Penetration testing and phishing simulations

For companies and development teams that want to know how an attacker could reach their data, and what to fix first. Simulated phishing shows how your employees respond to fraudulent messages.

Discuss your security needs Explore our services

The first 30-minute consultation is free.

We've tested security for

Auditors have accepted our penetration test reports as evidence for SOC 2 audits.

Our team holds OSCP, RHCSA, RHCE and Terraform Associate certifications. TunaSec has been operating since 2020.

We find the weak spots before an attacker does

In penetration tests, we look for ways an attacker could reach your data. We explain what we find and recommend how to fix it. In training, we show people how to defend themselves in everyday work. TunaSec is a nonprofit based in Brno and Prague; alongside our work for companies, we also teach schools and the public.

How we can help

Penetration testing

We test applications, APIs or company networks within an agreed scope. You receive a report of the vulnerabilities found and recommendations for fixing them.

Testing scope and process

Cybersecurity training

Practical examples of phishing, password security and data protection. We adapt the content to the situations your employees encounter at work.

Training topics and process

Security audits

We review system security and how data is handled. We help identify weaknesses and the next steps for your team.

Audit scope and process

Phishing simulations

An agreed simulation shows how employees respond to fraudulent messages. The results show where your company is vulnerable.

How phishing simulations work

More activities for companies, schools and the public

Start on your own, for free

Three free tools that show you where to start.

All tools

Czech NIS2 readiness check
Go through the minimum that the Czech Cybersecurity Act and Decree No. 410/2025 require in the lower-obligation regime. You get a list of gaps with section references.
SPF and DMARC check
Check your domain's SPF and DMARC records and see what to change.
Phishing quiz
Test your ability to recognize fraudulent emails and websites in an interactive test.

Case study

Liferay releases new DXP versions only after our penetration tests

Since 2020 we have run several penetration tests a year for Liferay, totalling more than 100 hours a year. Each one ends with a report of the vulnerabilities found and recommendations for fixing them.

Read our references and case study

The people behind TunaSec

Our testers and trainers work in security day to day: in red teaming, in penetration testing at NÚKIB, the Czech national cybersecurity agency, and in physical security.