The GRC Group acquires Pentest People to expand cyber division

The GRC Group, a provider of software and tech-enabled services for managing business risks and regulatory compliance, has acquired the cyber-security firm Pentest People.

This acquisition marks GRC's second in the cyber security risk management sector, having previously acquired Bulletproof in June. The combined entities will operate under a newly formed cyber division.

Pentest People, headquartered in Leeds, is known for its penetration-testing-as-a-service (PTaaS) model, which integrates consultant-led penetration testing with continuous vulnerability scanning via its proprietary SecurePortal software platform. The company serves over 1,200 clients directly and through channel partnerships and is recognised for its graduate trainee programme. Their services additionally include CHECK-accredited testing and a growing Incident Response service.

The formation of the new cyber division, inclusive of Bulletproof in the UK and Target Defense in the USA, means the group will now cater to over 3,000 clients across both regions. Alex Dacre, Chief Executive of The GRC Group, expressed enthusiasm about the acquisition. "I'm delighted to welcome Andrew, Anthony and the Pentest People team to the Group. The addition of Pentest People following our acquisition of Bulletproof in June demonstrates our commitment to become an international leader in the Governance, Risk and Compliance market, delivering tech-led compliance to SMEs alongside leading enterprise SaaS point solutions. We look forward to working with the Pentest People team in further accelerating our collective growth," Dacre said.

Andrew Mason, Founder and Managing Director of Pentest People, shared his positive outlook on the acquisition. "We were delighted to find a new owner for Pentest People that both shares our values and will be able to continue its rapid growth trajectory and focus on innovation. We look forward to extending the services we can offer, through a close relationship with our new sister company and the other businesses within the Group," Mason commented.

Anthony Harvey, also Founder and Managing Director of Pentest People, echoed these sentiments. "We're delighted to be joining The GRC Group to continue the development journey of Pentest People. It is clear that GRC is committed to developing outstanding cyber security and that our capabilities will complement the services already offered," Harvey remarked.

The GRC Group, established in 2019 and employing over 1,200 experts across the UK, USA, and other international regions, offers services spanning compliance eLearning, regulatory intelligence, risk management software, employment compliance, ISO services, and cyber security. This acquisition comes after the group's own acquisition by Inflexion in May 2024, aimed at accelerating growth and market expansion through a blend of organic strategies and mergers and acquisitions. The recent acquisition of Bulletproof, operating in the UK and the USA as Target Defense, has further fortified GRC’s position in cyber security, with more than 100 accredited professionals and consultants within the newly formed division.