Every European penetration testing and PTaaS software tool reviewed
Bucharest, Romania
Founded 2017
Three plans scale with asset count: NetScan at $96 monthly, AppScan at $140 monthly, Exploit at $190 monthly
Demo on request
Best for: In-house testers who want a toolbox plus ready-made evidence and reporting
Of all ten, Pentest-Tools.com leaves the most to you: Bucharest supplies scanners, exploiters and a report generator, and your staff run the tests. Pricing starts at $96 monthly for NetScan (16 assets), $140 for AppScan (5 assets) and $190 for Exploit (5 assets); annual billing is quoted as ten months. API access, unlimited rescans, team seats and integrations come with every plan.
The vendor is PENTESTTOOLS S.A., a Romanian joint stock company that has operated from Bucharest since 2017. Its about page cites 2,100 customers in at least 119 countries, which we could not verify.
On the technical side, AppScan covers authenticated DAST and REST and GraphQL APIs, while Exploit adds an automatic CVE exploiter plus SQL injection and XSS exploiters; Burp Suite findings can be imported. Weigh the dollar prices, the report add-on (Word or Google Docs export) and managed pentests that are priced by estimate.
What Pentest-Tools.com does well
- Price list built around asset counts
- Covers recon through to exploitation
- Reporting tool and Burp Suite import
- Contract with a Romanian S.A.
- API and integrations in each plan
Where Pentest-Tools.com falls short
- Offers no crowd of researchers and no triage desk
- Billed in US dollars
- Reporting costs extra
- Several features carry a new label
Standout feature. Its price list is the only one in this category that is organised around how many assets you have, not around a test or a quote.
Netherlands
Atlas is quoted against the total number of assets; a Nova pentest starts at EUR 1,250 per test, VAT not included
Demo on request
Best for: Security groups tired of scanner output who prefer confirmed, exploitable issues
Two products come from this Dutch vendor. Atlas continuously maps and validates the external attack surface, and Nova dispatches AI agents to run a pentest when you ask. According to Hadrian, a notification fires only for validated exposures, leaving the security team with fewer alerts and more proven problems. Atlas add-ons cover mergers and acquisitions assessments and infostealer credential leak detection.
You contract with Hadrian Security B.V., a Dutch limited company. One Nova run begins at EUR 1,250 excluding VAT, with lower rates in bundles, and reports are said to map to SOC 2, ISO 27001 and NIS2. A free external scan is the way in. Read the order form closely: the general terms let English or New York governing law be chosen. Atlas is quoted by asset count, and rating suppliers is left to other products.
What Hadrian does well
- Alerts follow validation of the finding
- A pentest price per test is public
- Reports mapped to DORA and NIS2
- Starts with a no-cost external scan
- Contract with a Dutch B.V.
Where Hadrian falls short
- Does not rate suppliers
- Atlas price comes only by quote
- Governing law in the order form may be non-EU
- Claims about agentic testing come from the vendor
Standout feature. An alert appears only once an exposure has been validated, which turns the output into a brief list of proven problems rather than a raw scan dump.
London, England, United Kingdom
A free plan exists; Cloud, Pro and Enterprise are bought via quote or checkout; an AI pentest begins at USD 3,500 per test
Demo on request
Best for: Lean security teams after steady, low-effort watching of their internet-facing surface
One subscription from this London vendor bundles exposure monitoring, vulnerability management, cloud checks and pentests, which are AI-led and begin at $3,500. Change detection starts a scan whenever a port opens or a cloud service shows up. Enterprise adds shadow IT discovery and monitoring of all ports. The homepage claims over 3,000 companies use it, a figure we did not check.
Your counterparty is a UK limited company, number 09529593 per the footer; UK law governs, backed by the EU adequacy decision. Four plan levels exist. The free one gives weekly external scans, one cloud account, two container images and three users. Cloud offers a 14-day trial, and Pro and Enterprise are quoted. We could not read the paid amounts, free scanning covers only ports 80 and 443, and internal scanning requires agents.
What Intruder does well
- A free tier is offered
- Cloud plan can be tried for 14 days
- Detects new assets as they change
- Long list of integrations
- UK Ltd whose company number is public
Where Intruder falls short
- Does not rate suppliers
- Paid prices missing from the page text
- Pentest fees are in US dollars
- Free scanning stops at ports 80 and 443
Standout feature. As soon as a port opens or a cloud service appears it gets scanned, and a free plan lets you begin at no cost.
Dublin, Ireland
Founded 2017
No price figures on the pages we read; ask via the website
Demo on request
Best for: Buyers who like automation but want a specialist to confirm each result
Dublin is where Eoin Keary started Edgescan in 2017. One subscription spans web, API, network and mobile testing along with an attack surface module. Vulnerability intelligence is combined with human guidance and verification, intended to remove false positives before they reach the customer, and pentest as a service is offered on the automated base.
The website is run by BCC Risk Advisory Limited, an Irish company numbered 497804 that uses the Edgescan trading name, with staff in Dublin and New York. That policy covers the website only. We did not check which entity signs a service contract, so ask. No price was shown, hence a quote request, and having a person verify results adds turnaround that a purely automated scanner skips.
What Edgescan does well
- Testing and attack surface in a single platform
- A person verifies the findings
- PTaaS is available
- Irish company, registration number shown
- Based in Dublin
Where Edgescan falls short
- Prices are not public
- Does not rate suppliers
- A US office exists next to Dublin
- We did not check the service contract entity
Standout feature. Before findings arrive, a human reviews them, which is the vendor's answer to false positives.
Ghent, Belgium
Founded 2022
Free Developer tier for 2 users; Basic is $300 monthly and Pro $600 monthly, each with 10 users; Enterprise is quoted; taxes are extra
Free plan, no credit card
Best for: Engineering teams looking for one product for repositories, packages, images and cloud settings
Aikido Security in Ghent started as a developer security platform and now sells AI pentests that, according to the vendor, finish the same day. The tests run in whitebox, greybox or blackbox mode, attach proof of exploit to findings and produce reports aimed at SOC 2 and ISO 27001. A test can pause for a person to review a possible escalation, so the agent does not take a risky step unattended.
The contracting party is Aikido Security BV (Belgian VAT BE0792914919), founded in 2022 in Ghent, which also has offices in the US and UK. The pentest is surrounded by scanners for dependencies, secrets, code, containers, cloud settings and infrastructure as code. Published tiers cost $300 and $600 monthly in dollars, each with ten users, plus a free plan for two users. The cost of a pentest is not confirmed, and the product does not scan networks or hosts.
What Aikido Security does well
- Scans repositories, packages, images, cloud and domains together
- Two users can start free
- Monthly prices are listed
- Belgian firm that states its VAT number
- Pricing suits small dev teams
Where Aikido Security falls short
- Network and host scanning are absent
- Dollar pricing
- It also has US and UK offices
- Free plan covers 10 repositories at most
Standout feature. One supplier checks your repositories and containers and also tests the live application, pausing for a person when an escalation needs review.
Coimbra, Portugal
Pricing on request
Demo on request
Best for: Groups replacing a once-a-year report with ongoing automated pentests backed by exploit proof
An engine called Hackian takes the place of the calendar-bound pentest at Ethiack in Coimbra. It maps internal, external and third-party assets and tests again after a code push, an infrastructure change or new threat intelligence. The home page says each confirmed risk comes with proof of exploit and fix guidance, and outputs include live reports for NIS2, DORA, SOC 2, ISO 27001 and PCI.
You sign with Ethiack, S.A., a Portuguese company numbered 516856146 and seated at the Instituto Pedro Nunes in Coimbra. Its case studies name ANA Aeroportos, Bluepharma and a Porto university as customers; the 650 percent ROI in one of them is the vendor's own figure. Open items to raise: there is no price list, the privacy policy dates from 2022, no hosting region is given, and outside researchers cannot take part.
What Ethiack does well
- Confirmed findings carry exploit proof
- Tests fire on events, so coverage is continuous
- Maps the attack surface including third-party assets
- NIS2 and DORA compliance reporting
- Portuguese S.A. that publishes its registration number
Where Ethiack falls short
- No researcher community or bounty table
- Prices are not published
- Hosting location is not given
- Performance numbers come from the vendor
Standout feature. A change to code or infrastructure sets off the testing, and each confirmed finding arrives with proof of exploit.
Paris, France
Sales sets the price per scope; the page text shows no amounts
Demo on request
Best for: Organisations built on APIs where flaws in business logic matter more than known CVEs
Paris-based Escape made its name with DAST that understands how an API is meant to behave. The AI engine hunts for broken authorisation and other business-logic flaws, the kind of bug no CVE list covers, and the company has stretched that engine into AI pentesting with a retest step and attack surface management for apps, APIs and infrastructure.
Escape Technologies SAS, a French simplified joint-stock company, is legally responsible and acts as data controller. Because the address it publishes is incomplete, procurement should ask for the full registered office. Budgeting is harder still, as the pricing page lists no figures and each path ends in a demo booking. Choose Escape for cloud-native stacks built on APIs, not for charting a legacy internal network.
What Escape does well
- Dynamic testing that understands business logic
- Scanning starts from the API
- Pentests from outside, with a retest
- French company under EU jurisdiction
Where Escape falls short
- The page text shows no amounts
- The privacy policy address is only partial
- Does not scan internal networks
- Buying begins with a demo
Standout feature. Its tests target business-logic flaws in APIs, something a signature-based scanner is blind to.
Geneva, Switzerland
Founded 2019
The Community Edition costs nothing; the paid AI Platform (covering pentests, ASM and dark web monitoring) goes through sales
Demo on request
Best for: Buyers wanting pentests led by people for web, API and mobile, under a formal accreditation
Human testers at ImmuniWeb in Geneva work alongside AI models tuned for application security. The vendor says it was among the first with a CREST accreditation for that combination and is one of ten firms worldwide holding the new AI-Enabled Penetration Testing accreditation in 2026, which would be an audited fact, not a slogan. The same suite includes attack surface management and dark web monitoring for leaked credentials and brand mentions.
ImmuniWeb SA, a Geneva company operating since 2019, funds itself, reports profit from the first year and holds ISO 9001:2015. Universities, municipalities and similar bodies can use the free Community Edition, which runs over 100,000 tests a day. Note three caveats: Switzerland depends on an adequacy decision and sits outside the EEA, the AI Platform carries no public price, and the free edition offers less than a paid engagement.
What ImmuniWeb does well
- People do the testing, with AI help under a CREST accreditation
- Pentests, ASM and dark web monitoring in a single suite
- The free Community Edition handles 100,000+ tests every day
- Funds itself and turns a profit, so no investors to answer to
- Holds ISO 9001:2015
Where ImmuniWeb falls short
- No published price for the paid platform
- Swiss jurisdiction rests on an adequacy decision, outside the EU/EEA
- The free edition does less than paid testing
- Real cost only emerges in a sales conversation
Standout feature. CREST has accredited its AI-enabled penetration testing, meaning an outside body has audited how the AI is applied.
Antwerp, Belgium
Founded 2016
Core, Premium and Enterprise plans exist; each price comes on request
Demo on request
Best for: Companies that want a bug bounty and managed pentests from the same Belgian supplier
Antwerp is where Intigriti began, as a bug bounty marketplace. Besides the bounty it runs a managed disclosure programme and sells Focused, Comprehensive and Certified pentests; Certified targets regulated buyers and lists CREST-accredited deliverables. An in-house triage team screens each incoming report, and platform pages mention over 150,000 independent researchers.
The registered operator is Intigriti NV, on Klokstraat in Antwerp. Founded in 2016, it now employs over 100 people across Belgium, the UK, the US, the Netherlands and South Africa, and raised a EUR 21 million Series B in 2022. Settle three points before buying: the PTaaS product page is labelled beta, Core, Premium and Enterprise have no listed price, and we found no hosting location, only that stored data is encrypted within the application.
What Intigriti does well
- Operated by a Belgian entity, Intigriti NV
- Its own team triages reports
- Bounty, VDP and PTaaS under one roof
- Stored data is encrypted by the application
- Programs for AI security and safety
Where Intigriti falls short
- Prices are not listed
- No hosting location in the pages we read
- The product page marks PTaaS as beta
- US and UK offices exist next to the Belgian one
Standout feature. Bounty, disclosure and pentests share a platform, and an internal team handles triage.
Stockholm, Sweden
Founded 2013
Yearly fees: a free Starter tier (5 users, 100 assets), then €2,500 Standard, €5,000 Professional and €15,000 Enterprise
Demo on request
Best for: Buyers who need listed prices and steady outside-in scanning in the gaps between pentests
First Detectify finds what a company has facing the internet, and then it runs DAST on every asset found. Payloads come from internal research and from Crowdsource, where over 400 ethical hackers add attack techniques they have used in the field. REST and GraphQL API scanning starts at the Standard tier, and pipeline integration only at Professional.
Detectify AB of Stockholm is the contracting party, operating since 2013 with ISO 27001 certification. Scan results can contain internal URLs and occasionally exposed credentials, which then fall under Swedish and EU law. Annual prices are public: €0 for Starter (five users, 100 assets), followed by €2,500, €5,000 and €15,000. Standard ends at 750 assets and 10 users. Because it only reports exposure and never blocks traffic, it sits next to a WAF.
What Detectify does well
- Outside-in attack surface management and DAST together
- Payloads contributed by 400+ ethical hackers via Crowdsource
- Scans REST and GraphQL APIs
- Public prices running from free up to €15,000 a year
- Swedish company under EU jurisdiction
Where Detectify falls short
- It reports weaknesses and does not stop attacks, so no WAF or CDN
- Standard is capped at 750 assets and 10 users
- CI/CD hooks start at the Professional tier
- Enterprise leaps to €15,000 per year
Standout feature. More than 400 ethical hackers feed its library of attack payloads.
