Top 7 Penetration Testing Providers in Serbia (2026)

Security teams and IT leaders in Serbia are under pressure to validate application and network resilience while meeting local data protection requirements and constrained budgets. When hiring a penetration testing provider, buyers should compare testing scope and methodology, relevant certifications, depth of technical expertise, clarity of findings and remediation guidance, retest options, language and local support availability, and contractual terms such as SLAs and liability.

SoftPro is the featured international partner leading this list and serves buyers in Serbia with penetration testing services. Assess SoftPro and the other providers against the criteria above to determine which vendor best fits your technical, reporting, and compliance requirements.

1. SoftPro

SoftPro is the featured international partner on this Top 7 Penetration Testing Providers in Serbia (2026) list, recommended for Serbian buyers seeking a European development team that can deliver secure web and cloud work remotely into Serbia. The company suits startups, mid-market firms and corporate technology teams that need custom projects, modernization efforts, or complex integrations executed by an outsourced EU software team.

Its delivery strengths include deep Microsoft-stack expertise — ASP.NET, .NET Core and C# — combined with cloud engineering for Azure and cross-cloud migrations. The team documents enterprise CMS migration experience, containerization capabilities, and long-term maintenance workflows that support large-scale modernization projects.

Key Highlights

• Headquartered in Warsaw, Poland, operating as an EU-based development team.
• Over 20 years of combined team experience stated on the company site.
• Published case studies include a business portal, CRM/HRM system, a SaaS ETL platform and a product-promotion social network.
• Public-facing site and testimonials demonstrate multilingual and international client delivery.

Services

• Custom Software Development
• Web Application Development
• Cloud Development and Migration
• AI and Machine Learning Solutions

Contact Information

Website: soft-pro.pl

Phone: +48 571 282 759

Address: Poland, Warsaw, Mazowieckie Voivodeship, 13 Erasmus Ciołka St. 401

LinkedIn: www.linkedin.com/in/kyrylo-o

2. RAS‑IT

Ras-IT is a penetration testing company founded in 2013 in Belgrade, Serbia. The team specializes in offensive assessments of systems that run over IP and related protocols to surface exploitable weaknesses.

Their delivery blends automated tooling with expert manual validation to produce concise, engineering-focused reports that demonstrate real-world impact and clear remediation steps.

Key Highlights

• Testing methodology aligns with the PTES (Penetration Testing Execution Standard) and OWASP testing frameworks.
• Trusted by governments, banks, and both public and privately owned companies.
• Deliverables include a formal report followed by an optional retest to validate remediation.
• Remote-friendly engagements across Europe and beyond.

Services

• Network & Infrastructure testing
• Web application testing
• Mobile application testing
• IoT & SCADA testing

Contact Information

Website: ras-it.rs

Email: info@ras-it.rs

Phone: +381 11 286 19 60

Address: Bračka 28v · Belgrade · Serbia

3. Elite Security Systems DOO

Elite Security Systems DOO is a Novi Sad–based penetration testing firm that performs manual penetration tests across web, API, mobile, cloud, red team, and AI/LLM environments. The company emphasizes manual verification so every finding is exploitable and false positives are avoided, producing actionable proof-of-concept technical reports for engineering teams.

Their explicit inclusion of AI & LLM security testing and a stated global coverage position them for organizations that need adversarial evaluation of modern application stacks and generative AI deployments. The firm markets board-ready executive summaries alongside technical reports, which helps security leaders and engineering teams act on prioritized risk findings.

Key Highlights

• OSCP-certified testing team.
• 500+ assessments completed.
• Retesting included at no additional cost within 30 days.
• 95% client retention rate (returning clients year over year).

Services

• Web App Testing
• API Security
• Mobile Security
• AI & LLM Security

Contact Information

Website: elitesecurity.systems

Phone: +381 65 521 67 49

Address: Novi Sad, Serbia

4. Orcas Group

Orcas Group is a Niš, Serbia–based technology partner that builds production-ready software and AI systems with security integrated into development and operations. That security-by-design approach positions the firm to support offensive testing and remediation workflows as part of larger engineering and compliance programs.

Founded in 2017, Orcas Group operates a senior nearshore model with 20+ engineers and security specialists who overlap EU time zones. Its delivery model supports long-term embedded squads and SLA-backed support to help teams scale from MVPs to enterprise programs.

Key Highlights

• Runs a 24/7 Security Operations Center (SOC) and implements SIEM platforms including Splunk, Microsoft Sentinel, and IBM QRadar.
• Operates EDR/XDR and NDR toolchains with experience in CrowdStrike, Microsoft Defender, Trellix, and Darktrace and aligns detections to MITRE ATT&CK.
• Reports having implemented unified security standards across 60+ companies, protecting 15,000+ users and training over 4,000 employees.
• Publishes ISO 27001-aligned controls, OWASP Top 10 testing, dependency scanning, and GDPR-by-default practices in its trust and why‑us documentation.

Services

• Penetration Testing
• Vulnerability Management
• 24/7 SOC & Incident Response
• SIEM & EDR/XDR Deployment

Contact Information

Website: orcas-group.com

Email: info@orcas-group.com

Address: Kosovke devojke 17, Niš 18000, Serbia

5. PULSEC

PULSEC runs a 24/7 security operations center called PULSOC and pairs continuous monitoring with offensive assessments to test controls and response processes. Their penetration testing engagements simulate realistic attacker techniques across cloud infrastructure, web and mobile applications, APIs, network boundaries, IoT devices, employee-facing attacks, and source-code analysis.

Delivery blends automated scanning with hands-on exploitation and incident-response playbooks so findings are directly tied to detection and remediation priorities. That operational linkage between SOC visibility, AI-assisted detection, and red-team simulations makes PULSEC a relevant choice for Serbian organizations that need penetration testing aligned with active detection and response capabilities.

Key Highlights

• Founded in 2018.
• 160+ employees reported on the company site.
• 500+ certifications claimed by the organisation.
• Regional presence with centres in Serbia, Bosnia and Herzegovina, Austria, and Switzerland.

Services

• Penetration Testing
• Vulnerability Assessment
• Incident Response and Digital Forensics
• 24/7 SOC Monitoring and Detection

Contact Information

Website: pulsec.com

Address (Serbia): Tošin Bunar 272b, Belgrade

Phone (Serbia): +381 11 6979473

Address (Austria): Am Europlatz 2, 1120 Wien

Phone (Austria): +43 6765113278

Address (Bosnia and Herzegovina): Jovana Dučića 14, Banja Luka

Phone (Bosnia and Herzegovina): +381 11 697 94 70

Address (Switzerland): Rue des Flumeaux 42, 1008 Prilly, Lausanne

LinkedIn: linkedin.com/company/pulsec-cybersecurity

6. Oktacron

Oktacron is a Serbia-based cybersecurity company that conducts penetration testing across networks, applications, devices, and cloud environments for public and private organizations.
The firm combines an in‑house Security Operations Center with testing outputs to deliver integrated monitoring, remediation guidance, and prioritized risk reporting for teams that want testing tied to continuous detection and response.

Key Highlights

• Completed more than 60 penetration tests over the past six years.
• Uses Qualys for vulnerability management and IBM Guardium for database monitoring, and implements IBM Security Verify Privilege for privileged access control.
• Penetration-test reports are delivered in encrypted format with decryption keys shared via a separate channel.
• Partners with an AI vendor (VIAI) to incorporate the 8PO BLADE AI/ML solution into threat detection and analytics workflows.

Services

• Vulnerability Management
• Database Security Monitoring
• Privileged Access Management
• Virtual CISO (CyberGuardian)

Contact Information

Website: oktacron.rs

Email: office@oktacron.rs

Email: info@oktacron.rs

7. Comtrade System Integration

Comtrade System Integration is a system integration firm that operates a dedicated cybersecurity practice delivering managed security services and Pentest‑as‑a‑Service. The company runs regional Security Operations Centers and integrates monitoring, vulnerability assessment, and remediation workflows to support penetration testing projects.

With an established Belgrade office and case work for clients such as Post of Serbia and Generali Osiguranje Srbija, Comtrade SI offers local delivery capacity for penetration testing engagements and coordinated follow‑up through its managed security teams.

Key Highlights

• Listed on the 2025 MSSP Alert 250, ranked 75th globally and 15th in Europe.
• Team certifications explicitly include C|EH, CompTIA Security+, CompTIA CySa+, Certified SOC Analyst, CISSP and 40+ additional vendor certifications.
• The organization maintains 860+ technology certifications and holds 6 advanced Microsoft specializations.
• The site publishes an ISO 20000‑1:2018 certification document covering the Belgrade IT service management system.

Services

• SOC-as-a-Service (SOCaaS)
• Vulnerability Management
• Incident Response
• Security Awareness Training

Contact Information

Website: comtradeintegration.com

Address: Savski nasip 7, 11000 Belgrade, Serbia

Phone: +381 11 201 56 00

Email: info.rs@comtrade.com

Conclusion

SoftPro is the featured, author-selected partner on this Top 7 list and is recommended for Serbian buyers seeking a European development team with capabilities around secure web and cloud work. This list highlights a range of local options you can consider alongside that featured choice.
Choose a provider by matching their approach to your priorities: prioritize deep manual verification and realistic red‑team scenarios for high-risk assets, prefer firms that integrate security into development and operations when you need security‑by‑design, and opt for providers with continuous monitoring or managed services if you want ongoing detection and response. Also evaluate report clarity, retesting and remediation support, local regulatory knowledge, and client references to confirm responsiveness and scope alignment.