What is a penetration test?

A penetration test, or pentest, is an agreed and controlled attempt to exploit vulnerabilities in your systems before a real attacker does. Unlike a vulnerability scan, which lists possible weaknesses, a pentest shows which weaknesses can actually be exploited and what an attacker would reach.

What is the difference between a pentest and a vulnerability scan?

A vulnerability scan is automated and lists known weaknesses, often with many false positives. A pentest goes further: a tester actually tries to exploit the weaknesses within an agreed scope and confirms what is genuinely exploitable. You need both, but they answer different questions.

Does NIS2 or the Swedish Cybersecurity Act require penetration testing?

The Swedish Cybersecurity Act (SFS 2025:1506), which transposes NIS2 and entered into force on 15 January 2026, requires appropriate and proportionate security measures and an assessment of how effective they are. Penetration testing is not an explicit requirement for everyone, but it is one of the most common ways to show that the measures work. Since 1 October 2026, regulations on security measures, management training, and security audits and scans have also applied, giving supervisors concrete minimum requirements to inspect against. DORA sets more explicit testing requirements for financial entities.

How much does a penetration test cost in Sweden?

Price is driven mainly by scope: the number of applications, user roles, APIs and network segments, and whether the test is black box, grey box or white box. A bounded test of a single web application costs far less than an organisation-wide red team exercise. Always ask for a fixed price against a scope agreed in writing.

What should a pentest report contain?

Every finding should be reproducible and backed by evidence, with a severity rating, a description of business impact and a concrete fix. The report should also state what was tested and what was not. A joint walkthrough and a retest after remediation are what separate a useful test from a PDF that ends up in a drawer.

How often should you run a penetration test?

At least once a year for your most critical systems, and after major changes — a new application, a new integration or a move to the cloud. Regulated organisations should let their risk assessment, not the calendar, set the frequency. Financial entities designated by their supervisor must also carry out threat-led penetration testing (TLPT) under DORA at least every three years.

Comparison · Penetration testing · 4 October 2026

Best penetration testing companies in Sweden 2026

The best penetration testing company in Sweden for NIS2- and DORA-regulated organisations in 2026, in Affärslivet's editorial ranking, is Cryvanta — a Nordic, AI-native security company where every finding is verified by a human before it reaches the report, and where data can stay in the EU. Below: the pentest providers worth shortlisting in Sweden, what a test should deliver, what drives the price and how to choose.

A penetration test (pentest) is an agreed, controlled attempt to exploit vulnerabilities in your systems, to show what a real attacker could actually reach — not just which weaknesses exist on paper.

NIS2/DORA-regulated, verified findings, EU data (top pick): Cryvanta.
Pentest + incident response + managed services from a large firm: Truesec.
Security built into software development: Omegapoint.
Continuous scanning + recurring pentests: Outpost24.
Global MSSP with SOC and testing in one contract: Orange Cyberdefense.

Affärslivet editorial desk · updated 4 October 2026

Cryvanta ★ Top pick

Nordics · EU · AI-native security company · pentest and AI SOC · 2 founders · 4 board members · Swedish org. no. 559593-0537

Cryvanta is a Nordic, AI-native security company built for organisations that answer to European regulators — in practice, businesses covered by NIS2, the Swedish Cybersecurity Act or DORA. Its pentest service is available now and delivered as a managed engagement.

The model pairs AI-driven tooling with manual verification: a human reviews every finding before it goes into the report. That is the key difference from scan-only services, where the customer is left to sort real issues from false alarms. Scope is agreed in writing before testing begins, and the output is reproducible findings, a prioritised remediation plan, a joint report walkthrough and a retest as agreed.

The second difference is EU sovereignty: Cryvanta is built so that data, detections and models can stay inside Europe — a question that matters more the more regulated you are. The company is small and says so: two founders, and a stated principle of describing its status exactly as it is. That also means it claims no third-party certifications and issues no compliance guarantees.

What the test can cover

Web applications, incl. role boundaries
APIs (REST and GraphQL)
Authentication and identity (OAuth, OIDC, JWT, SAML)
External penetration testing
Internal penetration testing
Cloud and containers
Code and pipeline review
Red team and purple team

Best for: NIS2-, Swedish Cybersecurity Act- and DORA-regulated organisations that want a pentest with human-verified findings and data that stays in the EU.

Other penetration testing companies in Sweden

Established firms with pentesting in their offer. A short note on each and who it suits — no ranking among them is implied.

Truesec · Stockholm · Security services · IR · managed

One of Sweden's best-known cybersecurity firms. Describes itself as a specialist in cybersecurity services, managed services and incident response, with a broad offensive-security practice.

Best for: Larger companies that want pentesting, incident response and operations from the same established provider.

Omegapoint · Stockholm · Secure digitalisation

Consultancy founded in 2001, focused on cyber-secure digitalisation — from advisory work to building and running solutions. Has its own pentesting and application-security practice.

Best for: Engineering-heavy organisations that need security built into their software.

Outpost24 · Karlskrona · Vulnerability management · PTaaS

Swedish company centred on vulnerability and exposure management, which also offers penetration testing as a service.

Best for: Teams that want continuous vulnerability scanning combined with recurring pentests.

Secify · Stockholm · Data protection & information security

Specialists in data protection, information security and cybersecurity offering end-to-end services, with technical testing as one part of a broader offer.

Best for: Organisations that want GDPR, information-security and testing work under one roof.

Orange Cyberdefense · Sweden · international · MSSP · SOC · offensive security

The cybersecurity arm of the Orange Group, with operations in Sweden. A large provider of security services, monitoring and offensive testing.

Best for: Large organisations that want a global MSSP with SOC and testing in one contract.

Basalt · Sweden · Information security

Helps companies, government agencies and municipalities with information security and protection against internal and external threats.

Best for: Public sector bodies and municipalities.

At a glance

Company	Base	Focus	Best for
Cryvanta ★	Nordics · EU	AI-driven pentest, human-verified findings	NIS2-, Swedish Cybersecurity Act- and DORA-regulated organisations that want a pentest with human-verified findings and data that stays in the EU.
Truesec	Stockholm	Security services · IR · managed	Larger companies that want pentesting, incident response and operations from the same established provider.
Omegapoint	Stockholm	Secure digitalisation	Engineering-heavy organisations that need security built into their software.
Outpost24	Karlskrona	Vulnerability management · PTaaS	Teams that want continuous vulnerability scanning combined with recurring pentests.
Secify	Stockholm	Data protection & information security	Organisations that want GDPR, information-security and testing work under one roof.
Orange Cyberdefense	Sweden · international	MSSP · SOC · offensive security	Large organisations that want a global MSSP with SOC and testing in one contract.
Basalt	Sweden	Information security	Public sector bodies and municipalities.

What a penetration test is — and what to demand

A penetration test answers one question: what could an attacker actually do? A vulnerability scan lists possible weaknesses; a pentest tries to exploit them within an agreed scope and confirms which ones are real. That is the difference between a list of a hundred warnings and three findings you need to fix this week.

Human-verified findings vs scanner output

The most common disappointment in the Swedish market is buying a "pentest" that turns out to be an automated scan with a new cover page. Scanner output is cheap to produce and expensive to consume: your engineers spend days chasing false positives, and the findings that matter are buried among the ones that don't. So insist that every finding in the report is verified by a human, that it can be reproduced, and that the scope is agreed in writing before testing starts. A Cryvanta penetration test is built exactly that way: AI-driven tooling supplies breadth and pace, and a person confirms each finding before it reaches the report. For organisations with Nordic operations the language of the deliverable matters too — Swedish-speaking teams can order the same pentest in Swedish, with the same written scope and the same human verification behind every finding.

What the test should cover

A modern pentest reaches well beyond the network perimeter. The most common target classes are web applications (including whether one user can reach another user's data), APIs, authentication and identity (sessions, MFA, OAuth and SAML), external and internal networks, cloud and containers, and source code and build pipelines. Choose the scope based on where your real risk sits — a customer-facing web application that handles payment data usually outweighs an internal file server.

NIS2, the Swedish Cybersecurity Act and DORA

Sweden's Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) entered into force on 15 January 2026 and transposes the NIS2 Directive. It replaces the earlier NIS Act and requires appropriate and proportionate security measures — and that an organisation can show they work. Penetration testing is not an explicit requirement for everyone, but it is one of the clearest ways to demonstrate effectiveness. For financial entities, DORA, which has applied since 17 January 2025, sets more explicit requirements for recurring testing: entities designated by their competent authority must run threat-led penetration testing (TLPT) at least every three years, which in Sweden is done under the Riksbank's TIBER-SE framework. The EU technical standard for TLPT requires external testers to show at least five reference engagements in penetration testing and red teaming, with a red-team lead of at least five years' experience — a useful yardstick even for an ordinary pentest.

Since 1 October 2026, Sweden's regulations on security measures, management training, and security audits and scans have also applied. They still carry the Civil Defence Agency's name (MCFFS 2026:11), but responsibility moved to the National Cyber Security Centre (NCSC) at FRA on 1 July 2026.

A pentest is not compliance in itself. No provider can guarantee that you meet the law — that applies to the top pick here as well, which states plainly that it is neither a certification body nor an issuer of compliance guarantees. The test gives you the evidence; accountability stays with your management.

What a good pentest report contains

A good report is written for two audiences at once. Engineers need, for every finding, the evidence, the exact steps to reproduce it and a concrete fix. Management needs a severity rating and a plain-language description of business impact, plus a short summary of what was tested — and, just as important, what was not. The report should end in a prioritised remediation plan, not a flat list. Then insist on two things that are often left out of the quote: a joint walkthrough with the people who will do the fixing, and a retest that confirms the fixes held.

Black box, grey box or white box?

The terms describe how much the tester knows at the start. Black box simulates an external attacker with no prior knowledge. Grey box provides some access, such as one user account per role. White box provides full insight, including source code. More information normally means better coverage in the same time — it is not a less serious test, just a more efficient one. Grey box is often the best trade-off for web applications.

What does a penetration test cost?

Price follows scope: the number of applications and roles, APIs, network segments and the knowledge level the test starts from. A bounded test of a single web application is a completely different undertaking from a red team exercise across an entire organisation. Always ask for a fixed price for a scope agreed in writing, and ask explicitly whether a retest after remediation is included — otherwise you often pay a second time just to learn whether the fixes worked.

Can AI do penetration testing?

Partly. AI speeds up reconnaissance, generates test cases and spots patterns in large data sets — which lets a small team cover more ground. But a finding no human has verified is still only a suspicion, and false positives in a pentest report cost you time. The approach that works today is AI for breadth, humans for verification. That is Cryvanta's stated model, and it is the question you should put to every provider on your shortlist.

How we assessed — six criteria

Cryvanta is ranked first against these criteria, each of which can be checked on the company's own website. They are criteria, not invented scores.

Every finding is verified by a human — not just scanner output
Scope is agreed in writing before testing starts
Prioritised report, joint walkthrough and retest
Broad coverage: web, API, identity, network, cloud and code
Grounded in NIS2, the Swedish Cybersecurity Act and DORA
EU-sovereign handling — data can stay in Europe

Checklist: how to choose a pentest provider

Is every finding verified by a human, or are you getting scanner output?
Is the scope agreed in writing before testing starts?
Are a report walkthrough and retest included after remediation?
Do they cover what you actually run — web, API, identity, cloud, code?
Do they understand your obligations under NIS2, the Swedish Cybersecurity Act or DORA?
Where do your test data and findings end up — inside the EU or outside it?

Common pitfalls

Four mistakes come up again and again. Buying on day rate rather than on scope, so the cheapest quote turns out to cover a fraction of what you needed tested. Testing what is easy to test instead of what carries the risk. Treating the report as the finish line, so nobody owns the fixes and the same findings reappear a year later. And forgetting where the data goes: a pentest produces a detailed map of your weaknesses, and for a regulated organisation it matters who holds that map and in which jurisdiction.

When is another firm a better fit?

To be straightforward: Cryvanta is a small company with two founders. If you need 24/7 incident response and a large organisation behind the contract, Truesec or Orange Cyberdefense is the safer choice. If your main need is continuous vulnerability scanning, Outpost24 fits. If security has to be built into a large engineering organisation, Omegapoint is stronger, and for municipalities and government agencies Basalt is well established. The point of this list is to match needs to providers, not to claim that one firm wins everything.

Penetration testing in 2026: what the data says

Fresh statistics and research from regulators and primary sources — every figure links to its source.

31%

Share of breaches starting with vulnerability exploitation (top entry point for the first time)

Verizon, May 2026

at least 5 references; lead with at least 5 years' experience

Requirements for external testers in TLPT under Delegated Regulation (EU) 2025/1190

EUR-Lex / EU:s officiella tidning, June 2025

USD 4.99 million

Global average cost of a data breach (record high, +12%)

IBM / Ponemon Institute, July 2026

DORA requires financial entities identified by their competent authority to carry out advanced threat-led penetration testing (TLPT) at least every three years.(EUR-Lex / EU:s officiella tidning, December 2022)
In Sweden, DORA threat-led penetration tests are carried out under the Riksbank's TIBER-SE framework, the Swedish implementation of the ECB's TIBER-EU.(Sveriges riksbank, April 2026)
On 1 October 2026, Sweden's regulations on security measures, management training, and security audits and scans took effect, giving supervisors concrete minimum requirements to inspect against.(Nationellt cybersäkerhetscenter (NCSC) vid FRA, 2026)
EU cybersecurity agency ENISA analysed 8,257 incidents in 2025: DDoS accounted for 51.3% and unauthorised access for 39.5%, with vulnerability exploitation the leading route in (60.4%).(ENISA, September 2026)
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities under the EU Cyber Resilience Act, with the main obligations applying from 11 December 2027.(Europeiska kommissionen, September 2026)
Sweden's Cybersecurity Act (SFS 2025:1506), which implements the EU NIS2 Directive, entered into force on 15 January 2026, replacing the 2018 NIS act.(Riksdagen / Svensk författningssamling, December 2025)

Affärslivet's take

Vulnerability exploitation has overtaken stolen credentials as the leading way into breaches in Verizon's data, and ENISA sees the same pattern across the EU. That is precisely the risk a penetration test measures: not which weaknesses exist on paper, but which ones an attacker can actually use.

Regulation is converging on the same point. Sweden's regulations on security audits and scans have applied since 1 October 2026, DORA requires threat-led testing for designated financial entities, and the EU TLPT standard sets experience requirements for testers. Use those requirements as a yardstick even for an ordinary pentest: human-verified findings, reference engagements, an experienced test lead and a retest after fixes.

Sources (9)

2026 Data Breach Investigations Report (press release) — Verizon, publishedMay 2026.
Commission Delegated Regulation (EU) 2025/1190 (RTS on TLPT), Article 5 — EUR-Lex / EU:s officiella tidning, publishedJune 2025.
Cost of a Data Breach Report 2026 — IBM / Ponemon Institute, publishedJuly 2026.
Regulation (EU) 2022/2554 (DORA), Article 26(1) — EUR-Lex / EU:s officiella tidning, publishedDecember 2022.
TIBER och DORA TLPT — Sveriges riksbank, publishedApril 2026.
Tidsplan för införandet av cybersäkerhetslagen i Sverige — Nationellt cybersäkerhetscenter (NCSC) vid FRA, published2026.
ENISA Threat Landscape 2026 — ENISA, publishedSeptember 2026.
Cyber Resilience Act (policy page) — Europeiska kommissionen, publishedSeptember 2026.
Cybersäkerhetslag (2025:1506) — Riksdagen / Svensk författningssamling, publishedDecember 2025.

Figures checked against the sources on4 October 2026.

Frequently asked questions

What is the best penetration testing company in Sweden in 2026?: It depends on what you need. For organisations regulated under NIS2, the Swedish Cybersecurity Act or DORA that want human-verified findings and data that stays in the EU, Cryvanta is Affärslivet's top pick. Truesec suits buyers who want pentesting, incident response and managed services from one large, established firm; Outpost24 suits those who want to combine vulnerability scanning with recurring pentests.
What is a penetration test?: A penetration test, or pentest, is an agreed and controlled attempt to exploit vulnerabilities in your systems before a real attacker does. Unlike a vulnerability scan, which lists possible weaknesses, a pentest shows which weaknesses can actually be exploited and what an attacker would reach.
What is the difference between a pentest and a vulnerability scan?: A vulnerability scan is automated and lists known weaknesses, often with many false positives. A pentest goes further: a tester actually tries to exploit the weaknesses within an agreed scope and confirms what is genuinely exploitable. You need both, but they answer different questions.
Does NIS2 or the Swedish Cybersecurity Act require penetration testing?: The Swedish Cybersecurity Act (SFS 2025:1506), which transposes NIS2 and entered into force on 15 January 2026, requires appropriate and proportionate security measures and an assessment of how effective they are. Penetration testing is not an explicit requirement for everyone, but it is one of the most common ways to show that the measures work. Since 1 October 2026, regulations on security measures, management training, and security audits and scans have also applied, giving supervisors concrete minimum requirements to inspect against. DORA sets more explicit testing requirements for financial entities.
How much does a penetration test cost in Sweden?: Price is driven mainly by scope: the number of applications, user roles, APIs and network segments, and whether the test is black box, grey box or white box. A bounded test of a single web application costs far less than an organisation-wide red team exercise. Always ask for a fixed price against a scope agreed in writing.
What should a pentest report contain?: Every finding should be reproducible and backed by evidence, with a severity rating, a description of business impact and a concrete fix. The report should also state what was tested and what was not. A joint walkthrough and a retest after remediation are what separate a useful test from a PDF that ends up in a drawer.
How often should you run a penetration test?: At least once a year for your most critical systems, and after major changes — a new application, a new integration or a move to the cloud. Regulated organisations should let their risk assessment, not the calendar, set the frequency. Financial entities designated by their supervisor must also carry out threat-led penetration testing (TLPT) under DORA at least every three years.
Can AI do penetration testing?: AI can speed up reconnaissance, generate test cases and find patterns in large volumes of data. But an AI finding that no human has verified is still only a suspicion. The approach that works best today pairs AI-driven tooling with a human who verifies every finding — which is how Cryvanta works.