SpindelNet Due Diligence

Run due diligence on SpindelNet: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by Independent (Denmark) · spindelnet.dk · 5 vendors

SpindelNet is a Danish sole-proprietorship cybersecurity company founded in 1997 by Christian Lysel, specialising in penetration testing of web applications and IP-based solutions. The company has rebranded to Pentests.dk and offers OWASP WSTG-methodology pentests, network security consulting, firewall/VPN configuration, and hardening of servers and applications. It is operated by an OSCP-certified expert with 25+ years of experience, serving clients across Denmark.

Resilience scores

Technology vendors

Insights

Last updated 2026-11-05 · revision 3

5 direct vendors, 87 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

9 in-scope frameworks identified; showing 3.

NIS2 (source) — No public evidence

As a provider of cybersecurity services and computer consultancy, SpindelNet likely falls under the 'ICT service management' or 'digital providers' sectors. With 10-19 employees, it may be classified as an 'important' entity.

EU Cybersecurity Act — Evidence found

As a provider of ICT products and services within the EU, SpindelNet is subject to the EU Cybersecurity Act's framework for cybersecurity certification schemes.

Evidence: https://cdn.digitaleurope.org/uploads/2026/05/Fixing-certification-supply-chains-and-critical-entities-CSA2-position-DIGITALEUROPE.pdf

DORA (source) — Evidence found

SpindelNet states on its website that it is a provider of IT services to the financial sector, making it subject to DORA as an ICT third-party service provider.

Evidence: https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/denmark/

Financials

Financial Resilience Score: 3/10

SpindelNet / pentests.dk is a Danish sole proprietorship (enkeltmandsvirksomhed) with no publicly filed financial statements, making quantitative assessment impossible. The business demonstrates notable qualitative strengths including a 29-year operating history since 1997, a minimal fixed-cost structure with zero registered employees, reputable reference clients across Danish municipalities and mid-size private companies (Slangerup Kommune, Græsted-Gilleleje Kommune, Avis Biludlejning A/S, Plus Pack A/S), and a focused 2024 strategic repositioning toward penetration testing - a high-demand cybersecurity niche. However, the risks are substantial and structural. As a sole proprietorship, the owner Christian Lysel bears unlimited personal liability with no equity buffer. The entire business depends on a single key person with no corporate succession structure. Capacity is capped at one person's working hours, limiting the ability to absorb large or parallel engagements. The absence of audited or publicly disclosed financials prevents counterparties from assessing solvency or revenue trajectory, which restricts eligibility for larger procurement contracts. Low web visibility (ranked ~231,300 in Denmark with <300 monthly visitors on the legacy domain) indicates a referral-dependent pipeline that concentrates demand risk. The score of 3 reflects a viable micro-enterprise with longevity but severe scale, transparency, and key-person constraints.

Key strengths: 29-year continuous operating history since 1997, Minimal fixed-cost structure with zero registered employees, Reputable Danish municipal and corporate reference clients, Focused specialization in penetration testing after 2024 rebrand, High operating flexibility from sole-owner structure

Risk factors: Key-person dependency on sole owner Christian Lysel, Unlimited personal liability inherent to sole proprietorship, No publicly disclosed or audited financial statements, Capacity capped at one person's hours - cannot scale, Low web visibility indicating referral-dependent pipeline, No equity buffer or corporate succession structure, Ineligibility for procurement contracts requiring filed accounts

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report