What Penumbra Security does

Penumbra Security, Inc. is a NIST NVLAP accredited Cryptographic Security Testing Laboratory (CSTL) headquartered in Clackamas, Oregon, operating as a specialized professional services firm focused on security conformance testing and certification for government and enterprise clients. Its core offering is accredited cryptographic security testing under FIPS 140-3 Security Levels 1-4 (NVLAP Laboratory Code 200983-0), supplemented by postal security systems evaluations, network and web application penetration testing, SAFE-IT certification for network-connected peripherals, physical security assessments, and IT infrastructure audits.

The company serves two primary verticals: government and postal entities as the main segment (with named customers including USPS, Canada Post, UK Royal Mail, and Deutsche Post), and large enterprises as a secondary segment. Penumbra self-describes as the world leader in postal security testing, with an established geographic footprint across North America and Europe despite its small 1-10 employee footprint.

The business model is project-based professional services with quote-based, multi-year contracts and direct enterprise sales motion; revenue is generated through custom testing engagements rather than a software product. Distribution is direct (website inquiry, email, and field sales), with no apparent channel partners, marketplace presence, or self-serve product offering. No funding rounds, acquisitions, or leadership changes are documented in the available data.

Name

Penumbra Security

Legal name

Penumbra Security, Inc.

Website

https://pensec.org

Company type

Private

Founded year

2011

Operating status

Operating

Headcount range

1–10 employees

Short description

Penumbra Security is a NIST NVLAP accredited cryptographic security testing laboratory providing FIPS 140-3 conformance testing, postal security evaluations, and penetration testing primarily to government postal entities and large enterprises across North America and Europe.

Ownership category

akta.pro rank

Product category

Security Testing Services

NAICS

Testing Laboratories and Services (54138)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Vulnerability Assessment, Security Audits & Compliance Testing (BPAKAHAG)

akta.pro secondary industries

Penetration Testing & Red Teaming (BPAKAHAF), Vulnerability Management & Penetration Testing Services (BPAEADAD)

Keywords

• FIPS 140-3 testing
• Postal security testing
• Cryptographic security testing
• Penetration testing services
• Security conformance testing

Headquarters

HQ city

Clackamas

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales

Revenue model

1. Security Testing and Certification Services: Professional services revenue from providing security testing, conformance certification, and compliance auditing. Includes FIPS 140-3 testing, PEN testing, postal security assessments, and IT infrastructure audits. Revenue model based on project-based engagements with government and enterprise clients requiring certification and compliance verification.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels2 records

Core offering

Penumbra Security is a NIST NVLAP-accredited Cryptographic Security Testing Laboratory (CSTL, Laboratory Code 200983-0) that provides information security conformance testing to government standards and regulatory compliance. Its core offerings include FIPS 140-3 cryptographic module testing across Security Levels 1-4, postal security systems evaluations, network and web application penetration testing, SAFE-IT peripheral certification, physical security assessments, and IT infrastructure audits.

Product overview

Penumbra Security is a NIST NVLAP-accredited Cryptographic Security Testing Laboratory (CSTL) offering a portfolio of security testing and certification services. The company operates as a single-service platform providing specialized conformance testing rather than a software product company. Its core offerings include FIPS 140-3 cryptographic testing (accredited for Security Levels 1-4), postal security systems evaluations (serving USPS, Canada Post, UK Royal Mail, Deutsche Post), PEN testing (network and web application), SAFE-IT peripheral certification, web application testing, physical security assessments, and IT infrastructure audits. These services are delivered by security experts proficient in cryptographic security techniques and regulatory compliance.

Differentiator

Problem solved

Functional benefit

Brands

• SAFE-IT: Testing and certification service that provides assurance of the security, functionality, and interoperability of network-connected peripherals.

Products and services

• FIPS 140-3 Testing Cryptographic security testing services accredited under NVLAP (Laboratory Code 200983-0) for FIPS 140-3 Security Levels 1-4, providing conformance testing to government cryptographic standards for module vendors and government agencies.
• Postal Security Testing World-leading postal security systems evaluations and assessments for major global postal entities including USPS, Canada Post, UK Royal Mail, and Deutsche Post, covering testing, compliance, and conformance for postal infrastructure.
• PEN Testing Network and web application penetration testing services including architecture reviews, security assessments, and vulnerability analysis conducted by security professionals for enterprise and government clients.
• SAFE-IT Testing and certification service providing assurance of the security, functionality, and interoperability of network-connected peripherals for vendors and government agencies.
• Web Application Testing Security testing services for web applications, identifying vulnerabilities and providing security assessment reporting for organizations deploying web-based systems.
• Physical Security Physical security assessment and evaluation services for organizations requiring evaluation of physical access controls, facility security, and related protective measures.
• IT Infrastructure Audits IT infrastructure auditing services for various industries, providing independent assessment of security controls, configurations, and compliance posture across enterprise environments.

Named customers4 records

Segments2 records

Ideal customer profiles2 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Scale indicators2 records

Recent moves4 records

Expansion highlights4 records

Broad incumbents

• Trustwave: Global cybersecurity services and testing provider offering penetration testing, vulnerability assessments, and compliance audits. Broad incumbent with overlapping services in PEN testing and security auditing segments.
• Leidos: Large federal contractor with cybersecurity services including FIPS validation, PEN testing, and security compliance for government agencies. A broad incumbent competing for the same federal and postal security testing budgets.
• Booz Allen Hamilton: Major management and technology consulting firm with a significant federal cybersecurity practice that includes FIPS testing, vulnerability assessments, and PEN testing. Competes for the same government and enterprise security services engagements.
• ICSA Labs (Intertek): Long-established security testing and certification division of Intertek providing FIPS, Common Criteria, and product security testing. A larger incumbent with overlapping accredited testing capabilities targeting similar government and enterprise customers.
• UL Verification Services: Global safety and security testing/certification arm of UL offering FIPS 140-3 and Common Criteria evaluation services. A broad incumbent with accredited labs competing for the same module vendor and government customers.

Direct peers

• IOActive: Specialized cybersecurity services firm providing penetration testing, security assessments, and vulnerability analysis for hardware and software products. Comparable in its PEN testing and security assessment offerings to Penumbra's non-FIPS service lines.
• Acumen Security: NVLAP-accredited Cryptographic and Security Testing laboratory that performs FIPS 140-3 validation and security testing for cryptographic modules. Operates as a direct competitor in the same CSTL niche serving federal and enterprise customers.
• EWA-Canada: Canadian-based IT security testing laboratory offering FIPS 140-3 conformance testing, Common Criteria evaluation, and cryptographic security assessments. Directly competes with Penumbra in accredited cryptographic module testing services.
• Serma Safety & Security: European security evaluation laboratory providing FIPS 140-3 testing, Common Criteria, and embedded security assessments. Directly competes in cryptographic and security conformance testing for module vendors globally.

Regional players

• TÜV Informationstechnik (TÜViT): German-based testing and certification body offering FIPS 140-3, Common Criteria, and product security evaluation. Provides comparable accredited security testing services, primarily serving European customers with overlap to Penumbra's postal and enterprise accounts in EMEA.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/penumbra-security-inc-

Compliance1 record

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Penumbra Security