys, and operates cybersecurity programs for organizations.

Puma Security provides .NET static analysis tools and application security services.

Secvura reviews web and SaaS applications for security weaknesses and helps teams fix them.

Swiss testing and certification group offering security evaluations, penetration tests and ISO/SAE 21434 audits.

simler provides an AI platform for generating and running cybersecurity tabletop exercises.

System Force IT provides managed IT support, cyber security, and Microsoft 365 services to UK SMEs.

YSecurity provides an on-demand cybersecurity team for startups, handling compliance and security reviews.