
Penetration Test and Vulnerability Assessment Open Call
CYSSDE, funded by the European Commission under the Digital Europe Programme, launches its third and last Open Call to support European organisations in strengthening cybersecurity through penetration testing, vulnerability assessments, and enhanced risk monitoring.
We will select up to 12 proposals, submitted either individually or by consortia of up to two entities. Each selected proposal must deliver at least 10 tests, for a combined minimum of 100 penetration tests and vulnerability assessments for Essential Services Operators, SMEs, and other eligible entities.
💰 Funding available: Up to €200,000 per selected proposal.
🛠 Technical Support: Tailored 18-month Mentoring and Support Programme
📨 Proposals can be submitted by: a single entity, or a consortium of up to two entities (at least 1 expert in Cybersecurity)
🌍 Eligible applicants: SMEs (including micro-enterprises and start-ups), mid-caps, large companies, research centers, and public bodies with expertise in cybersecurity and registered in a Member State of the European Union and European Economic Area (EEA).
Application period:
Before applying:
Find all you need to know at the Guide for Applicants
Find more useful information here:
INFORMATIVE WEBINARS: Join us for the two online sessions during which we will guide you through the Open Call assumptions and the application process. You will have the chance to ask your questions live.
1st webinar: watch the recording and check the presentations.
2nd webinar: watch the recording and check the presentations.
The 3rd Open Call is a part of the wider CYSSDE initiative launched in June 2024 and it is the second and final call dedicated to penetration testing and vulnerability assessments. The previous call closed in April 2025 - check the winners under this link. Together, both calls will fund at least 20 projects with a total budget of €4 million, in close cooperation with the National Cybersecurity Coordination Centres and under the guidance of the European Cybersecurity Competence Centre (ECCC).
Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the granting authority can be held responsible for them. The project is supported by the European Cybersecurity Competence Center (ECCC) and its members.