Sisoft Sp Z O O

What Sisoft Sp Z O O does

Sisoft Sp. z o.o. is a Kraków-based, privately held cybersecurity consulting firm founded in 2006, operating as a limited liability company under Polish law. The firm delivers an integrated offensive-and-defensive cybersecurity practice combining penetration testing (web, mobile, infrastructure, IoT/OT, vehicles), social engineering assessments, security audits against ISO/IEC 27001, TISAX, NIST, KSC, DORA and related frameworks, vCISO services, managed Security Operations Center (SOC) monitoring, and structured cybersecurity training through its Akademia Sisoft e-learning portal. Its technical differentiation centers on the proprietary EurisQ GRC platform, which automates ICT supplier cybersecurity assessment for entities subject to NIS2, DORA, and the Polish KSC Act, layered on top of a documented 4D methodology (Diagnosis, Roadmap, Delivery, Improvement).

The company sells through a consultative, sales-led GTM anchored by free initial consultations and a free KSC2 diagnostic workshop, then converts into one of four revenue streams: project-based professional services (penetration tests, audits, training, multi-year contracts), subscription-based Cybersecurity-As-A-Service (vCISO) with Time-and-Material expert hours, recurring managed SOC services, and likely SaaS-licensed EurisQ. SISOFT serves roughly 700+ clients across 12 countries on 4 continents, with 340 ISMS certifications delivered and 8,000+ employees trained cumulatively. Its primary verticals are Automotive (TISAX, ISO/SAE 21434, UN R155/R156), Finance and Insurance (DORA, ISO 27001/27017/27018), and Government and Public Administration (KSC, NIS2, interoperability frameworks), supplemented by Software Houses, E-commerce, Manufacturing, and Startups.

The firm holds ISO/IEC 27001:2013 and ISO 9001:2015 certifications, and its offensive and defensive teams are staffed with CISSP, CRISC, OSCP, OSWE, CEH, and Lead Auditor credentialed consultants. Notable enterprise and public-sector references include BNP Paribas, PERN, LG, OOREDOO, Morele, the City of Kraków, the Polish Ministry of Culture, and defense entities PCO and DCO. No external investors, funding rounds, or M&A activity are disclosed; ownership appears founder/management-retained.

Name

Sisoft Sp Z O O

Legal name

SISOFT Spółka z ograniczoną odpowiedzialnością

Website

https://sisoft.pl

Company type

Private

Founded year

2006

Operating status

Operating

Headcount range

11–50 employees

Short description

Sisoft Sp. z o.o. is a Kraków-based cybersecurity consulting firm founded in 2006 that delivers penetration testing, security audits, vCISO, SOC, and training services, plus the proprietary EurisQ GRC platform, to over 700 clients in Automotive, Finance, and Government across 12 countries.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting Services

NAICS

Management, Scientific, and Technical Consulting Services (5416), Other Scientific and Technical Consulting Services (54169), Computer Systems Design and Related Services (54151), Software Publishers (513210)

akta.pro primary industry

Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF)

akta.pro secondary industries

Compliance Technology, GRC Platforms & Controls Automation Advisory (BPAHAFAO), Cybersecurity Operations Outsourcing (SOC / SecOps) (BPAEAMAG), Security Operations Center (SOC) as a Service (BPAEADAB), Governance, Risk & Compliance (GRC) & Security Management (EDAOAIAG)

Keywords

• Penetration testing services
• Cybersecurity consulting
• Security compliance audits
• Managed security services
• GRC platform software

Headquarters

HQ city

Kraków

HQ country

Poland

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Professional Cybersecurity Consulting Services: Core revenue stream from penetration testing, social engineering assessments, security audits, and compliance implementation projects. Delivered as discrete consulting engagements with defined scope.
2. Cybersecurity-As-A-Service (vCISO): Virtual CISO and cybersecurity risk management delivered in a subscription (abonament) model, supplemented by expert hours in a Time and Material structure. Provides recurring revenue through ongoing retainer relationships.
3. Security Operations Center (SOC): Continuous security monitoring services, likely delivered as a recurring managed service retainer.
4. Training and Awareness Programs: Dedicated cybersecurity training programs for employees and management, including security awareness and cybersecurity strategy workshops, delivered as instructor-led or e-learning courses through the Sisoft Academy portal.
5. EurisQ GRC Platform: Automated ICT supplier cybersecurity assessment platform, likely offered as a SaaS or licensed subscription tool.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels8 records

Core offering

SISOFT is a Kraków-based cybersecurity consulting firm that delivers offensive and defensive services including penetration testing, social engineering assessments, security audits, compliance implementations (ISO/IEC 27001, TISAX, NIS2/KSC, DORA), vCISO subscriptions, and Security Operations Center (SOC) monitoring. The firm also sells EurisQ, a proprietary GRC platform that automates ICT supplier cybersecurity assessment for entities subject to NIS2, DORA, and the Polish KSC Act.

Product overview

Sisoft Sp Z O O is a Kraków-based cybersecurity consulting firm founded in 2006, offering a portfolio of professional services centered on offensive security testing, defensive security consulting, and regulatory compliance advisory. The core offering includes penetration testing and social engineering assessments (offensive), security audits and cybersecurity management (defensive), and a GRC platform called EurisQ. These are complemented by Cybersecurity-As-A-Service (vCISO), a Security Operations Center (SOC), cybersecurity training via Akademia Sisoft, and compliance audit services spanning ISO 27001, TISAX, NIS2/DORA, and KSC. The EurisQ GRC platform serves as the primary software product, while the remaining services are delivered as consulting engagements.

Differentiator

Problem solved

Functional benefit

Brands

• Akademia Sisoft: E-learning portal for cybersecurity training and awareness programs
• EurisQ

Products and services

• EurisQ GRC Platform

Quantifiable outcome

• 340 information security management system certifications designed and implemented for clients
• +3 more outcomes

Named customers18 records

Segments7 records

Ideal customer profiles6 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature4 records

Scale indicators5 records

Direct peers

• NCC Group: UK-listed cybersecurity consulting firm offering penetration testing, managed detection/response, and compliance advisory. Closest direct peer given its mix of offensive security services, compliance work (ISO 27001, NIS regulations), and recurring managed services.
• Trustwave: Global cybersecurity firm combining managed security services, penetration testing, database security, and consulting. Comparable due to its blended offensive testing, managed SOC, and compliance advisory offering.
• WithSecure (formerly F-Secure): Finland-headquartered cybersecurity firm delivering consulting, managed detection and response, and compliance services across Europe. Comparable as a mid-sized European cybersecurity specialist with a similar consulting-plus-managed-services mix.
• Orange Cyberdefense: European MSSP and cybersecurity consultancy owned by Orange, providing SOC, penetration testing, compliance, and threat intelligence across multiple European markets. Comparable as a Europe-wide cybersecurity services provider with regulated-sector focus.

Broad incumbents

• Atos Cybersecurity (Eviden): Global IT services group (operating as Eviden) with a dedicated cybersecurity portfolio including SOC services, identity, and compliance. Competes with SISOFT on European enterprise and public-sector cybersecurity engagements.
• Deloitte (Poland Cybersecurity practice): Big 4 advisory firm with a substantial Polish cybersecurity and risk advisory practice covering ISO 27001, NIS2/DORA, pen testing, and GRC. Competes for the same enterprise and public-sector clients as SISOFT at the higher end of the market.
• EY Poland (Cybersecurity): Big 4 firm providing cybersecurity consulting, compliance, and managed services in Poland with a focus on financial services and regulated industries. Overlaps with SISOFT in GRC, ISO, and DORA/NIS2 advisory work.
• KPMG Poland (Cybersecurity): Big 4 advisory firm with a cybersecurity advisory practice in Poland serving financial services, public sector, and industrial clients. Competes for regulated-sector GRC and compliance mandates.

Regional players

• Asseco Poland: Major Polish IT group with cybersecurity offerings for banking, public sector, and enterprise customers. Comparable as a large domestic peer operating in similar regulated verticals across Poland and Central Europe.
• Comarch: Large Kraków-headquartered IT services and software company with a cybersecurity practice serving Polish and European enterprises. Most directly comparable Polish peer in scale and geographic footprint, with overlapping regulated-sector clients.

Market position

Strengths5 records

Weaknesses5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Facebookfacebook.com/sisoftpl
• LinkedInlinkedin.com/company/sisoftpl

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles6 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Sisoft Sp Z O O