Citadelo

What Citadelo does

Citadelo is a private cybersecurity services firm specializing in ethical hacking and penetration testing, incorporated in 2010 as citadelo AG and operating through subsidiaries in Slovakia (citadelo s.r.o., Bratislava), the Czech Republic (Citadelo Czech Republic, s.r.o., Prague), and Switzerland (citadelo AG, Steinhausen/Zug as regional headquarters). The firm employs 26 ethical hacking professionals and targets enterprise clients, with named customers in banking (Erste Group, ČSOB, ING, Komerční banka), Big Four and consulting (KPMG), automotive (Carvago), energy (E.ON, Jablotron), telecommunications (Orange Slovensko), retail (Lidl), healthcare (Dr.Max, Union zdravotná poisťovňa), industrial automation (ComAp), and gambling (Doxxbet, FORTUNA), alongside globally recognized logos such as Dell.

Citadelo's offering centers on simulated attacks — penetration testing, red teaming, and social engineering (phishing and vishing with disclosed success rates up to 40%) — and specialized assessments across AI/LLM systems, cloud (AWS, Azure), web and mobile applications, infrastructure, and IoT/OT/SCADA environments. AI is integrated into reconnaissance and test-coverage acceleration, while final vulnerability validation remains manual. The team holds 26+ advanced certifications including OSCP, OSWE, OSEP, OSCE3, OSED, CISSP, CRTO, and CRTE. Adjacent productized assets include a public CVE database, an annual Ethical Hacking Report, the ExtendedMacro BurpSuite plugin, and an unofficial CVE-2014-4971 patch. Add-on modules cover SOC-as-a-Service, audit/consulting, and security awareness training.

Citadelo generates revenue through professional services sold via consultation-led enterprise field sales. No pricing is publicly disclosed; engagements begin with a free 15-minute consultation, followed by proposal and project execution under quote-based pricing. The company reports 628 IT projects assessed in 2025 (a 34% year-over-year increase) with over half containing critical or high-severity findings, and 384 projects with 2,795 vulnerabilities identified in 2023. Tomáš Zaťko serves as CEO and partner, with Mateo Meier as Head of Finance and Marketing and Member of the Board; ownership is founder-controlled with no disclosed venture or private equity investment.

Name

Citadelo

Legal name

citadelo AG

Website

https://citadelo.com

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

11–50 employees

Short description

Citadelo is a Slovakia-headquartered ethical hacking and penetration testing firm with offices in Switzerland and the Czech Republic, serving European enterprise clients in banking, automotive, energy, healthcare, telecoms, and retail with penetration testing, red teaming, AI/LLM security, and compliance assessments.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Investigation and Security Services (5616), Security Systems Services (except Locksmiths) (561621)

SIC

Services-Engineering, Accounting, Research, Management (8700)

akta.pro industry

PRIMARYHDADAHAD

Breach & Attack Simulation (BAS)

Hardware, Technology & Telecom/Cybersecurity/Vulnerability & Exposure Management (VM, ASM, BAS)

SECONDARYBPAKADAM

Insider Threat Program Design & Risk Assessments

Business & Public Services/Security & Investigations Services/Security Consulting, Risk Assessment & Audits

SECONDARYIMAIAEAF

Security Systems Monitoring & Dispatch (SOC/Remote Guarding)

Industrials, Manufacturing & Construction/Industrial Services & Facility Operations/Security, Guarding & Access Control Services

Keywords

• Penetration testing services
• Ethical hacking services
• Red team assessments
• Cybersecurity compliance testing
• Ai security testing

Headquarters

HQ city

Bratislava

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. Professional Security Testing Services: Professional services revenue generated from comprehensive security testing engagements including penetration testing, red teaming, social engineering, and specialized AI/LLM security testing for enterprise clients.
2. Cyber Defense Services: SOC as a Service offering continuous network monitoring and overview capabilities.
3. Training Services: Employee training programs to reduce human error risk, the most common attack vector.
4. Audit & Consulting: Preparation for external or internal audits and compliance with security standards.

Go-to-market motion2 records

Distribution channels2 records

Marketing channels6 records

Core offering

Citadelo is a professional ethical hacking and offensive security services company that delivers simulated attacks for enterprise clients. Its core services include Penetration Testing, Red Teaming, and Social Engineering engagements (phishing and vishing campaigns), augmented by AI-powered testing methodologies. The portfolio extends to specialized testing of AI/LLM systems, cloud environments (AWS, Azure), web and mobile applications, IT infrastructure, IoT and embedded systems, plus industry-specific audits for healthcare/MedTech, industrial/OT-SCADA, and financial services.

Product overview

Citadelo is a professional ethical hacking services company offering a comprehensive portfolio of cybersecurity assessment services. The core offering includes Simulated Attacks comprising Penetration Testing, Red Teaming, and Social Engineering. Specialized testing services cover AI & LLM Security Testing, Cloud Testing, Web Application Testing, Mobile Application Testing, Infrastructure Testing, and IoT & Embedded Testing. The company also provides targeted testing for specific industries including Healthcare (MedTech), Industrial (OT/SCADA), and Financial sectors. Additional services include Cyber Defense (SOC as a Service), Audit & Consulting, and Training. Citadelo also maintains a Blog for industry education and a CVE Database of discovered vulnerabilities, along with internally developed security tools like the ExtendedMacro BurpSuite plugin.

Differentiator

Problem solved

Functional benefit

Products and services

• Penetration Testing Security testing service that reveals vulnerabilities in systems, infrastructures, and processes, and supports compliance with standards such as PCI-DSS, DORA, NIS2, ISO 27000, and GDPR. Targeted at enterprise customers that need evidence-based security assessments.
• Red Teaming
• Social Engineering
• AI & LLM Security Testing
• Cloud Testing
• Web Application Testing
• Mobile Application Testing
• Infrastructure Testing
• IoT & Embedded Testing
• Healthcare Security Testing (MedTech)
• Industrial Security Testing
• Financial Industry Testing
• Cyber Defense (SOC as a Service)
• Audit & Consulting
• Training

Quantifiable outcome

• 384 completed projects in single year
• +4 more outcomes

Named customers21 records

Segments7 records

Ideal customer profiles5 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability4 records

Feature4 records

Scale indicators7 records

Recent moves5 records

Expansion highlights5 records

Direct peers

• NCC Group: UK-headquartered global cybersecurity services firm with a substantial Assurance division focused on penetration testing, red teaming, and security consulting — directly comparable in service mix and enterprise client focus to Citadelo.
• Bishop Fox: Elite US-based offensive security firm offering penetration testing, red teaming, and AI security assessments — comparable boutique positioning and high-end enterprise client roster as Citadelo.
• NetSPI: US penetration testing and attack surface management firm with a strong enterprise foothold — comparable in offering breadth (pen testing, red teaming, vulnerability management) and Fortune 500 client mix.
• Trail of Bits: US-based security research and consulting firm specializing in application security, cryptography, and AI/LLM security reviews — competes directly with Citadelo's AI testing practice and high-end pen testing.
• Coalfire: US-based cybersecurity advisory specializing in penetration testing, red teaming, and compliance assessments (PCI-DSS, HIPAA, SOC) — directly comparable service set to Citadelo.
• SECURA: Netherlands-based cybersecurity firm focused on penetration testing, red teaming, and compliance testing — closest European competitor with similar regulatory compliance positioning as Citadelo.

Broad incumbents

• Trustwave: Global cybersecurity services and MDR provider with a deep penetration testing and offensive security practice — broader portfolio than Citadelo but overlapping enterprise client base.
• Rapid7: Public cybersecurity platform with managed pen testing and vulnerability management services — competes for Citadelo's enterprise wallet from a product-plus-services angle.

Emerging players

• XM Cyber: Breach and attack simulation platform that overlaps with Citadelo's red teaming offering — represents the platformization threat to traditional human-led pen testing services.
• HackerOne: Bug bounty and penetration testing as a service marketplace — competes for vulnerability discovery budgets via crowdsourced models rather than traditional consulting engagements.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat3 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/citadelo
• YouTubeyoutube.com/c/Citadelo
• Facebookfacebook.com/citadelocom
• LinkedInlinkedin.com/company/citadelo

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Citadelo