How to choose a penetration testing company in Lithuania? Start with your situation, not the price

2026-11-01 · Buyer's guide

“Which companies in Lithuania do penetration testing?” “Which one should we choose?” Google sees these questions every day. The honest answer: there is no single best pentest company. There is only the one that best fits your situation, your system and your goal.

What testing costs and which technical criteria to look for in a proposal (methodology, sample report, retest, NDA) are covered in our article “How much does a pentest cost in Lithuania in 2026”. This one is about what lies beyond the price: how to match a provider to your situation, how to assess who will actually do the testing, and why it pays to rotate testers.

The short answer

Start with your situation: a first test, a new application, NIS2 or PCI DSS each call for different services and different skills.
Choose the tester, not the logo: ask who exactly will test, and whether their certifications are practical and relevant to your area.
Rotate providers: a different tester, with different tools and a different approach, finds different vulnerabilities. The European Central Bank's TIBER-EU guidance recommends rotating providers for every test.

1. Why doesn't a “best pentest companies” list work?

The UK National Cyber Security Centre (NCSC) puts it plainly: “the quality of a penetration test is closely linked to the abilities of the penetration testers involved” [1]. Not to the size of the company, not to its client logos, and not to the price. At a large firm, your system may be tested by a junior specialist or a subcontractor, while a small team may have exactly the expertise you need.

The second reason: “pentest” is not a single product. A web application test, an internal network (Active Directory) test, a cloud configuration review and a red team exercise all require different knowledge. A provider that is strong in one area may be average in another.

2. What is your situation, and what does it call for?

Before you look for a provider, be clear about why you are testing. That determines which service and which skills you need.

Situation	What you actually need	What to look for in a provider
First test, current security posture unknown	A vulnerability assessment first (DAST, page in Lithuanian), then a pentest of your most critical system	Whether the provider suggests starting with a cheaper step rather than selling you the biggest package straight away
New web application or major change before go-live	Web application and API pentest following OWASP WSTG / ASVS [15][16]	Practical web security certifications (BSCP, OSWE); testing with multiple user roles
NIS2 entity	A cybersecurity audit every 3 years and vulnerability scanning every 6 months [2][3]; penetration testing recommended [5]	For the audit: an auditor certification on the list approved by the National Cyber Security Centre (NKSC) [4]; for the pentest: the tester's hands-on competence. These are often different providers
You accept payment cards (PCI DSS)	Internal and external penetration testing every 12 months and after significant changes, plus segmentation testing (Requirement 11.4) [6]	The tester's organisational independence; experience with segmentation testing
Financial sector (DORA)	Annual independent testing of critical systems; for larger entities, TLPT every 3 years [7]	For TLPT testers: a lead with 5 years' experience, at least 2 testers with 2 years' experience, 5 references, insurance [8]
A client or partner asks for a pentest report	A report from an independent provider with an executive summary, often in English	Whether the report format works for a third party; whether the provider will retest and issue a confirmation
You have had an incident	Incident investigation (DFIR) first, not a pentest	Incident response experience; a pentest only once it is clear what happened

A common NIS2 mistake. Lithuania's Law on Cybersecurity requires an audit carried out by an independent certified auditor [2]. The list of certifications approved by the NKSC includes CISA, CISM, CISSP, ISO 27001 auditor and similar management certifications, but not a single practical penetration testing certification [4]. In other words, an NIS2 audit and a penetration test are different jobs: the audit assesses processes and compliance, while a pentest shows whether the system can actually be compromised.

The same pattern shows up in public procurement. Pentest tenders often require PMP, CISSP or CISA certifications, and practical testing certifications less often. If you are preparing a tender, include the tester's hands-on competence (e.g. OSCP, BSCP or equivalent) in the qualification requirements as well.

3. What types of providers are there in Lithuania, and when does each one fit?

About twenty companies offer penetration testing in Lithuania. By business model, they fall into four groups:

Audit and consulting firms. Strong in compliance, risk assessment and audit (NIS2 audits, ISO 27001). Technical testing is sometimes done by subcontractors.
IT integrators and system vendors. Convenient if you already work with them. However, if the same provider built or maintains the system under test, there is a conflict of interest: the TIBER-EU guidance does not allow such a provider to test if its services create a conflict of interest [9].
Specialised cybersecurity companies. Larger teams covering several areas (SOC, incident response, red teaming). A good fit for large and complex projects.
Small specialised teams. The person you talk to is usually the person who tests. Deep expertise in one or two areas and flexibility, but limited capacity for very large scopes.

No group is better by default. What matters is that the provider's strengths match your situation from section 2.

4. Who exactly will test your system?

This is the most important question to ask before you sign. Ask for the testers' names, CVs and certifications, and ask whether any of the work will be subcontracted. For the financial sector, the DORA technical standards require this directly: the provider must supply testers' CVs, copies of their certifications and references from previous engagements [8].

Certifications differ not only in subject area but also in how they are earned. The TIBER-EU guidance notes that some certifications can be obtained by answering only multiple-choice questions, whereas others require technical tasks in a lab environment, so certifications alone should not be relied on [9].

Certification	Area	Exam
BSCP (PortSwigger) [13]	Web applications	Practical, 4 hours: two applications, in which you must gain user and administrator access
OSWE (OffSec) [12]	Web applications, code analysis	Practical, 48 hours: finding vulnerabilities in source code, writing your own exploit, report
OSCP (OffSec) [11]	Infrastructure, Active Directory	Practical, 24 hours: three servers and an Active Directory scenario
PenTest+ (CompTIA) [14]	General pentest knowledge	Up to 90 questions, some of them practical tasks, 165 min.
CISSP, CISA, CISM	Security management, audit	Theoretical. Demonstrates management competence, not hacking skills

Beyond certifications, ask about real-world experience: what similar systems they have tested, whether they have published research or discovered CVEs, and whether they take part in responsible disclosure programmes (bug bounty, VDP).

Not sure where to start?

In a free 15-minute consultation, we will discuss your situation and tell you which test you need. If it is not our area, we will tell you that too.

Book a consultation

5. Why does it pay to rotate testers?

Every tester has their own tools, habits and favourite attack paths. The same person testing the same system year after year will naturally follow the same routes. A different tester will look at it from another angle and find what the first one missed.

This is not just our opinion. The European Central Bank's TIBER-EU guidance on service provider procurement states: “It is highly recommended to rotate service providers for every test. A new external service provider might bring new insights to the testing entity through a fresh outlook, other research routines, different methods and a different testing approach” [9]. For financial entities that carry out TLPT with internal testers, the DORA Regulation requires external testers to be used for every third test [7].

Rotation has its costs, too. CREST guidance describes it as a trade-off [10]: a long-standing provider knows your organisation well and gives more practical recommendations, but too much familiarity can create a conflict of interest. Several providers test more thoroughly, but are harder to manage.

In practice, we recommend the following model:

A main provider carries out regular tests and retests (a retest is always done by whoever found the vulnerabilities).
Every 2–3 years, or for a new critical system, a different provider. This acts as an independent second opinion.
If you cannot change provider, ask the provider to rotate its testers.
Give a new provider your architecture, user roles and the remediation status of previous findings, so they do not waste time on what is already known.

One more signal: the PCI DSS guidance notes that a test that finds nothing usually points to shortcomings in the tester [6]. If several tests in a row come back “clean”, that is a reason to change the tester, not to relax.

6. What warning signs should make you think twice?

The provider quotes a price and timeline without asking a single question about the system (how many roles, APIs, integrations, environments).
They cannot say who will do the testing, or the testers' certifications have nothing to do with your area.
The “pentest” takes one day, and the sample report looks like scanner output.
They do not ask for written authorisation to test and do not agree testing windows or incident contacts with you.
They guarantee they will “find all vulnerabilities”. The NCSC reminds us that a test only shows what was vulnerable on the day of the test [1].
The provider itself built or maintains the system under test.

7. When should you choose us, and when not?

We are a small specialised team, so we are honest about where our strengths lie.

Our area is web applications, APIs and protecting them with a WAF. Our testers hold OSCP, BSCP and PenTest+ certifications, and on the WAF side we bring more than a decade of hands-on experience with F5 and Cloudflare. With us, you talk directly to the tester. That brings an extra benefit: when we find a vulnerability, we can not only document it but also help you shield it temporarily with a WAF rule while developers fix it, and check whether the WAF can be bypassed.

We also work well as a second opinion. If the same provider tests you every year, we can run an independent test of your most critical web application from a different angle.

We will recommend looking elsewhere if you need an NIS2 compliance audit (carried out by certified auditors), large-scale red team exercises under DORA TLPT, testing of industrial control systems (OT), or incident investigation.

Our services and pricing are on the penetration testing page; for WAF, see WAF deployment and maintenance (in Lithuanian).

Frequently asked questions

Which penetration testing company should you choose in Lithuania?

One whose testers have hands-on experience in exactly the area your system belongs to (web applications, infrastructure, cloud), that is independent of whoever built or maintains your system, and that can tell you who specifically will do the testing. The quality of a test depends more on the testers' abilities than on the size of the company [1].

Does NIS2 require penetration testing in Lithuania?

Not directly. Lithuania's Law on Cybersecurity requires a cybersecurity audit at least once every 3 years [2], and Government Resolution No. 818 requires vulnerability scanning at least every 6 months [3]. The National Cyber Security Centre (NKSC) recommends carrying out penetration testing periodically [5].

Should you change your pentest provider?

Not necessarily every year, but it is worth doing periodically. The TIBER-EU guidance recommends rotating providers for every test [9]. A practical model: a main provider, plus a different one every 2–3 years or for a new critical system. Retests are carried out by the same provider that did the original test.

Which pentest certifications matter most?

Those with a practical exam that matches the area being tested: BSCP or OSWE for web applications, OSCP for infrastructure and Active Directory. CISSP, CISA or CISM demonstrate management and audit competence, but not hands-on hacking skills.