# Cyber Company Profiles: Ethiack

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-09-11
Analyzed 2026-08-18
Canonical: https://cybercompanyprofiles.com/companies/ethiack
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Ethiack, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [ethiack.com](https://ethiack.com)
- Profile: https://cybercompanyprofiles.com/companies/ethiack
- Type: Application Security, Network Security, Security Operations
- Also known as: Ethiack, S.A., Ethiack, Lda
- Market readiness: Established (27/40)
- Defensibility: Contested (14/21)
- Founded: 2022
- Last updated: 2026-08-18

## Executive Summary

Ethiack sells continuous penetration testing to security teams. An AI engine called Hackian maps a customer’s exposed assets, tries to exploit what it finds, and returns reproducible proof, while human ethical hackers run deeper engagements. Ethiack publishes the benchmark it uses to compare automated penetration-testing systems, with its targets and answer key public. PentesterLab’s review said that released data may be the more valuable part, and cautioned that the targets are deliberately vulnerable, so the scores do not stand in for a real engagement. Portugal’s public spending portal records 486,000 euros of contracted work for Ethiack under the state cybersecurity programme, a record of that work independent of the company.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Ethiack sells offensive security as a subscription: an agentic AI engine called Hackian maps a customer's attack surface, attempts exploitation, and reports each confirmed risk with a reproducible proof, with human ethical hackers running deeper engagements alongside it. | [\[f1\]](#company-detail-sources) |
| Founded | 2022 | [\[f2\]](#company-detail-sources) |
| HQ | Coimbra, Portugal | [\[f2\]](#company-detail-sources) |
| Latest funding | Seed (EUR 4 million, December 2024, led by Explorer Investments) | [\[f2\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Ethiack Platform | Subscription platform pairing continuous attack surface management with exploit validation, prioritized risks, and compliance-ready reporting. |
| Hackian | Agentic AI pentesting engine that runs reconnaissance, chains exploitation routines, and attaches a reproduction blueprint to every confirmed finding. |

## Matrix Coverage

Mapped to the [Cyber Defense Matrix](https://cyberdefensematrix.com) [\[f3\]](#company-detail-sources):

| Asset | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|
| Applications | ✓ |  |  |  |  |
| Networks | ✓ |  |  |  |  |
| Devices | ✓ |  |  |  |  |

Hackian enumerates a customer's subdomains, ports, services, and content, then attempts exploitation to establish which weaknesses in those web applications, network services, and servers are reachable, and is mapped to the Cyber Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (27/40)**

Analyzed 2026-08-18. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Ethiack names the buyer and the pain in plain terms, arguing that annual pentest results arrive late and are ranked by severity score rather than by what an attacker can reach. Quantification of that pain in the cited sources comes from Ethiack and its investors rather than from an independent measure. \[[s1](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Capability Depth | 4/5 | Ethiack sets out the engine stage by stage, from reconnaissance through exploitation routines to a reproduction blueprint, and two outside checks reach the offensive work it sells: PentesterLab reviewed the scoring method and released data behind Ethiack’s benchmark, and BleepingComputer and Rapid7 record the Rails Active Storage disclosure as the work of Ethiack researchers with GMO Flatt Security. PentesterLab’s review reaches the benchmark and the disclosure credits reach the team’s own offensive work, and no cited source independently measures the engine running against a customer. \[[s3](#profile-analysis-sources), [s9](#profile-analysis-sources), [s16](#profile-analysis-sources), [s17](#profile-analysis-sources), [s18](#profile-analysis-sources)\] |
| Market Timing | 3/5 | The enabler is agent-based AI applied to exploitation. Ethiack raised 4 million euros in December 2024 to develop its automated continuous pentesting technology. One buyer-side signal appears outside the company, 486,000 euros of contracted work in Portugal’s spending portal, while the DORA demand framing in the cited sources comes from an investor in that round. \[[s12](#profile-analysis-sources), [s14](#profile-analysis-sources), [s1](#profile-analysis-sources)\] |
| Team Credibility | 4/5 | Jornal de Negocios, writing in December 2024, reports that André Baptista took the Most Valuable Hacker title the previous August, becoming one of five people worldwide to have won it twice, after a first win in 2018. BleepingComputer and Rapid7 credit Ethiack researchers for the Rails Active Storage disclosure. \[[s13](#profile-analysis-sources), [s16](#profile-analysis-sources), [s17](#profile-analysis-sources)\] |
| GTM Proof | 4/5 | Ethiack’s pages quote named people at Aegon Santander Portugal, NOS and other accounts, and its customer story names the chief information security officer of the airport operator ANA Aeroportos. One reference is independent of the company: Portugal’s public spending portal lists Ethiack, Lda with 486,000 euros of contracted work under the state cybersecurity investment, and EU-Startups reported a nine-country client base at the December 2024 round. \[[s4](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Funding Efficiency | 3/5 | The 4 million euro seed round led by Explorer Investments closed in December 2024, and EU-Startups reported 1 million euros of turnover across its first two years, so the raise sits alongside the commercial results rather than ahead of them. No revenue, margin or growth figure appears in the cited sources since that announcement. \[[s12](#profile-analysis-sources)\] |
| Category Clarity | 3/5 | Penetration testing is a budget line buyers already hold, and Ethiack layers its own labels over it, selling adversarial exposure validation and autonomous ethical hacking. The placement evidence in the cited sources is a SourceForge directory that ranks alternatives to Ethiack, which is a listing rather than independent category confirmation. \[[s1](#profile-analysis-sources), [s5](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | A SourceForge listing shows the shape of the pressure, with Aikido Security selling automated pentests inside an all-in-one platform a buyer may already run. Ethiack’s ethical-hacker network and its published disclosures raise the effort of a copy, and the cited sources name no cross-customer data asset behind the product. \[[s20](#profile-analysis-sources), [s2](#profile-analysis-sources), [s16](#profile-analysis-sources)\] |

### Business Risks

- The accuracy and speed claims Ethiack leads with, near-zero false positives and testing described as 30 times faster than a manual pentest, are the company’s own measurements, so a buyer who wants an outside read has to run the 30-day trial or the published benchmark before signing.
- The most recent commercial figures published outside the company, 1 million euros of turnover and clients in nine countries, date from the December 2024 seed announcement, so a buyer sizing the business has to ask for current numbers under diligence.
- Every ISO 27001 statement in the cited sources is Ethiack’s own, across a 2023 announcement, a footer line and a pricing-page answer, and no inspectable trust portal appears on the probed surfaces, so a buyer whose procurement requires an auditor’s report has to request the certificate directly.
- Ethiack published its evaluation protocol, its target applications and its annotated vulnerability list, so a competitor can tune against the same test and weaken the comparison Ethiack cites.
- The contracted public work in the cited sources is Portuguese and every customer quote sits on Ethiack’s own page, so a buyer in another market has to ask for a reference it can call.
- Automated pentesting is already sold as one module of a broader platform, as the Aikido Security listing shows, so Ethiack could face buyers who take the capability from a vendor they already pay.

### Problem & Market

Security teams buy penetration testing on a schedule and get a snapshot. Ethiack builds its pitch on that gap, arguing that annual results arrive late and are ranked by severity score rather than by what an attacker can actually reach. The buyer it addresses is the security team that owns an external estate which changes faster than the test cycle.

European regulation is part of the pitch. Ethiack sells reporting aligned to NIS2, DORA, SOC 2, ISO 27001 and PCI, and an investor in the seed round tied the product to financial firms preparing for the EU Digital Operational Resilience Act. That framing comes from the company and its backers rather than from an independent measure of buyer demand.

Public buying confirms part of the demand. Portugal’s public spending portal records Ethiack, Lda as a supplier with 486,000 euros contracted under the state investment to reinforce the national cybersecurity framework, whose direct beneficiary is the national security office. \[[s1](#profile-analysis-sources), [s12](#profile-analysis-sources), [s14](#profile-analysis-sources)\]

### Product Capabilities

Hackian is the engine, and Ethiack describes it in three stages. It enumerates subdomains, resolves DNS, scans ports and fingerprints services, then runs exploitation routines to confirm a weakness, then attaches reproduction steps and impact to each confirmed finding. Ethiack states that the system is a set of coordinated AI agents with deterministic modules rather than prompting on a general model.

The team’s offensive craft is what an outsider can check. Researchers at Ethiack, working with GMO Flatt Security, reported the Rails Active Storage flaw tracked as CVE-2026-66066, which The Hacker News records at a severity score of 9.5, and SC Media credits researchers at Ethiack and Depthfirst with CVE-2026-25253 in the OpenClaw assistant. The cited sources credit those findings to people at Ethiack rather than to the engine.

Ethiack also published the yardstick. Its EthiBench protocol scores agents against 108 expert-annotated vulnerabilities across three open-source targets, and PentesterLab’s weekly review said the released data may matter more than the framework, while cautioning that the targets are intentionally vulnerable and the annotated answer key may be incomplete.

The headline accuracy and speed claims are the company’s own. Its pages claim near-zero false positives and testing 30 times faster than a manual pentest, neither of which the cited sources verify independently, so a buyer weighing them has the 30-day trial or the published benchmark as the check. \[[s3](#profile-analysis-sources), [s5](#profile-analysis-sources), [s9](#profile-analysis-sources), [s10](#profile-analysis-sources), [s15](#profile-analysis-sources), [s16](#profile-analysis-sources), [s17](#profile-analysis-sources), [s18](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Competitive Positioning

Ethiack sits between two things buyers already know. A scanner reports findings nobody has confirmed, and a booked pentest covers one point in time. Ethiack sells both halves in one package: its price page describes each plan as a pentest performed by AI and human ethical hackers, and separates the plans by whether the testing runs once or continuously.

Its published comparison is against open-source agents rather than commercial rivals, so the cited sources carry no head-to-head against the products a buyer would shortlist. Ethiack ran the open-source engines Strix and PentAGI and the general-purpose coding agent Claude Code against its own agent on its own protocol, and reported its agent ahead on the combined discovery and precision measure. Ethiack states the comparison is its own and that the underlying protocol is open for anyone to rerun.

A directory listing places the company in a crowded field. SourceForge’s alternatives page for Ethiack ranks Aikido Security first and lists the pentest-as-a-service vendor Cobalt among the products a buyer would weigh against it. \[[s4](#profile-analysis-sources), [s9](#profile-analysis-sources), [s10](#profile-analysis-sources), [s20](#profile-analysis-sources)\]

### Go-to-Market & Traction

Named references carry the names of people. Ethiack’s pricing page runs a block headed “what security teams say after running Ethiack” holding fifteen quotes, each naming a person and an employer, among them contacts at Aegon Santander Portugal and NOS, and its customer story names Joao Annes as chief information security officer of the airport operator ANA Aeroportos. Ethiack publishes every one of those itself.

One traction record is independent of the company. Portugal’s public spending portal lists Ethiack, Lda as a supplier with 486,000 euros of contracted work under the national cybersecurity reinforcement investment. The portal uses the company’s earlier legal form. Ethiack’s terms of service give its registration and tax number as 516856146 for Ethiack, S.A, a Portuguese tax-number lookup returns Ethiack, Lda for that same number, and a company register lists the current legal form as Sociedade Anónima at the same Instituto Pedro Nunes address and records a company transformation in July 2025.

Figures on commercial scale published outside the company are older. EU-Startups reported 1 million euros in turnover and a client portfolio spanning nine countries when the 4 million euro seed round closed in December 2024, and no newer independent figure appears in the cited sources, so the size of the business today is not visible from outside.

Ethiack publishes list prices. A single pentest is 3,000 euros, the continuous plan lists at 12,000 euros a year for up to 50 assets, and a 30-day trial is offered without commitment. Ethiack states that it charges nothing unless a validated vulnerability with proven exploitation is identified. \[[s4](#profile-analysis-sources), [s5](#profile-analysis-sources), [s8](#profile-analysis-sources), [s12](#profile-analysis-sources), [s14](#profile-analysis-sources), [s22](#profile-analysis-sources), [s23](#profile-analysis-sources), [s24](#profile-analysis-sources)\]

### Team & Credibility

The founding is documented outside the company. Jornal de Negocios reports that André Baptista founded Ethiack in 2022 with Jorge Monteiro and Vítor Pinho, and EU-Startups gives the same three names and the same year.

Baptista’s standing is the strongest verified fact about the team. Jornal de Negocios, writing in December 2024, reports that he took the Most Valuable Hacker title the previous August, becoming one of five people worldwide to have won it twice, after a first win in 2018.

Recent research keeps the bench visible. BleepingComputer records the Rails Active Storage disclosure as coming from researchers at Ethiack and GMO Flatt Security, and Rapid7 notes that both parties withheld proof-of-concept code and the full attack chain.

The founders hold the senior roles. Ethiack’s own posts sign Jorge Monteiro as chief executive and André Baptista as chief technology officer, and the cited sources name no executive outside the three founders, so a buyer assessing bench depth beyond them has to ask. \[[s2](#profile-analysis-sources), [s7](#profile-analysis-sources), [s11](#profile-analysis-sources), [s12](#profile-analysis-sources), [s13](#profile-analysis-sources), [s16](#profile-analysis-sources), [s17](#profile-analysis-sources)\]

### Trust Readiness

Ethiack makes its assurance claims itself. A post on its own site dated 17 July 2023 states that it obtained ISO 27001 certification, an ISO 27001 compliance line runs in the site footer, and the pricing page states that Ethiack is ISO 27001 certified and that it stores and processes all data in Belgium, inside the EU.

No inspectable trust portal appears on the probed surfaces. The published security policy names Ethiack, S.A at Instituto Pedro Nunes in Coimbra and sets out access control, confidentiality and continuity commitments, without naming an auditor or a report a buyer could read. A buyer whose procurement wants an auditor’s report has to request it from Ethiack.

Compliance output is a product feature rather than an assurance about Ethiack itself. The platform pulls reports aligned to NIS2, DORA, SOC 2, ISO 27001 and PCI for the customer’s own audits, which is a different claim from an audited control set at the vendor. \[[s1](#profile-analysis-sources), [s4](#profile-analysis-sources), [s6](#profile-analysis-sources), [s7](#profile-analysis-sources), [s21](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Aikido Security | competes with | A SourceForge directory page ranks it first among alternatives to Ethiack, and its listing there advertises automated pentests inside an all-in-one platform. |
| Cobalt | competes with | A SourceForge directory page lists this pentest-as-a-service vendor among alternatives to Ethiack. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Contested (14/21)**

Band guidance: reinforce or reposition. Analyzed 2026-08-18. Scope: whole company.

Publishing the benchmark makes Ethiack’s claims easier to check and hands competitors the same testing materials. The engine behind those claims, reconnaissance through exploit chaining to proof capture, is specialist offensive-security engineering that a funded rival could rebuild. No cross- customer dataset appears in the cited sources. What accumulates instead is a hacking bench with public standing: co-founder André Baptista has twice won the title of most valuable hacker. Ethiack wires testing into the customer’s delivery pipeline, work a departing customer would re-create. The cited sources do not size that migration. The scarce thing here is a record of finding real vulnerabilities, and the cited sources credit that record to Ethiack’s researchers.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 2/3 | Ethiack sells testing performed by AI and human ethical hackers, ending in a compliance-ready report, and states that it charges nothing unless a validated vulnerability with proven exploitation is identified. Code and expertise blend in what the customer buys. \[[s4](#deep-dive-sources), [s8](#deep-dive-sources)\] |
| Switching Cost | 2/3 | Ethiack names integrations with Slack, Jira, GitLab, Splunk Enterprise, ManageEngine, Zapier and n8n plus webhook and API support, so a customer can wire the product into the tools it already runs, which is the meaningful friction this rung names. The cited record documents no non-portable state, no network effect and no obligation binding a customer to Ethiack, and it does not size the migration a departure would require. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | ISO 27001 rests on Ethiack’s own 2023 announcement and a footer mark, with no inspectable portal on the probed surfaces. Certification of that kind is preparation a funded competitor can complete rather than an approval that stands between a buyer and a replacement. \[[s7](#deep-dive-sources), [s6](#deep-dive-sources), [s21](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Running reconnaissance, exploit chaining and proof capture safely against production systems is years of specialist offensive-security work, and Ethiack’s researchers showed the bench by reporting the Rails Active Storage flaw The Hacker News records at a severity score of 9.5. \[[s3](#deep-dive-sources), [s15](#deep-dive-sources), [s16](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | Portugal’s public spending portal records 486,000 euros of contracted work bought through state procurement, which is the government class this rung names, and Ethiack’s own pages carry fifteen named references including an airport operator whose chief information security officer is quoted by name. The price page also addresses small and medium businesses, so the base is not purely regulated enterprise. \[[s4](#deep-dive-sources), [s8](#deep-dive-sources), [s14](#deep-dive-sources)\] |
| Layer | 2/3 | Ethiack sells continuous access to its platform plus integrations into the tools a customer already runs, a platform with application features that runs beside production rather than infrastructure other applications depend on. \[[s4](#deep-dive-sources), [s5](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 1/3 | Ethiack describes feedback loops that learn from validated exploits and false positives, and it published its benchmark targets and annotated vulnerability list openly. The cited sources name no non-public dataset, so a funded rival could reach parity by building and hiring. \[[s3](#deep-dive-sources), [s9](#deep-dive-sources), [s18](#deep-dive-sources)\] |

### Strategic Market Segmentation

Ethiack addresses two buyer sizes from one price page. The continuous plan names small and medium businesses that want ongoing security of their attack surface and covers up to fifty assets, and a separate enterprise tier is custom and quoted on request.

Ethiack names its reference customers individually. Its pricing page runs fifteen customer quotes, each naming a person and an employer, and its customer story names the chief information security officer of the airport operator ANA Aeroportos. EU-Startups reported a client portfolio spanning nine countries at the December 2024 round, and the same announcement described expansion starting with the United Kingdom and Europe while exploring the United States and the Middle East.

Regulated buyers are a visible target segment. Reporting aligned to NIS2, DORA, SOC 2, ISO 27001 and PCI is a headline feature, and the spending portal records Ethiack’s contracted work under a state programme to reinforce the national cybersecurity framework, with the national security office as its beneficiary. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s8](#deep-dive-sources), [s12](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

Ethiack presents Hackian as a system rather than a prompt. It states that the engine is a set of coordinated AI agents with deterministic modules, and describes feedback loops in which each validated exploit, false positive and fixed mitigation refines its internal models.

The public proof is about the people rather than the engine. Researchers at Ethiack working with GMO Flatt Security reported the Rails Active Storage flaw CVE-2026-66066, which The Hacker News records at a severity score of 9.5, and SC Media credits researchers at Ethiack and Depthfirst with CVE-2026-25253 in the OpenClaw assistant. The cited sources attribute both findings to people at Ethiack and to no automated system, so they evidence offensive craft rather than the engine’s autonomy.

Ethiack also published its measurement. EthiBench scores agents against 108 expert-annotated vulnerabilities across three open-source targets, and Ethiack reports its own agent ahead of the open-source engines Strix and PentAGI and the coding agent Claude Code on the combined discovery and precision measure. PentesterLab’s review cautioned that the targets are intentionally vulnerable and the annotated answer key may be incomplete, so the scores describe the benchmark rather than a production engagement.

The learning loop is a possible asset that the cited sources do not yet evidence. Validated exploits and false positives accumulated across customers could become an exclusive corpus behind the exploit modules, and no source names such a corpus today. \[[s3](#deep-dive-sources), [s9](#deep-dive-sources), [s10](#deep-dive-sources), [s15](#deep-dive-sources), [s16](#deep-dive-sources), [s17](#deep-dive-sources), [s18](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Self-service and sales run side by side. Ethiack’s pages offer a 30-day trial without commitment beside a book-a-demo button, and the price page carries a 3,000 euro per-test option a buyer can start alone.

Part of the motion is channel. Ethiack runs a partnership programme with its own partner portal, pitched as elevating security services, and recruits ethical hackers into a network on the same page.

Public sector is a distinct route. Portugal’s spending portal shows 486,000 euros of contracted work under the national cybersecurity investment, which is procurement rather than self-service. The portal lists the supplier under the company’s earlier legal form. Ethiack’s terms of service give its registration and tax number as 516856146 for Ethiack, S.A, a Portuguese tax-number lookup returns Ethiack, Lda for that same number, and a company register lists the current legal form as Sociedade Anónima at the same Instituto Pedro Nunes address and records a company transformation in July 2025.

Recognition carries part of the marketing. EU-Startups lists a Web Summit promising-startup title, a Portuguese national innovation award, and selection for a Google cybersecurity growth academy. \[[s2](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources), [s12](#deep-dive-sources), [s14](#deep-dive-sources), [s22](#deep-dive-sources), [s23](#deep-dive-sources), [s24](#deep-dive-sources)\]

### Pricing Model

Ethiack publishes list prices, so a buyer can size a deal from the site alone. A single targeted, in-depth pentest scoped to specific assets or applications is 3,000 euros. The continuous core plan lists at 12,000 euros a year covering up to 50 assets, shown at 9,000 euros under a 25 percent promotion, and the enterprise tier is custom and quoted on request.

The tier is bounded by asset count, and Ethiack defines an asset broadly. Domains, subdomains, servers, IP addresses, APIs and web or mobile applications all count toward the 50-asset ceiling on the core plan, so the size of the estate a customer registers is one input to which tier it needs.

Ethiack publishes a guarantee. It states that it charges nothing unless a validated vulnerability with proven exploitation is identified, which moves part of the delivery risk onto the vendor and gives a first-time buyer a cheap way to test the claim. \[[s4](#deep-dive-sources)\]

### Product Delivery & Operations

Delivery blends software and people. The pentest line is performed by AI and human ethical hackers, and the continuous plan adds compliance-ready reporting and attack surface security for up to 50 assets.

The product reaches into the customer’s pipeline. Testing is triggered by code pushes, infrastructure changes and new knowledge rather than by a calendar, and Ethiack names integrations with Slack, Jira, GitLab, Splunk Enterprise, ManageEngine, Zapier and n8n, plus webhook support and a full API for custom work.

Turnaround carries a stated commitment. Ethiack describes the on-demand engagement as targeted and in-depth, running once and delivering a compliance-ready report within five days.

Human engagements are scheduled work rather than continuous. Ethiack’s customer story describes ethical hacking events that sometimes run a whole week, aimed at business-logic flaws automated testing misses. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s8](#deep-dive-sources)\]

### Earning Customers' Trust

Ethiack makes its assurance claims itself. A post dated 17 July 2023 states that it obtained ISO 27001 certification, an ISO 27001 compliance line runs in the site footer, and the pricing page states that Ethiack is ISO 27001 certified and that it stores and processes all data in Belgium, inside the EU.

No inspectable trust portal appears on the probed surfaces. The published security policy names Ethiack, S.A at Instituto Pedro Nunes in Coimbra and sets out access, confidentiality and continuity commitments, without naming an auditor or a report a buyer could read, so a buyer whose procurement wants one has to request it from Ethiack.

The product’s compliance output is a separate thing from the vendor’s own assurance. Ethiack pulls live reports aligned to NIS2, DORA, SOC 2, ISO 27001 and PCI for the customer’s audits, which says nothing about the controls around Ethiack itself.

Safety is a stated design constraint, and it is the claim a buyer of an offensive tool has to test. Ethiack says the engine runs under strict rules and guardrails so testing stays safe, controlled and non-disruptive. \[[s1](#deep-dive-sources), [s3](#deep-dive-sources), [s4](#deep-dive-sources), [s6](#deep-dive-sources), [s7](#deep-dive-sources), [s21](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

The platform is described as one surface doing several jobs. Attack surface management, adversarial exposure validation and pentest as a service each get their own description on the same page, while the price page sells them as an on-demand test, an annual plan and a custom enterprise tier.

Extensibility is documented on the pricing page. Ethiack names integrations with Slack, Jira, GitLab, Splunk Enterprise, ManageEngine, Zapier and n8n, offers webhook support and a full API for custom work, and reserves custom integration support for enterprise plans.

The open benchmark is the clearest ecosystem move. Ethiack published the evaluation protocol, the target applications and the annotated vulnerability list, and invites others to run their own agents through it.

A partner programme is the other extension point. Ethiack pitches agentic pentesting as a way to elevate security services and gives partners their own portal to log into, and it recruits ethical hackers into a network it asks applicants to join. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s4](#deep-dive-sources), [s9](#deep-dive-sources)\]

### Team & Execution Capability

Three founders, all named outside the company. Jornal de Negocios and EU-Startups both record André Baptista, Jorge Monteiro and Vítor Pinho as the founders in 2022.

Baptista is the credential Ethiack leads with, and it holds up. Jornal de Negocios, writing in December 2024, reports that he took the Most Valuable Hacker title the previous August, becoming one of five people worldwide to have won it twice, after a first win in 2018.

The research team is visible through its output. BleepingComputer records the Rails Active Storage disclosure as coming from researchers at Ethiack and GMO Flatt Security, Rapid7 notes that both parties withheld the full attack chain, and SC Media credits Ethiack researchers with an OpenClaw vulnerability.

The founders hold the senior roles. Ethiack’s own posts sign Jorge Monteiro as chief executive and André Baptista as chief technology officer, and the cited sources name no executive outside the three founders, so a buyer assessing bench depth beyond them has to ask. Ethiack describes itself as a growing team of builders and breakers and recruits ethical hackers into a network. \[[s2](#deep-dive-sources), [s7](#deep-dive-sources), [s11](#deep-dive-sources), [s12](#deep-dive-sources), [s13](#deep-dive-sources), [s16](#deep-dive-sources), [s17](#deep-dive-sources), [s19](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [https://ethiack.com/platform](https://ethiack.com/platform) | official | 2026-08-18 |
| f2 | [https://www.eu-startups.com/2024/12/ethiack-hacks-cybersecurity-with-ai-raising-e4-million/](https://www.eu-startups.com/2024/12/ethiack-hacks-cybersecurity-with-ai-raising-e4-million/) | press | 2026-08-18 |
| f3 | [https://ethiack.com/hackian](https://ethiack.com/hackian) | official | 2026-08-18 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Ethiack: homepage](https://ethiack.com) “Pentest as a Service On-demand pentesting led by Hackian, combining autonomous speed with expert human validation.” | official | 2026-08-18 |
| s2 | [Ethiack: About page](https://ethiack.com/about) “Already a partner? Log in the Ethiack Partner Portal” | official | 2026-08-18 |
| s3 | [Ethiack: Hackian engine page](https://ethiack.com/hackian) “Step-by-step reproduction blueprints” | official | 2026-08-18 |
| s4 | [Ethiack: pricing page with plans and customer quotes](https://ethiack.com/pricing) “what security teams say after running Ethiack Rui Pereira, Aegon Santander Portugal” | official | 2026-08-18 |
| s5 | [Ethiack: platform overview page](https://ethiack.com/platform) “Book a Demo” | official | 2026-08-18 |
| s6 | [Ethiack: security policy](https://ethiack.com/legal/security-policy) “Develop, Maintain and Test business continuity plans to ensure we stay on course despite all obstacles that we may come across.” | official | 2026-08-18 |
| s7 | [Ethiack: ISO 27001 certification announcement, July 2023](https://ethiack.com/info-hub/blog/were-now-iso-27001-certified-heres-what-this-means-for-you) “Vítor Pinho CCSO Ethiack July 17, 2023” | official | 2026-08-18 |
| s8 | [Ethiack: ANA Aeroportos customer story](https://ethiack.com/info-hub/case-studies/strengthening-cybersecurity-at-ana-aeroportos-with-ethiacks-ethical-hacking) “Sometimes lasting for a whole week, our ethical hackers get the opportunity to find the most critical vulnerabilities by exploiting business logic” | official | 2026-08-18 |
| s9 | [Ethiack: EthiBench benchmark write-up](https://ethiack.com/info-hub/research/ai-pentesting-benchmarks-are-so-bad-we-made-a-new-one) “the protocol, the targets, and the ground truth are all public” | official | 2026-08-18 |
| s10 | [Ethiack: evaluating pentesting agents, part 1](https://ethiack.com/info-hub/research/evaluating-pentesting-agents-part-1) “we compare multiple agentic systems with pentesting capabilities: Strix , PentAGI , and Claude Code and our own Hackian’s Pentesting Agent” | official | 2026-08-18 |
| s11 | [Ethiack: KindaRails2Shell research write-up on CVE-2026-66066](https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066) “André Baptista CTO Ethiack” | official | 2026-08-18 |
| s12 | [EU-Startups: ETHIACK hacks cybersecurity with AI, raising 4 million euros](https://www.eu-startups.com/2024/12/ethiack-hacks-cybersecurity-with-ai-raising-e4-million/) “The fresh funding will be used to launch the next generation of ETHIACK’s Automated Continuous Pentesting technology.” | press | 2026-08-18 |
| s13 | [Jornal de Negocios: the world’s most valuable hacker is from Coimbra and has just raised four million euros](https://www.jornaldenegocios.pt/empresas/tecnologias/detalhe/hacker-mais-valioso-do-mundo-e-de-coimbra-e-acaba-de-angariar-quatro-milhoes-de-euros) “10 de Dezembro de 2024 às 12:01” | press | 2026-08-18 |
| s14 | [Portuguese state transparency portal: PRR project C19-i03, national cybersecurity framework, suppliers list](https://transparencia.gov.pt/pt/fundos-europeus/prr/beneficiarios-projetos/projeto/C19-i03/) “Ethiack, Lda Valor contratado 486 mil €” | regulatory | 2026-08-18 |
| s15 | [The Hacker News: critical Rails flaw could let unauthenticated attackers read server files](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html) “Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base” | press | 2026-08-18 |
| s16 | [BleepingComputer: Rails patches critical Active Storage flaw with RCE potential](https://www.bleepingcomputer.com/news/security/rails-patches-critical-active-storage-flaw-with-rce-potential/) “The vulnerability was discovered and responsibly reported to the Rails team by researchers from Ethiack and GMO Flatt Security Inc.” | press | 2026-08-18 |
| s17 | [Rapid7: emergent threat response on CVE-2026-66066](https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/) “Ethiack and GMO Flatt Security, who independently reported the vulnerability, have withheld proof-of-concept code and details of the full attack chain.” | research | 2026-08-18 |
| s18 | [PentesterLab: research worth reading, week 30 2026, with a review of EthiBench](https://pentesterlab.com/blog/research-worth-reading-week30-2026) “EthiBench is a more serious attempt to answer a question that most AI pentesting benchmarks avoid: did the agent actually find the vulnerabilities?” | research | 2026-08-18 |
| s19 | [SC Media: how OpenClaw could be hijacked with a simple website visit](https://www.scworld.com/news/how-openclaw-could-be-hijacked-with-a-simple-website-visit) “Last month, researchers at Ethiack and Depthfirst discovered a vulnerability, tracked as CVE-2026-25253 , that could similarly be used to hijack an OpenClaw agent when the user visits a malicious website.” | press | 2026-08-18 |
| s20 | [SourceForge: directory listing of alternatives to Ethiack](https://sourceforge.net/software/product/Ethiack/alternatives) “Teams get security done with Aikido thanks to: - False-positive reduction - AI Autotriage & AI Autofix - Deep integration into the dev workflow (from IDEs and task managers to CI/CD gating) - AI Pentests - Automated Compliance” | other | 2026-08-18 |
| s22 | [Ethiack: terms of service, naming the legal entity and its registration number](https://ethiack.com/legal/terms-of-service) “ETHIACK, S.A., a private limited liability company incorporated in Portugal, with registration and tax number 516856146” | official | 2026-08-18 |
| s23 | [Portuguese tax-number lookup for NIF 516856146](https://utils.antoniocampos.net/contribuinte-nif/procurar-informacao/516856146/) “ETHIACK, LDA - NIF 516856146” | other | 2026-08-18 |
| s24 | [Racius company register entry for Ethiack, S.A](https://www.racius.com/ethiack-s-a/) “Morada Rua Rua Pedro Nunes, Instituto Pedro Nunes, S/N 3030-199 Coimbra” | other | 2026-08-18 |
| s21 | [Trust-surface probe 2026-08-18: /trust, /security and /compliance return 404, and the trust. and security. subdomains do not resolve](https://ethiack.com/trust) | other | 2026-08-18 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Ethiack: homepage](https://ethiack.com) “Pentest as a Service On-demand pentesting led by Hackian, combining autonomous speed with expert human validation.” | official | 2026-08-18 |
| s2 | [Ethiack: About page](https://ethiack.com/about) “Already a partner? Log in the Ethiack Partner Portal” | official | 2026-08-18 |
| s3 | [Ethiack: Hackian engine page](https://ethiack.com/hackian) “Step-by-step reproduction blueprints” | official | 2026-08-18 |
| s4 | [Ethiack: pricing page with plans and customer quotes](https://ethiack.com/pricing) “what security teams say after running Ethiack Rui Pereira, Aegon Santander Portugal” | official | 2026-08-18 |
| s5 | [Ethiack: platform overview page](https://ethiack.com/platform) “Book a Demo” | official | 2026-08-18 |
| s6 | [Ethiack: security policy](https://ethiack.com/legal/security-policy) “Develop, Maintain and Test business continuity plans to ensure we stay on course despite all obstacles that we may come across.” | official | 2026-08-18 |
| s7 | [Ethiack: ISO 27001 certification announcement, July 2023](https://ethiack.com/info-hub/blog/were-now-iso-27001-certified-heres-what-this-means-for-you) “Vítor Pinho CCSO Ethiack July 17, 2023” | official | 2026-08-18 |
| s8 | [Ethiack: ANA Aeroportos customer story](https://ethiack.com/info-hub/case-studies/strengthening-cybersecurity-at-ana-aeroportos-with-ethiacks-ethical-hacking) “Sometimes lasting for a whole week, our ethical hackers get the opportunity to find the most critical vulnerabilities by exploiting business logic” | official | 2026-08-18 |
| s9 | [Ethiack: EthiBench benchmark write-up](https://ethiack.com/info-hub/research/ai-pentesting-benchmarks-are-so-bad-we-made-a-new-one) “the protocol, the targets, and the ground truth are all public” | official | 2026-08-18 |
| s10 | [Ethiack: evaluating pentesting agents, part 1](https://ethiack.com/info-hub/research/evaluating-pentesting-agents-part-1) “we compare multiple agentic systems with pentesting capabilities: Strix , PentAGI , and Claude Code and our own Hackian’s Pentesting Agent” | official | 2026-08-18 |
| s11 | [Ethiack: KindaRails2Shell research write-up on CVE-2026-66066](https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066) “André Baptista CTO Ethiack” | official | 2026-08-18 |
| s12 | [EU-Startups: ETHIACK hacks cybersecurity with AI, raising 4 million euros](https://www.eu-startups.com/2024/12/ethiack-hacks-cybersecurity-with-ai-raising-e4-million/) “The fresh funding will be used to launch the next generation of ETHIACK’s Automated Continuous Pentesting technology.” | press | 2026-08-18 |
| s13 | [Jornal de Negocios: the world’s most valuable hacker is from Coimbra and has just raised four million euros](https://www.jornaldenegocios.pt/empresas/tecnologias/detalhe/hacker-mais-valioso-do-mundo-e-de-coimbra-e-acaba-de-angariar-quatro-milhoes-de-euros) “10 de Dezembro de 2024 às 12:01” | press | 2026-08-18 |
| s14 | [Portuguese state transparency portal: PRR project C19-i03, national cybersecurity framework, suppliers list](https://transparencia.gov.pt/pt/fundos-europeus/prr/beneficiarios-projetos/projeto/C19-i03/) “Ethiack, Lda Valor contratado 486 mil €” | regulatory | 2026-08-18 |
| s15 | [The Hacker News: critical Rails flaw could let unauthenticated attackers read server files](https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html) “Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base” | press | 2026-08-18 |
| s16 | [BleepingComputer: Rails patches critical Active Storage flaw with RCE potential](https://www.bleepingcomputer.com/news/security/rails-patches-critical-active-storage-flaw-with-rce-potential/) “The vulnerability was discovered and responsibly reported to the Rails team by researchers from Ethiack and GMO Flatt Security Inc.” | press | 2026-08-18 |
| s17 | [Rapid7: emergent threat response on CVE-2026-66066](https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/) “Ethiack and GMO Flatt Security, who independently reported the vulnerability, have withheld proof-of-concept code and details of the full attack chain.” | research | 2026-08-18 |
| s18 | [PentesterLab: research worth reading, week 30 2026, with a review of EthiBench](https://pentesterlab.com/blog/research-worth-reading-week30-2026) “EthiBench is a more serious attempt to answer a question that most AI pentesting benchmarks avoid: did the agent actually find the vulnerabilities?” | research | 2026-08-18 |
| s19 | [SC Media: how OpenClaw could be hijacked with a simple website visit](https://www.scworld.com/news/how-openclaw-could-be-hijacked-with-a-simple-website-visit) “Last month, researchers at Ethiack and Depthfirst discovered a vulnerability, tracked as CVE-2026-25253 , that could similarly be used to hijack an OpenClaw agent when the user visits a malicious website.” | press | 2026-08-18 |
| s22 | [Ethiack: terms of service, naming the legal entity and its registration number](https://ethiack.com/legal/terms-of-service) “ETHIACK, S.A., a private limited liability company incorporated in Portugal, with registration and tax number 516856146” | official | 2026-08-18 |
| s23 | [Portuguese tax-number lookup for NIF 516856146](https://utils.antoniocampos.net/contribuinte-nif/procurar-informacao/516856146/) “ETHIACK, LDA - NIF 516856146” | other | 2026-08-18 |
| s24 | [Racius company register entry for Ethiack, S.A](https://www.racius.com/ethiack-s-a/) “Morada Rua Rua Pedro Nunes, Instituto Pedro Nunes, S/N 3030-199 Coimbra” | other | 2026-08-18 |
| s21 | [Trust-surface probe 2026-08-18: /trust, /security and /compliance return 404, and the trust. and security. subdomains do not resolve](https://ethiack.com/trust) | other | 2026-08-18 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.