Oppida

What Oppida does

Oppida is a French cybersecurity audit and consulting firm operating as a wholly-owned subsidiary of the Apave Group, with approximately two decades of operating history and a headcount of 45 expert collaborators based in Montigny-le-Bretonneux, France. The firm specializes in Information Systems Security (SSI) and serves a dual client base of French government administrations (Defense, Prime Minister's Office, Ministries) and private-sector organizations including banks, insurance companies, retail, industrial operators, and SMEs. Its core positioning rests on an officially accredited CESTI laboratory status enabling Common Criteria (ISO 15408) and CSPN security product evaluations recognized by ANSSI, the French national cybersecurity agency.

The service portfolio is structured across five integrated lines: (1) IT and industrial security audits including black-box and white-box penetration testing and source code audits; (2) cybersecurity consulting covering risk analysis, ISMS implementation, and ISO 27001 certification preparation; (3) accredited security product evaluations under Common Criteria and CSPN frameworks; (4) professional training and awareness programs; and (5) applied research collaboration under French national (RAPID, PIA, FIU) and European (H2020) programs in partnership with industrial and academic actors. The firm executes 400+ missions and 200+ CESTI evaluations annually, with technical depth anchored in ANSSI-issued habilitations held by individual consultants.

The business model is professional services-based and sales-led, with revenue generated from consulting engagements, project-based audits, official product evaluations, and training programs. Pricing is quote-based and tailored to client requirements with no public disclosure. Distribution runs through direct client engagement rather than intermediaries, and marketing is primarily thought-leadership oriented through LinkedIn, a dedicated blog (blog.oppida.apave.com), and the parent Apave Group's social presence. The go-to-market is consultative and relationship-driven, targeting organizations requiring high-level security expertise and regulatory-recognized certifications. Leadership is provided by Anne Perrin in the role of Directrice Générale.

Name

Oppida

Legal name

Oppida

Website

https://oppida.fr

Company type

Private

Founded year

2003

Operating status

Operating

Headcount range

11–50 employees

Short description

Oppida is a French cybersecurity audit and consulting firm specializing in Information Systems Security for government and private-sector clients. It operates an ANSSI-accredited CESTI laboratory for Common Criteria and CSPN product evaluations as a subsidiary of the Apave Group.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting and Audit Services

NAICS

Other Scientific and Technical Consulting Services (54169), Professional, Scientific, and Technical Services (54)

SIC

Services-Business Services, Nec (7389), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Security Audits & Compliance (ISO 27001, SOC 2, PCI DSS, HIPAA, SOX) (BPAKADAC)

Keywords

• Cybersecurity consulting services
• Penetration testing services
• Security product evaluations
• ISO 27001 certification support
• Information systems security

Headquarters

HQ city

Montigny-le-bretonneux

HQ country

France

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Revenue model

1. Professional Consulting Services: Revenue generated from cybersecurity consulting services including security approach development, risk analysis, security documentation, ISMS implementation, and ISO 27001 certification assistance.
2. Security Audits: One-time project-based revenue from penetration testing and security code audits.
3. Security Product Evaluations: Revenue from official product security evaluations (Common Criteria and CSPN) performed as an accredited laboratory.
4. Training Services: Training and awareness programs in cybersecurity for various client organizations.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels5 records

Core offering

Oppida is an ANSSI-accredited cybersecurity expertise firm providing security audits and penetration testing (black-box, white-box, and source code audits), cybersecurity consulting (risk analysis, ISMS implementation, ISO 27001 certification support), formal security product evaluations as an officially accredited CESTI laboratory under Common Criteria (ISO 15408) and CSPN frameworks, professional training and awareness programs, and applied research collaboration. Services are delivered to French government administrations (Defense, Prime Minister's Office, Ministries) and regulated private-sector organizations (operators, banks, insurance, retail, industry, SMEs).

Product overview

Oppida is a cybersecurity expertise, evaluation, and consulting firm providing a unified portfolio of five integrated services. The core offerings include IT and industrial security audits with penetration testing, cybersecurity consulting for risk management and ISO 27001 certification preparation, security product evaluation under CSPN and Common Criteria (ISO 15408) frameworks, professional training and awareness programs, and applied research collaboration. As a subsidiary of the Apave Group, Oppida serves both government entities (Defense, Prime Minister's Office, Ministries) and private sector organizations (operators, banks, insurance, retail, industry, SMEs).

Differentiator

Problem solved

Functional benefit

Products and services

• Audit IT et industriels (IT and Industrial Audits) Security audits and penetration testing services (black-box or white-box), including source code audits, to assess the information security posture of enterprises. Designed for organizations needing an independent review of IT and industrial system security.
• Conseil en cybersécurité (Cybersecurity Consulting) Cybersecurity consulting services covering security approach development, risk analysis, security documentation, ISMS implementation, and ISO 27001 certification preparation assistance. Targeted at organizations formalizing their information security management and seeking certification readiness.
• Evaluation CSPN et Critères Communs (CSPN and Common Criteria Evaluations) Official security product evaluations conducted by an ANSSI-accredited CESTI laboratory under Common Criteria (ISO 15408) and CSPN (Certification de Sécurité de Premier Niveau) frameworks. Available to product vendors and government buyers requiring certified security assurance for IT products.
• Formation (Training) Professional training and awareness programs in cybersecurity aimed at security managers, risk managers, and organizational stakeholders. Designed to build internal capability in client organizations.
• Recherche (Research) Participation in applied cybersecurity research projects at French (RAPID, PIA, FIU) and European (H2020) levels, conducted in partnership with industrial players and research laboratories. Offered to partners seeking Oppida's expertise in collaborative R&D engagements.

Quantifiable outcome

• 400+ missions completed annually
• +2 more outcomes

Named customers5 records

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

One partnership is on record.

• Apave GroupcoreStrategic or Co-development PartnerOppida is a wholly-owned subsidiary of the Apave Group. As part of the Apave family, Oppida benefits from the group's resources, brand recognition, and cross-selling opportunities across the Apave network of specialized entities.

Scale indicators4 records

Recent moves5 records

Expansion highlights4 records

Broad incumbents

• Thales Cyber & Digital: Thales is a large French defense and digital technology group with a substantial cybersecurity division covering consulting, encryption, evaluation services, and government-grade cyber solutions. It is a broad incumbent that competes with Oppida in government and certified evaluation work, though as part of a much wider portfolio.
• Capgemini Engineering (Cybersecurity): Capgemini is a global IT services leader whose cybersecurity practice offers consulting, audit, compliance, and managed security to large enterprises and governments. It competes with Oppida in regulated cybersecurity engagements in France and Europe, though at a much larger scale.
• Atos Cybersecurity: Atos (and its Eviden cybersecurity business) is a major European IT services and cybersecurity provider offering consulting, managed security, and compliance services to large enterprises and governments. It competes broadly with Oppida in regulated cybersecurity consulting across Europe.
• Sopra Steria Cybersecurity: Sopra Steria is a major European IT services group with a dedicated cybersecurity practice serving public-sector and regulated clients in France, the UK, and across Europe. It is a broad incumbent competing for many of the same government cybersecurity contracts as Oppida.
• Devoteam Cybersecurity: Devoteam is a European technology consulting firm with a strong cybersecurity practice serving enterprise and government clients across France and neighboring markets. It offers consulting, audits, and managed security services comparable to Oppida's portfolio.

Direct peers

• Orange Cyberdefense: Orange Cyberdefense is the dedicated cybersecurity arm of Orange Group, one of the largest cybersecurity service providers in France and Europe. It offers security consulting, audits, penetration testing, managed detection, and incident response to enterprise and government clients — directly overlapping with Oppida's core consulting and audit portfolio.
• Almond: Almond is a French cybersecurity pure-play offering consulting, audits, integration, and managed security services. Its similar size and target market in France position it as a direct peer to Oppida.
• Advens: Advens is a French cybersecurity services firm providing consulting, SOC services, audits, and managed security to enterprise and public-sector clients across France. It competes head-to-head with Oppida for many of the same government and large-enterprise engagements.
• XMCO: XMCO is a long-established French cybersecurity consultancy offering penetration testing, security audits, incident response, and security advisory services. Its size, customer base, and service mix in France make it a direct comparable to Oppida.
• Synacktiv: Synacktiv is a French cybersecurity firm specializing in offensive security, penetration testing, code audits, and security evaluations for high-profile enterprise and government clients. Its boutique, expert-driven model in pentesting and product security audits closely mirrors Oppida's positioning.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks6 records

Key highlights3 records

Customer concentration

• YouTubeyoutube.com/channel/UC6ZiAcm5IwpJ8rHFf2USoTA
• LinkedInlinkedin.com/company/oppida
• Instagraminstagram.com/apave_officiel/?hl=fr
• Xx.com/oppidafr
• Facebookfacebook.com/oppidacesti

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Oppida