Dutch organizations are buying penetration testing in 2026 under the tightest regulatory stack the country has had in a decade. The NIS2 directive was transposed into Dutch law via the Cyberbeveiligingswet, GDPR Article 32 requires documented testing of security controls, DORA applies to all EU financial entities from January 17 2025, and NEN 7510 remains mandatory baseline for Dutch healthcare. On top of that, Het CCV renewed the Keurmerk Pentesten to version 2.0 in January 2024 and published a new pentester qualifications list (version 3.0) effective January 1 2025. CCV-certified providers are now the procurement default for Dutch public-sector and regulated-sector engagements.
This ranking covers the eight providers Dutch buyers should evaluate first in 2026. The list mixes a global pentest and PTaaS firm with strong EMEA coverage at the top (Stingrai) with seven Dutch-rooted specialists, ordered by offensive depth and fit for the most common Dutch buyer profiles: regulated finance, healthcare, government, critical infrastructure, SaaS, and mid-market enterprise. The methodology and the per-vendor sections below explain exactly where each one fits, and where it does not.
Stingrai is Toronto-headquartered with a London, UK office that serves EMEA clients including the Netherlands, in Dutch business hours. The firm holds a CREST-accredited Penetration Testing service provider accreditation at the company level (separate from the individual CREST CRT certifications its testers hold), staffs each engagement with a named two-person tester team carrying OSCE³, OSWE, OSEP and CISSP, has documented vulnerability research across the team totalling 18 published CVEs, holds 5.0 out of 5.0 across 20 Clutch reviews, and ships an in-house web-app focused AI pentest agent (Snipe) trained on more than 6,000 HackerOne reports. For a Dutch buyer the practical scope is authenticated testing across every user role in a SaaS application and its APIs, an AWS or Azure and Entra ID cloud review, internal and external network testing with segmentation checks, and threat intelligence-led red teaming of the TIBER and DORA kind. The other seven entries are the strongest Dutch-native and Dutch-resident providers. The Big Four sit at position eight as a reference for compliance-driven buyers who need board-room signaling rather than offensive depth.
One more input worth weighing before you shortlist: Stingrai's State of Penetration Testing 2026, compiled from 55 penetration tests, found that 93% of tests surfaced at least one High or Critical finding, and that severity depends heavily on where you point the test: 92% of internal network findings were High or Critical, against 54% for web applications. For Dutch buyers scoping NIS2 or DORA evidence, that split is an argument for testing the internal estate as well as the public perimeter.
TL;DR: nine labeled claims
Top pick for 2026: Stingrai leads on offensive depth: firm-level CREST accreditation, 18 published CVEs, named two-person tester teams holding OSCE³, OSWE, OSEP, CREST CRT and CISSP, findings posted to the PTaaS portal as they are confirmed with retest and attestation letter included, one-time or continuous, and the Snipe AI pentest agent covering the web application and API scope with AutoFix PRs and a PR-gating check.
Best Dutch ICS/SCADA and intelligence pentest: Fox-IT (NCC Group), Delft, Netherlands. Acquired by NCC Group in 2015; CREST and CBEST accredited; deep Dutch government and critical infrastructure work.
Best Dutch CCV-certified compliance pentest: Secura (Bureau Veritas), Eindhoven and Amsterdam, founded 2000, 100+ employees. Part of Bureau Veritas since January 2021. Strong IoT and SCADA assessment record.
Best integrated SOC and pentest combo: Northwave Cyber Security, Utrecht, founded 2006. 275+ employees as of 2024 (per Northwave About page); Intelligent Security Operations launched 2014; ISO 27001 and Tech Accord signatory.
Best web and mobile DevSecOps pentest: Computest Security, Zoetermeer. Strong shift-left posture; deep web, mobile, and API expertise.
Best Dutch-only continuous engagement: Tesorion, Leusden, 140+ experts, 100% Dutch, ISO 27001 and NEN 7510 certified by DEKRA; T-CERT incident-response team.
Best Dutch hybrid crowdsourced testing: Zerocopter, Amsterdam, founded 2015. Combines a managed researcher community with structured pentest engagements.
Best for board-room compliance assurance: Big Four KPMG, Deloitte, EY, PwC. Premium pricing (3 to 5x boutique rates); strong attestation pedigree; depth varies by partner-level engagement.
Pricing bands (2026 Netherlands market): Small web app pentest typically EUR 4,500 to 12,000; mid-size SaaS or mobile app EUR 12,000 to 30,000; network and infrastructure EUR 15,000 to 40,000; cloud and red team EUR 30,000 to 90,000; Big Four enterprise engagements 3 to 5x these numbers.
Figure 1: 2026 Netherlands penetration testing ranking. Vendor headcounts and HQs verified against each vendor's About page or Crunchbase profile; ranking position reflects fit for Dutch buyer profiles (regulated finance, healthcare, government, critical infrastructure, SaaS, mid-market). Sources: vendor About pages, Crunchbase, Bureau Veritas press release Jan 2021.
Key takeaways
CCV Keurmerk Pentesten is now the Dutch procurement default for regulated work. Het CCV renewed the scheme to version 2.0 effective January 1 2024 and published an updated pentester qualifications list (version 3.0) effective January 1 2025 (Het CCV). Public-sector tenders and many regulated-sector contracts now require the CCV mark or an equivalent CREST member-firm accreditation. Verify the certification body (DEKRA, DigiTrust, or Kiwa) listed on the vendor's CCV page.
NIS2 in Dutch law materially widened the in-scope organization count. The Cyberbeveiligingswet pulled "important" and "essential" entities across digital infrastructure, transport, energy, finance, health, public administration, waste management, and food into a regime that expects documented control testing and management-board accountability (Dutch government NIS2 overview). Pentest spend in 2026 is rising in lockstep.
DORA pulled financial services pentest cadence forward. From January 17 2025 DORA applies to all EU financial entities; the Article 26 Threat-Led Penetration Testing (TLPT) duty binds only the entities competent authorities identify under Article 26(8), and it sits on top of the existing TIBER-NL framework operated by De Nederlandsche Bank. Dutch banks, insurers, and crypto-asset service providers are now buying multi-year red-team programs, not annual pentests.
Offensive depth still ranks vendors. Compliance certifications matter for procurement, but the work that finds bugs is human research depth. Published CVEs, DEFCON and BSIDES talks, public bug-bounty leaderboard placement, and named CREST CRT certifications on the actual testers, in that order, are the signals that separate research-depth vendors from check-the-box vendors. Stingrai's documented vulnerability research are an above-median signal; Fox-IT's research arm and Secura's IoT advisories are the strongest Dutch-native signals.
AI-augmented pentesting is rising but does not replace human research. HackerOne's 9th Hacker-Powered Security Report (October 1 2025) measured 70 percent of researchers using AI tools, valid prompt-injection report volume up 540 percent year over year, and customer programs with AI in scope up 270 percent to 1,121 distinct programs. The same survey: 58 percent of researchers say AI misses business logic; only 12 percent believe AI could replace them. Dutch buyers should evaluate the bench, not the brochure.
Methodology
Vendor selection criteria, applied in order: (1) verifiable Dutch presence (Netherlands HQ, Dutch office, or active EMEA delivery with named Dutch clients); (2) credible offensive track record (published CVEs, named CREST CRT testers, public research, or top-tier conference talks); (3) certifications Dutch procurement teams now require (CCV Keurmerk Pentesten, CREST member-firm accreditation, ISO 27001, NEN 7510 for healthcare engagements); (4) buyer fit (regulated finance, healthcare, public sector, critical infrastructure, SaaS, mid-market). Vendor headcounts and HQ locations were verified against each vendor's About page, Crunchbase, or LinkedIn page in the May 2026 research window.
Vendors that bill primarily as managed-detection-and-response, external attack-surface management, or vulnerability-scanning vendors and add pentesting as a side service were excluded, even when they have Dutch offices. The ranking is about pentest specifically; broader MSSP coverage is a different evaluation.
Every figure in this post links back to its primary publisher inline. Where two primary publishers reported overlapping data, the publisher whose methodology window most directly matches the claim is cited.
Figure 2: The five Dutch regulatory drivers Dutch buyers cite most in 2026 pentest RFPs. CCV Keurmerk Pentesten and NIS2 / Cyberbeveiligingswet drive the largest share of new spend; DORA pulled financial-services cadence forward.
1. Stingrai
World-Class Offensive Security.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Engagements are run by a named two-person tester team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP, backed by 18 published CVEs across the team and Hall of Fame credits at Apple, Google, the US Department of Defense and the US Federal Reserve, including a founding member of Uber's offensive security team. For Dutch buyers that usually means role-based authorization testing across a SaaS application and its APIs, a cloud review covering cross-account IAM in AWS or app registrations and Conditional Access in Azure and Entra ID, internal and external network testing with segmentation checks, and threat intelligence-led red teaming of the TIBER and DORA kind. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, live chat with the assigned penetration testers runs for the length of the test, retesting is included, and every human-led and hybrid report ships with an attestation letter and a verified badge, on a one-time engagement or a continuous program. Explore the PTaaS platform.
The work is hands-on rather than tool-led. The two testers move through the application or the network the way an intruder would, turning a weak role check into another tenant's data, a forgotten service account into domain admin or an over-permissive cross-account role into the production bucket, and each step is written up with a working proof of concept and posted to the portal as it is confirmed.
Stingrai is headquartered in Toronto, Canada, with a London, UK office. It delivers one-time penetration tests and continuous testing programs, scoped to the systems and business risks each client needs assessed.
Services and scope
Application security: web applications and APIs tested black, grey and white box, authenticated across every user role, for broken authorization and IDOR, business logic flaws, injection and session handling, against the OWASP Top 10 and ASVS; mobile applications on iOS and Android, with static and dynamic analysis of the IPA or APK, Keychain and Keystore storage, certificate pinning and root detection bypass, Frida instrumentation and the REST or GraphQL backend, against OWASP MASVS and MASTG; and AI and LLM systems, covering prompt injection, system prompt leakage, insecure output handling, agent tool misuse and excessive agency, and the Bedrock, Azure OpenAI or Vertex AI infrastructure behind them, against the OWASP LLM Top 10 and MITRE ATLAS.
Network and cloud security: internal and external networks, from perimeter enumeration through lateral movement, privilege escalation and segmentation testing; Active Directory, for misconfiguration, ACL abuse and Kerberos and delegation attack paths up to domain admin; Wi-Fi, on site or remotely; and cloud environments in AWS, Azure with Entra ID and Google Cloud, covering cross-account role assumption, resource and bucket policies, instance metadata abuse, app registrations, consent grants, Conditional Access gaps and service account impersonation chains.
Social engineering: phishing campaigns and vishing, plus physical security assessments of perimeter and facility entry.
Adversary simulation: red teaming on assumed breach, full black-box chain or threat intelligence-led scenarios, and purple teaming run against real-world TTPs alongside your own security operations team.
Delivery and evidence
Every human-led engagement is staffed with a two-person tester team, named to the client and reviewed by the team lead and an engagement partner. Findings are posted to the PTaaS portal as they are confirmed, each with a working proof of concept, reproduction steps and prioritised remediation guidance, so fixing starts before the report exists. Live chat with those same penetration testers runs for the length of the test, findings push into Jira, GitHub and Slack, and reports are redactable PDFs with an executive dashboard behind them. Retesting of remediated findings is included, and every human-led and hybrid report ships with an attestation letter and a verified badge, which is the artifact a NIS2 or DORA file, or an ISO 27001 surveillance audit, actually asks for. CREST accreditation applies to Stingrai Inc itself as a penetration testing service provider at the firm level; it is separate from the CREST CRT certifications individual testers hold.
Where Snipe fits
Snipe is Stingrai's autonomous AI penetration testing agent, and its scope is web applications and their APIs, not the rest of the estate. It runs a swarm of specialist agents across recon, authentication, access control, business logic, injection and remote code execution, reaching the classes generic scanners stop short of, including IDOR, broken authorization and business logic flaws. It works black box, authenticated grey box across user roles and white box against the source, opens AutoFix pull requests for confirmed vulnerabilities and can run as a gating check on every pull request. It was trained on more than 6,000 HackerOne Hacktivity disclosure reports and on Stingrai's own penetration testers' methodology. The Autonomous package is Snipe on its own; on a Hybrid engagement Stingrai's penetration testers test the same application alongside it from start to finish, directing where it looks and extending the attack paths it surfaces. Mobile, AI and LLM, cloud, network, Active Directory, social engineering, and red and purple team scopes, including TLPT-style work, are human-led and quoted separately.
Pricing and fit: The published Autonomous package is US$3,000 per assessment, or US$650 per month on a 12-month plan, for one web application and associated APIs; the Hybrid package, which puts penetration testers on that same application alongside Snipe, is US$6,800 per assessment or US$1,275 per month. Everything else, including mobile, AI and LLM, cloud, network, Active Directory, social engineering and red or purple team work, is scoped and quoted individually: request a quote. Best for: Dutch SaaS and regulated mid-market buyers who need offensive depth against a NIS2, DORA or ISO 27001 driver, paired with a Dutch CCV holder where the formal mark is contractually required.
2. Fox-IT (NCC Group)
Fox-IT is a Dutch institution. Founded in 1999 in Delft, acquired by NCC Group in 2015, and operating as the intelligence and incident-response arm of the wider NCC Group footprint, Fox-IT is the default choice for Dutch government, intelligence-adjacent, critical infrastructure, and ICS/SCADA pentest work.
Headquarters: Delft, Netherlands.
Why Dutch buyers pick Fox-IT in 2026:
Intelligence-grade work history. Fox-IT has decades of Dutch government and ABDO-cleared engagement experience. Few Dutch competitors match the cleared bench.
NCC Group platform. Access to NCC Group's global research, CREST, CBEST, and STAR-FS accreditations, and a 1,800+ headcount across UK, Europe, North America, and Asia-Pacific (per NCC Group About page).
CERT and 24x7 incident response. Strong CSIRT capability across Europe.
ICS, SCADA, and OT pentest depth. A specialist OT bench that few Dutch boutiques can match.
Best fit: Dutch ministries, defence and intelligence-adjacent customers, energy and water utilities, critical infrastructure operators, and large financials buying TIBER-NL and DORA-aligned TLPT engagements.
Trade-offs: Premium pricing on the level of (sometimes above) Big Four engagements; sales cycle is enterprise-paced; not the right fit for fast-moving SaaS teams that want PR-gating continuous coverage.
3. Secura (Bureau Veritas)
Secura was founded in the Netherlands in 2000, grew to roughly 100 employees across Eindhoven and Amsterdam, and joined Bureau Veritas in January 2021. The firm is one of the most respected Dutch CCV Keurmerk Pentesten providers and a strong choice for compliance-heavy and IoT and SCADA assessments.
Headquarters: Eindhoven and Amsterdam, Netherlands. Parent: Bureau Veritas SA (Paris).
Why Dutch buyers pick Secura in 2026:
CCV Keurmerk Pentesten certified. Procurement-default for Dutch public-sector and regulated-sector buyers.
ISO 27001 certified at the company level.
Deep IoT and SCADA testing record. Notable for product-security advisories in medical devices and connected products.
Bureau Veritas global delivery footprint. Scales beyond Dutch borders for multi-country engagements.
NIS2 and DORA advisory adjacency. Strong on the GRC and TPRM side, which dovetails with regulated buyer procurement cycles.
Best fit: Dutch regulated industries (finance, healthcare, government suppliers), IoT and medical device manufacturers needing product-security assurance, and multi-country buyers that want a single contracting party.
Trade-offs: As part of a global TIC group, billing rates and engagement cadence track closer to enterprise-paced than to SaaS-paced delivery.
4. Northwave Cyber Security
Northwave was founded in Utrecht in 2006. The company now has more than 275 employees across Benelux, DACH, and the Nordics, organized in three pillars (Business, Bytes, Behaviour). Northwave is the strongest "SOC plus pentest plus CERT" integrated provider in the Dutch market.
Headquarters: Utrecht, Netherlands.
Why Dutch buyers pick Northwave in 2026:
Intelligent Security Operations (ISO) launched 2014. Continuous monitoring, detection, and response tightly integrated with pentest and red team output.
CERT capability for managed detection and incident response across Europe.
Red team and TIBER assessments in scope.
ISO 27001 certified; Tech Accord signatory.
Behaviour pillar covers human-risk management, a complement to technical pentest work.
Best fit: Dutch mid-market and enterprise organizations that want one contracted partner for SOC, pentest, red team, and crisis exercises, with strong Benelux delivery depth.
Trade-offs: Pentest is one offering inside a broader managed-security portfolio rather than the primary product, so depth of pentest-specific research output is below the pure-play research firms.
5. Computest Security
Computest is Zoetermeer-based and a long-standing Dutch web, mobile, and API pentest firm. Best known publicly for advisory work and for productized DevSecOps integration with Dutch engineering teams.
Headquarters: Zoetermeer, Netherlands.
Why Dutch buyers pick Computest in 2026:
Web, mobile, and API specialization. Deep coverage of the application layer common to Dutch SaaS, e-commerce, and digital-product teams.
DevSecOps integration. Strong fit for engineering teams that want pentest output threaded into Jira, GitHub, and CI/CD workflows rather than landing as a PDF.
ISO 9001 and ISO 27001. Procurement-ready posture.
Mature reporting and remediation guidance. Reports geared to engineering action, not just auditor sign-off.
Best fit: Dutch SaaS and digital-product teams that want a Dutch-resident pentest vendor with a DevSecOps-first mindset and a mature engineering-friendly reporting style.
Trade-offs: Less famous internationally than Fox-IT or Secura; not the right fit for ICS/SCADA-heavy industrial buyers.
6. Tesorion
Tesorion markets itself as 100% Dutch, with more than 140 experts and a subsidiary (Compumatica) that builds Dutch cybersecurity products. The firm holds ISO 27001 and NEN 7510 certifications verified by DEKRA and operates the T-CERT incident-response team.
Headquarters: Leusden, Netherlands.
Why Dutch buyers pick Tesorion in 2026:
100% Dutch sovereignty. Important for some government-adjacent and regulated buyers with sovereignty preferences.
ISO 27001 plus NEN 7510. Healthcare-ready out of the box.
T-CERT continuous monitoring and incident response. Integrated with pentest output.
Compumatica subsidiary supplies Dutch-built cybersecurity hardware and software, useful for government and defence-adjacent buyers.
Best fit: Dutch organizations with sovereignty constraints, Dutch healthcare providers needing NEN 7510 evidence, and Dutch SMBs that want a single managed-security plus pentest partner with Dutch-language support.
Trade-offs: Cross-border reach is limited; bench size is smaller than Northwave or Secura; offensive research output is less visible than the larger firms.
7. Zerocopter
Zerocopter was founded in 2015 in Amsterdam as one of the early European hybrid crowdsourced testing platforms. The model combines a managed researcher community with structured pentest engagements (Vulnerability Disclosure Programs, bug bounty, and PTaaS-style work).
Headquarters: Amsterdam, Netherlands.
Why Dutch buyers pick Zerocopter in 2026:
Hybrid crowdsourced model. Access to a curated researcher community with breadth no single boutique pentest firm can match on a single engagement.
Bug bounty plus pentest under one contract. Reduces vendor management overhead.
Strong Dutch and EU customer base. Local-language support and EU data-residency.
Best fit: Dutch digital-first companies, fintechs, and government VDP programs that want crowdsourced breadth plus boutique-style management.
Trade-offs: Research depth on novel bug classes depends on which researchers happen to engage; less consistent than a senior in-house pentest bench. Buyers who want predictable methodology cadence prefer a pure-pentest firm.
8. The Big Four (KPMG, Deloitte, EY, PwC)
KPMG Netherlands, Deloitte Netherlands, EY Netherlands, and PwC Netherlands all sell penetration testing inside their broader cyber, risk, and assurance practices. Board-level Dutch buyers often default to the Big Four for the audit-adjacent assurance signal.
Headquarters: Global Big Four firms with substantial Dutch member-firm benches.
Why Dutch buyers pick the Big Four in 2026:
Board-room compliance signaling. ISAE 3000, SOC 2 (US-equivalent attestation), and integrated GRC reporting.
Audit-adjacent assurance. Pentest output threaded into broader IT audit and risk programs.
DORA and NIS2 program-level advisory beyond pentest itself.
Cross-border footprint. Strongest fit for multinational Dutch HQs that need consistent vendor coverage across multiple legal entities.
Best fit: Listed Dutch corporates, regulated financial institutions where the audit partner relationship is the pivot, and Dutch HQs of multinational groups.
Trade-offs: Pricing typically 3 to 5x boutique rates for equivalent scope. Offensive depth varies sharply by partner-level engagement; junior teams sometimes ship below boutique quality. Less likely to break novel ground than a research-led pentest firm.
Figure 3: Certifications matrix. Verified against each vendor's About page or certifications page. CCV Keurmerk Pentesten coverage is the procurement-default for Dutch public-sector tenders. CREST member-firm accreditation is the closest internationally-accepted equivalent. Sources: vendor pages, Het CCV certified bodies list.
Pricing reality in the 2026 Dutch market
Dutch pentest pricing tightened in 2026 as supply expanded and as NIS2 and DORA pulled more in-house security budgets toward continuous testing. The bands below reflect the EUR-denominated Dutch market median for the May 2026 research window; bespoke scopes and senior-only delivery sit at the top of each band.
Small web app pentest (single product, 1 to 3 user roles): EUR 4,500 to 12,000 per engagement.
Mid-size SaaS or mobile app (5 to 10 roles, 2 to 4 integrations): EUR 12,000 to 30,000 per engagement.
Network and infrastructure (internal plus external, 250 to 1,000 IPs): EUR 15,000 to 40,000 per engagement.
Cloud and red team (multi-cloud or attack-path-focused): EUR 30,000 to 90,000 per engagement.
Annual PTaaS subscription (continuous web app coverage): EUR 40,000 to 120,000 per year.
Big Four enterprise engagements: typically 3 to 5x the boutique numbers above.
TIBER-NL or DORA TLPT: multi-month programs typically starting EUR 150,000 and rising with scope.
Stingrai publishes its specific package prices at www.stingrai.io/pricing. Use the live page for current numbers; specific dollar or euro figures cited from memory go stale.
Figure 4: Typical 2026 EUR-denominated pentest pricing bands in the Dutch market. Bespoke scopes and senior-only delivery sit at the top of each band. Big Four engagements typically run 3 to 5x boutique rates for equivalent scope.
How to choose between these vendors
Three questions narrow the shortlist quickly.
Does the engagement require a CCV Keurmerk Pentesten certification by contract or policy? If yes, the shortlist is Fox-IT, Secura, Northwave, Tesorion, and any current CCV holder on the Het CCV certified bodies list. Stingrai partners with a CCV holder for the formal mark where required.
Is the buyer profile SaaS or DevSecOps-first, or board-room compliance-first? SaaS and DevSecOps buyers should weight Stingrai, Computest, and Zerocopter higher. Board-room compliance buyers should weight Fox-IT, Secura, and the Big Four higher.
Is the scope ICS, SCADA, OT, or product security? Fox-IT and Secura have the strongest Dutch records on industrial and product testing. Most application-pentest firms (including Stingrai's web-focused Snipe) are not the right fit.
For most Dutch SaaS and regulated-mid-market buyers in 2026, the shortlist that fits 80 percent of the use case is: Stingrai for offensive depth and AI-augmented testing, one-time or continuous, paired with one Dutch CCV holder for any CCV-mandated work. The remaining 20 percent of Dutch buyers (defence-adjacent, OT, healthcare-sovereignty, board-level compliance) have purpose-built local choices on this list.
If your shortlist reaches beyond the Netherlands, we compare the wider field in the best VAPT companies of 2026, and cover pricing benchmarks in the average cost of a penetration test in Canada, which tracks closely with Western European rates.
More provider guides
Shortlisting beyond the Dutch market? These rankings follow the same methodology:
Frequently Asked Questions
Who is the best penetration testing company in the Netherlands in 2026?
Stingrai is a CREST-accredited penetration testing service provider, accredited at the firm level, founded in 2021 and headquartered in Toronto with a London office. Engagements are run by a named two-person tester team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP, backed by 18 published CVEs across the team and Hall of Fame credits at Apple, Google, the US Department of Defense and the US Federal Reserve, including a founding member of Uber's offensive security team. For Dutch buyers that usually means role-based authorization testing across a SaaS application and its APIs, a cloud review covering cross-account IAM in AWS or app registrations and Conditional Access in Azure and Entra ID, internal and external network testing with segmentation checks, and threat intelligence-led red teaming of the TIBER and DORA kind. Findings post to the PTaaS portal as they are confirmed, each with a working proof of concept, live chat with the assigned penetration testers runs for the length of the test, retesting is included, and every human-led and hybrid report ships with an attestation letter and a verified badge, on a one-time engagement or a continuous program. London, UK office serves Dutch and broader EMEA delivery and Toronto, Canada is HQ. Fox-IT, Secura, Northwave, Computest, Tesorion, and Zerocopter are the strong Dutch-native runners-up depending on whether the engagement needs CCV certification, integrated SOC and pentest, DevSecOps focus, NEN 7510 healthcare, or crowdsourced breadth.
What is the CCV Keurmerk Pentesten and is it required?
The CCV Keurmerk Pentesten is the Dutch national pentest quality mark, developed and administered by Het CCV (Centrum voor Criminaliteitspreventie en Veiligheid). The scheme renewed to version 2.0 effective January 1 2024; a new pentester qualifications list (version 3.0) became effective January 1 2025. Certification is performed by DEKRA, DigiTrust, or Kiwa. The mark is not legally mandatory across the board, but is procurement-default for Dutch public-sector tenders and many regulated-sector contracts. Non-Dutch buyers often accept CREST member-firm accreditation as an internationally-recognized equivalent.
How much does a penetration test cost in the Netherlands?
Typical 2026 Dutch market pricing: small web app pentest EUR 4,500 to 12,000, mid-size SaaS or mobile app EUR 12,000 to 30,000, network and infrastructure EUR 15,000 to 40,000, cloud and red team EUR 30,000 to 90,000, annual PTaaS subscription EUR 40,000 to 120,000 per year. Big Four (KPMG, Deloitte, EY, PwC) engagements typically run 3 to 5x boutique rates. TIBER-NL and DORA TLPT programs typically start EUR 150,000 and rise with scope.
Which Dutch firm is best for NIS2 compliance evidence?
Fox-IT, Secura, Northwave, and Stingrai are all credible for NIS2 evidence. Stingrai's pentest output supports your NIS2 documentation alongside SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, NIST SP 800-53 and 800-171, and DORA evidence. For CCV-mandated tenders, pair Stingrai with one of the Dutch CCV holders for the formal mark.
Which Dutch firm is best for DORA Threat-Led Penetration Testing?
Fox-IT (intelligence-grade and TIBER-NL pedigree) and Stingrai (CREST-accredited firm-level Penetration Testing service provider with senior red-team certifications on the bench, OSCE3, OSCP, OSED, OSEP, CRTO, CRTE) are the strongest matches for DORA TLPT work. Northwave is also strong for the SOC-integrated phase of a TLPT program. The European Central Bank's TIBER framework and the Dutch local variant TIBER-NL operated by De Nederlandsche Bank are the operational predecessors to DORA TLPT.
Which Dutch firm is best for healthcare and NEN 7510?
Tesorion (ISO 27001 plus NEN 7510 certified by DEKRA, T-CERT for incident response), Secura, and Northwave are the strongest Dutch fits. Stingrai's pentest output supports HIPAA, ISO 27001, and NEN 7510 evidence; pair Stingrai with a Dutch healthcare-experienced GRC partner for the formal NEN 7510 audit.
Is penetration testing required by Dutch law?
Pentesting is not universally mandated by Dutch federal law, but the frameworks Dutch organizations adopt each expect documented security testing: GDPR Article 32 expects documented testing of security controls; NIS2 (Cyberbeveiligingswet) expects management-board accountability for documented testing; DORA Article 26 requires Threat-Led Penetration Testing for in-scope financial entities from January 17 2025; NEN 7510 expects independent assurance for Dutch healthcare. Combined with sector contractual requirements and the Autoriteit Persoonsgegevens' breach-notification regime, pentesting is the practical baseline for Dutch organizations handling personal data, critical-infrastructure operations, or financial services.
What certifications should my Dutch pentest vendor hold?
At the individual level: OSCP, OSWE, OSED, OSEP, CREST CRT, and CRTO on the actual testers who will be on the engagement. At the company level: CCV Keurmerk Pentesten (for Dutch procurement) or CREST member-firm accreditation (internationally equivalent), ISO 27001, plus NEN 7510 for Dutch healthcare scopes. Beyond paper, check public CVE track record (Stingrai's team has documented vulnerability research), DEFCON and BSIDES talks, and named senior testers on the actual proposal.
Can a non-Dutch vendor work for Dutch buyers in 2026?
Yes. Many Dutch buyers contract international pentest firms for SaaS, cloud, web, and red team scopes that do not require a Dutch national mark. Stingrai serves Dutch buyers from its London, UK office during EMEA hours. For CCV-mandated public-sector or regulated-sector contracts, pair the international firm with a Dutch CCV holder, or use the international firm for the offensive work and a Dutch GRC partner for the audit-side mark.
How long does a Dutch pentest engagement take?
Typical durations in the 2026 Dutch market: small web app 5 to 8 working days; mid-size SaaS or mobile app 10 to 15 working days; network and infrastructure 8 to 15 working days depending on scope size; cloud and red team 15 to 30 working days; TIBER-NL or DORA TLPT programs 12 to 24 weeks end-to-end. Reporting cycle typically 5 to 10 working days after testing ends; retesting included for paid PTaaS subscriptions. Stingrai's Hybrid Pentest model collapses some of this cycle by running Snipe's AI agent in parallel with the manual pentest bench.
Talk to Stingrai
Scoping a penetration test against what this guide covers takes one short conversation. Stingrai is a CREST-accredited penetration testing service provider at the firm level, headquartered in Toronto with a London office. A named two-person tester team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP runs the engagement, backed by 18 published CVEs and Hall of Fame credits at Apple, Google, the US Department of Defense and the US Federal Reserve. For Dutch buyers that usually means role-based authorization testing across a SaaS application and its APIs, a cloud review covering cross-account IAM in AWS or app registrations and Conditional Access in Azure and Entra ID, internal and external network testing with segmentation checks, and threat intelligence-led red teaming of the TIBER and DORA kind. Findings are posted to the PTaaS portal as they are confirmed with a working proof of concept, retesting is included, and every human-led and hybrid report ships with an attestation letter and verified badge, on a one-time engagement or a continuous programme. Book a free scoping call, get a quote, or read the published pricing.
References
Het CCV (Centrum voor Criminaliteitspreventie en Veiligheid). Pen Test Keurmerk (English overview). Updated January 2025. https://hetccv.nl/keurmerken/cybersecurity/pen-test-english/. Dutch national pentest quality mark; version 2.0 effective January 1 2024; pentester qualifications version 3.0 effective January 1 2025.
Het CCV. Certified pentest bodies list. https://hetccv.nl/keurmerken/cybersecurity/pentest/certificatie-instellingen-pentest/. Lists DEKRA, DigiTrust, and Kiwa as the currently licensed certification bodies for the CCV Keurmerk Pentesten.
Dutch Government (Digitale Overheid). NIS2 in the Netherlands (Cyberbeveiligingswet). https://www.digitaleoverheid.nl/dossiers/cybersecurity/nis2/. Official Dutch NIS2 transposition overview.
EIOPA. Digital Operational Resilience Act (DORA) overview. https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en. Applies to all EU financial entities from January 17 2025; Threat-Led Penetration Testing required under Article 26 from the entities competent authorities identify.
NEN. NEN 7510-1:2017 (Dutch healthcare information security baseline). https://www.nen.nl/nen-7510-1-2017-nl-235850. Mandatory baseline for Dutch healthcare providers handling patient data.
HackerOne. 9th Hacker-Powered Security Report. October 1 2025. https://www.hackerone.com/press-release/hackerone-report-finds-210-spike-ai-vulnerability-reports-amid-rise-ai-autonomy. 70 percent of researchers use AI tools; valid prompt-injection report volume up 540 percent YoY; 58 percent of researchers say AI misses business logic.
Bureau Veritas. Bureau Veritas joins forces with Secura. January 19 2021. https://group.bureauveritas.com/newsroom/bureau-veritas-expands-cybersecurity-offer-secura. Press release confirming Secura's 2000 Dutch founding and 2021 acquisition.
NCC Group. About NCC Group. https://www.nccgroup.com/about-us/. 1,800+ global headcount, UK / Europe / North America / Asia-Pacific footprint, parent of Fox-IT in Delft.
Northwave Cyber Security. About Northwave. https://www.northwave-cybersecurity.com/about. Utrecht HQ, founded 2006, 275+ employees, ISO 27001 and Tech Accord signatory.
Tesorion. About Tesorion. https://www.tesorion.nl/en/about/. Leusden HQ, 140+ experts, 100% Dutch, ISO 27001 plus NEN 7510 certified by DEKRA, T-CERT incident-response team.
GDPR.eu. Article 32 - Security of processing. https://gdpr-info.eu/art-32-gdpr/. Mandatory documented testing of security controls for personal data processing.
Stingrai. Pricing. https://www.stingrai.io/pricing. Canonical pricing reference; numbers update periodically and should not be quoted from memory.
Stingrai. Clutch profile. https://clutch.co/profile/stingrai. 5.0 out of 5.0 across 20 reviews as of May 2026.
MITRE / CVE.org. Published CVE list. https://www.cve.org/. Public record of CVEs published by Stingrai team members.
Next steps
If you are scoping a 2026 Dutch pentest engagement, start with Stingrai's pentest service overview and request a scoped proposal via the contact form. For ongoing coverage, Stingrai's PTaaS program runs continuous web application testing with the Snipe agent and Stingrai penetration testers working together throughout, and integrates with Jira, GitHub, and Slack so output lands where engineering already works; the same team also delivers annual (one-time) penetration tests. Related Stingrai reading: Top Penetration Testing Companies 2026, Best PTaaS Providers 2026, and Penetration Testing Methodologies.
