What ISGroup does

ISGroup SRL is an Italian boutique cybersecurity firm headquartered in Verona that delivers independent offensive and defensive security services to enterprise clients, ICT operators, and public administrations. Founded as an operating business in 2005 (with company materials noting active security operations since 2013), the firm specializes in penetration testing (network, web application, mobile), vulnerability assessment, ethical hacking, code review, training, and managed security services including vCISO, Vulnerability Management Service, Cyber Threat Simulation, threat intelligence, and SOC monitoring. ISGroup's named engagements span banking (UBI Banca, Add Value), retail (Coop Italia), media (Mediaset, Libero), FMCG (Nestlé), government (Repubblica Italiana, ISWEB public-administration platform), and software development (Creactives, Kelyon, Progel, TimeFlow, TECNORAD, Sturnis), and the company is certified to UNI EN ISO 9001:2015 and UNI CEI EN ISO/IEC 27001:2022 (reaffirmed December 29, 2023, valid through 2026).

The technology stack centers on proprietary SaaS and tooling developed in-house. Ganapati is a multi-tenant vulnerability scanning SaaS with API-driven partner workflows; VulnMAP cross-references vulnerabilities across ten databases (NIST NVD, OSVDB, Mitre CVE, Exploit-DB, Rapid7, Nessus, Secunia, McAfee, Bugtraq, ISS Xforce); Exposure monitors online information leakage about websites; SCADA Exposure targets industrial control systems and national critical infrastructure; and Ostorlab integration delivers mobile application security scanning for iOS and Android across 12+ frameworks via static, dynamic, backend, and behavioral analysis engines. The firm also maintains The Bunker (a Verona-based hacklab, coworking space, and training facility) and ush.it, a non-commercial research platform that has published 35+ security advisories and CVEs since 2005 against vendors including Apache, Fortinet, Nginx, PHP, Moodle, QNAP, Veeam, and SugarCRM.

ISGroup operates a hybrid go-to-market combining direct enterprise sales (quote-based pricing, Calendly booking with founder/COO Francesco Ongaro, WhatsApp and email intake) with software distribution: it is the official Italian reseller for PortSwigger Burp Suite (Enterprise and Professional editions priced €449-€25,185) and the official Italian distributor for Micro Focus and OpenText. Revenue streams span professional services (penetration testing, audits, code review), recurring managed services (vCISO, VMS, CTS, SOC), SaaS subscriptions (Ganapati, VulnMAP), per-scan mobile testing (€359 + VAT via Ostorlab), and software licensing margin. Delivery is executed through a network of senior freelance consultants keeping headcount at 1-10, and the firm has raised no external capital.

Name

ISGroup

Legal name

ISGroup SRL

Website

https://isgroup.biz

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

1–10 employees

Short description

ISGroup SRL is an independent Italian cybersecurity firm based in Verona that delivers penetration testing, vulnerability assessment, managed security, and proprietary scanning tools to enterprise and public-administration clients across banking, retail, media, technology, and government sectors.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Computer Systems Design and Related Services (54151)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Site Reliability Engineering (SRE) & Reliability Operations (BPAEAKAD)

Keywords

• Penetration testing services
• Vulnerability assessment
• Ethical hacking
• Cybersecurity consulting
• Managed security services

Headquarters

HQ city

Verona

HQ country

Italy

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations

Revenue model

1. Professional Cybersecurity Services: Core revenue stream from penetration testing (network, web application, mobile), vulnerability assessment, ethical hacking, code review, and training services. Delivered by senior freelance consultants.
2. Managed Services: Recurring revenue from managed security services including vCISO, Vulnerability Management Service (VMS), Cyber Threat Simulation (CTS), Threat Intelligence, SOC monitoring.
3. Software Distribution - PortSwigger: Reseller revenue from selling PortSwigger Burp Suite Enterprise Edition and Professional licenses in Italy. Prices range from €449 to €25,185 depending on edition and duration.
4. Software Distribution - Micro Focus/OpenText: Official distributor of Micro Focus and OpenText software products including license sales, consulting, implementation, and technical support.
5. SaaS Products: Revenue from SaaS platforms including Ganapati (vulnerability scanning), VulnMAP (vulnerability database), and other security tools.
6. Mobile Application Security Testing: Automated mobile app scanning service at €359 + VAT per scan, covering static, dynamic, and backend analysis.

Pricing tiers

Go-to-market motion2 records

Distribution channels5 records

Marketing channels8 records

Core offering

ISGroup SRL is an independent IT Security boutique that delivers offensive and defensive cybersecurity services — network, web application and mobile penetration testing, vulnerability assessment, ethical hacking, code review, managed security, GRC, SecOps and SSDLC — to Italian and European enterprises and public bodies. The company complements these services with proprietary SaaS platforms (Ganapati vulnerability scanner, VulnMAP vulnerability database, Exposure reputation tool, SCADA Exposure ICS monitoring) and acts as official Italian reseller/distributor for PortSwigger Burp Suite and Micro Focus/OpenText security software.

Product overview

ISGroup is an independent IT Security company offering a portfolio of cybersecurity products and services. The product portfolio consists of: (1) Proprietary security tools including VulnMAP (vulnerability database cross-referencing NIST NVD, OSVDB, CVE, Exploit-DB, Nessus, and other sources), Ganapati (SaaS multi-tenant vulnerability scanning platform), SCADA Exposure (ICS/SCADA security monitoring), EasyAudit and ICT Audit (automated security assessments), Exposure (security reputation monitoring), and a Starter Kit entry-level WAPT offering; (2) Professional services including Ethical Hacking, Network Penetration Testing, and hacklab/community offerings like The Bunker Hacklab, The Bunker Coworking, and The Bunker Courses; (3) Distribution partnerships for PortSwigger Burp Suite, Microfocus/OpenText, and Ostorlab mobile security scanning; (4) Spin-off products including USH (security research platform), PracticalRP (medical practice ERP), and Metasploit/EXEEC. The core offering combines proprietary SaaS vulnerability management tools with professional penetration testing services and training programs.

Differentiator

Problem solved

Functional benefit

Products and services

• Vulnerability Assessment Systematic security assessment that identifies and reports known vulnerabilities across IT infrastructure, web and mobile applications; delivered for enterprise customers and security agencies.
• Network Penetration Testing Intelligence-driven network penetration testing service covering discover, fingerprint, attack and penetrate phases against enterprise networks and infrastructures.
• Web Application Penetration Testing Application security assessment service that identifies vulnerabilities in web applications by simulating real-world attack scenarios; one of ISGroup's primary service offerings executed for enterprises, SaaS vendors and public administrations.
• Mobile Application Security Testing Security testing of iOS and Android mobile applications using static, dynamic, behavioral and backend analysis engines; delivered to enterprises and software vendors.
• Code Review Manual and automated source code review that identifies vulnerabilities in application source code; intended for development teams and software vendors building secure applications.
• Ethical Hacking Simulated external or internal attacker engagement whose strategies are not bounded strictly to technical aspects; part of ISGroup's offensive service portfolio.
• Training Professional training paths for offensive (auditors, penetration testers) and defensive (network administrators, developers) staff, designed to reduce security-related costs and build internal capability.
• Managed Security Services Recurring managed security offerings including vCISO, Vulnerability Management Service (VMS), Cyber Threat Simulation (CTS), Threat Intelligence, and SOC monitoring on subscription.
• Governance, Risk and Compliance GRC advisory supporting organizations in aligning with GDPR, NIS2, PCI DSS, ISO 27001 and other regulatory frameworks, including ISMS implementation support.
• SecOps Services Security Operations services integrating detection, response and operational security controls for client environments.
• SSDLC Services Secure Software Development Lifecycle services helping organizations integrate security into software design, coding, testing and deployment processes.
• Ganapati SaaS vulnerability-scanning platform that scans networks, servers or applications in both external and internal environments, with multi-user workflow, a multi-tier partner system and fully-automated partner websites integrated via API.
• VulnMAP Complete cross-reference vulnerability database aggregating data from NIST NVD, OSVDB, Mitre CVE, Exploit-DB, Rapid7, Nessus, Secunia, McAfee, Bugtraq ID and ISS Xforce for integrated vulnerability knowledge management.
• SCADA Exposure Security monitoring service for Industrial Control Systems (SCADA, HMI, PLC, RTU) designed to generate awareness and improve security of national critical infrastructure.
• Exposure Security reputation tool that helps webmasters understand what information about their websites is exposed on the internet and to identify exposure to script-kiddie attackers.
• EasyAudit External security assessment offering Network and Web Application Penetration Testing with 24/7 technical support and flat-fee professional packages targeted at small and medium businesses.
• ICT Audit Automated security auditing service combining network and web application scanning technologies to deliver enterprise-level audit results.
• Starter Kit Entry-level web application security audit service for new customers at €420 + VAT per working day of senior-technician testing on internet-exposed websites, following OWASP and OSTMM standards with a money-back guarantee.
• Ostorlab Mobile Application Security Scan Self-service mobile application security scanning service for iOS and Android using static, dynamic and backend analysis engines, supporting 12+ multi-platform frameworks and priced at €359 + VAT per scan.
• PortSwigger Burp Suite (Italian Reseller) Official Italian reseller offering for PortSwigger Burp Suite Enterprise and Professional editions, with pre- and post-sale support, subscription pricing from €449 to €25,185 depending on edition and duration.
• Micro Focus and OpenText Software (Italian Distributor) Official Italian distributor channel for Micro Focus and OpenText software, providing license sales, consulting, implementation and ongoing technical support to enterprise customers.
• The Bunker Hacklab HackerSpace/Maker/Creative Space laboratory in Verona for socializing, collaboration and knowledge exchange about technology, electronics, science and art.
• The Bunker Coworking Flexible coworking space in Verona center (Via Roma and Via Cantarane) with telecom fiber connectivity, wireless access and weekend access for individual professionals and small teams.
• The Bunker Courses Professional training courses in Programming, Cyber Security, Networking and Devops, taught by industry professionals with theoretical and practical components including hands-on challenges.

Quantifiable outcome

• Successful Web Application Penetration Testing identified and resolved vulnerabilities for enterprise clients in banking, retail, government, and technology sectors
• +2 more outcomes

Named customers18 records

Segments4 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration11 records

Feature7 records

Partnerships

18 partnerships are on record, tiered strategic, core and minor.

• RootersstrategicStrategic or Co-development Partner · 11 December 2025Strategic Cybersecurity Partnership between Rooters and ISGroup S.r.l. documented as a case study relationship.
• PortSwigger LtdcoreChannel Partner/ Reseller/ DistributorOfficial Italian reseller of PortSwigger Burp Suite products. Offers payment via bank transfer and provides pre and post-sale support for Enterprise Edition and Professional versions.
• Micro Focus and OpenTextcoreChannel Partner/ Reseller/ DistributorOfficial distributor of Micro Focus and OpenText software products. Provides software license sales, consulting, implementation, and technical support services.
• OstorlabcoreTechnology or IntegrationOstorlab provides mobile application security scanning technology used by ISGroup. The technology supports iOS and Android apps with Static, Dynamic, Backend analysis. Used by more than 1,000 developers, security, and privacy professionals.
• ush.it (Underground Security Hub)coreStrategic or Co-development PartnerNon-commercial research platform where ISGroup researchers publish security advisories, develop exploits, and conduct bug hunting. Active publication of CVE advisories since 2005.
• DEF CONminorOthersISGroup participated in DEF CON 31 cybersecurity conference, demonstrating involvement in the broader security community.
• International Journalism FestivalminorOthersISGroup participated in International Journalism Festival events including 'The Lost War on Information Security' and 'Hacking Landscape' presentations.
• TECNORAD S.R.L.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study partnership for Pitagora and Tecnoradon applications.
• Progel SAstrategicStrategic or Co-development PartnerWeb Application Penetration Test case study for MyPlanet platform.
• TimeFlow S.r.l.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study for Workforce Management Platform, Vendor Management Platform and Marketplace.
• Kelyon S.r.l.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study for Flora application.
• Sturnis S.r.l.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study for Sturnis365 corporate disclosure management platform.
• Creactives S.p.A.strategicStrategic or Co-development PartnerComprehensive security partnership including Web Application Penetration Test, ISMS support compliant with ISO 27001/27017/27018, and secure software development training.
• Alias Group S.r.l.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study for DocEasy electronic invoice management platform.
• Add Value S.r.l.strategicStrategic or Co-development PartnerComprehensive security partnership including WAPT on TSV8, Vulnerability Assessment and Penetration Testing on entire IT infrastructure.
• Prime Service S.r.l.strategicStrategic or Co-development PartnerNetwork Penetration Test case study for IT infrastructure security assessment.
• ISWEB S.p.A.strategicStrategic or Co-development PartnerWeb Application Penetration Test case study for eALBO public administration platform.
• Coop ItaliastrategicStrategic or Co-development PartnerComprehensive security testing partnership including Web Application Penetration Testing on GPS, Salvatempo, SAPCRM, WinEpts and Network Penetration Test on entire external perimeter.

Scale indicators3 records

Recent moves6 records

Expansion highlights7 records

Broad incumbents

• Secureworks: Global cybersecurity services and managed detection provider (NYSE: SCWX) covering vulnerability assessment, penetration testing, and managed SOC. Overlapping capability set with ISGroup's combined offensive and managed services portfolio.
• NCC Group: UK-listed cybersecurity services and consulting firm offering penetration testing, managed security, and threat intelligence. Much larger broad incumbent competing for the same enterprise testing and assurance budgets that ISGroup targets in Italy.
• Positive Technologies: Cybersecurity vendor offering penetration testing, vulnerability management products (MaxPatrol), and security consulting. Overlaps with ISGroup's combined advisory services and proprietary scanning tooling (Ganapati, VulnMAP).
• WithSecure: Finnish-listed cybersecurity vendor (formerly F-Secure business) offering managed security, penetration testing, and consulting. Comparable mix of offensive security services and managed/recurring revenue that ISGroup is moving toward.

Direct peers

• Pen Test Partners: UK-based specialist penetration testing and security assurance boutique focused on web, mobile, network, and IoT testing. Closely comparable size, service mix, and customer profile to ISGroup's offensive security practice.
• Trail of Bits: US-based security research and consulting boutique offering code audit, penetration testing, and security tooling with a strong researcher publication record. Comparable boutique scale and credibility driven by CVE/advisory output like ISGroup's ush.it channel.
• NetSPI: US-based penetration testing and vulnerability management firm combining human-led offensive security with its own scanning technology. Comparable business model blending consultancy services with proprietary platform tooling.
• Bishop Fox: US-based offensive security boutique offering penetration testing, red teaming, and product security assessments. Highly comparable posture to ISGroup: researcher-driven, boutique in scale, focused on high-end technical testing engagements.
• Cure53: Berlin-based boutique cybersecurity firm specializing in web application penetration testing, code review, and security research. Most comparable peer to ISGroup given similar size, vendor-agnostic positioning, researcher-led culture, and penetration testing focus on European clients.
• Secarma: UK penetration testing and cyber resilience boutique covering web, network, mobile, and cloud testing, plus managed security services. Closely comparable size and service mix to ISGroup.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/ISGroupSRL
• LinkedInlinkedin.com/company/isgroup-srl

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ISGroup