Fortreum has been accredited by CREST as a penetration testing service provider, putting the company’s testing methodology, data handling practices and reporting standards behind Fortreum Override, the company’s offensive security practice, through independent review by the international body whose accreditation banks, regulators and public sector buyers use to separate professional testing firms from everyone else selling a scan.

Who gets assessed, the company or the testers?

CREST certifies individual testers and accredits companies through two distinct processes, and a company employing certified practitioners is not itself accredited. Company accreditation examines how an organization scopes engagements, executes assignments, protects client data, reviews its own work and handles remediation support. Fortreum is one of just 53 U.S.-headquartered companies that hold the firm-level penetration testing accreditation in the CREST Marketplace today.

Fortreum’s accreditation covers penetration testing delivered across networks, web and mobile applications, APIs, cloud environments, social engineering, red and purple team operations, and AI and LLM systems. Engagements follow OWASP, PTES and MITRE ATT&CK.

“Certifications tell a client who is on the team. Accreditation tells them how the team works, how an engagement gets scoped, how their data is handled, what happens when we find something nobody anticipated,” said Gary Guercio, VP of Operations at Fortreum. “We built those processes to hold up under scrutiny, and CREST put them through it.”

Fortreum’s offensive security practice exists to demonstrate impact rather than catalog findings, chaining exploits to show what an attacker would accomplish and then working with the client’s team to close the paths it used. The application and accreditation process began in January 2026 and ran roughly nine months, culminating in the CREST Marketplace listing last week.

The buyers that U.S. federal credentials don’t reach

CREST opens a market Fortreum’s federal credentials were never built to reach. FedRAMP and CMMC run as their own systems, administered through A2LA and the Cyber AB, and they speak to contracting officers and agency buyers. A London bank, a Singapore regulator and an Australian enterprise read a different signal, and CREST is the one they wrote into their procurement standards. Fortreum now carries both.

Fortreum is now pursuing threat-led penetration testing accreditation as a follow-on, with the CREST standard behind regulator-mandated adversary simulation programs, including CBEST at the Bank of England and TIBER-EU at the European Central Bank. The penetration-testing requirements Fortreum met carry over, making the second accreditation a narrower application than the first.

About Fortreum

Fortreum helps organizations navigate cybersecurity, compliance and risk with clarity. Through advisory services, assessments, managed compliance programs, offensive security and AI-powered risk intelligence, Fortreum supports defense contractors, cloud service providers, regulated enterprises and government organizations. Fortreum Override is the company’s offensive security practice. Fortreum holds accreditation as a Top 5 FedRAMP 3PAO, a CMMC C3PAO, a GovRAMP 3PAO and a PCI QSA, is CREST-accredited for penetration testing, and is ISO 27001 certified. The company supports leading frameworks including FedRAMP, CMMC, StateRAMP, PCI DSS, SOC 2, ISO 27001 and NIST. Learn more at fortreum.com.

About CREST

CREST is an international not-for-profit accreditation and certification body serving the technical information security industry. CREST publishes nine service-specific accreditation standards and assesses member organizations against them, and separately certifies individual practitioners through a structured examination program. CREST (International) is registered in the UK, company number 09805375.

Media gallery

About The Author
Business Wire