Published by Excession Labs. We also sell penetration testing, and we are one of the providers in the table. How we compare

PentestComparepublished by Excession Labs Scoping checklist

HIPAA penetration testing companies: compared

The HIPAA Security Rule in force does not name penetration testing. It requires a risk analysis and a periodic evaluation. HHS proposed a pentest at least every 12 months in January 2025, and that proposal is not final. The table lists providers that mention HIPAA, A to Z. Ask about a BAA, PHI in test data and where evidence is stored.

HIPAA penetration testing companies are the providers whose own pages mention HIPAA. That is a statement about their marketing, not about whether your regulator will accept their report. The table lists them A to Z with no ranking, checked on 9 November 2026. Read the questions below before you shortlist.

20 of 20 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.

Penetration testing providers compared on delivery, scope, published price, turnaround, retesting and sample reports
ProviderDeliveryWeb appsAPIsCloudNetworkMobileAI appsPublished priceTurnaroundRetestSample report
AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) automated YesYes?YesYesYes $4,000 per assessment +1 more TYPICAL Pentest: same-day results. The AI pentest page also says a… Free retesting for up to 6 months, including checks for bypasses of… Public
Astra SecurityPTaaS platform hybrid YesYesYesYesYesYes $2,999 per year (card also shows $199 per month) +3 more Manual pentest: 10-15 working days. Pentest Auto: first report the… Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… not published
BreachLockPTaaS platform hybrid YesYesYesYesYes? Custom quote Pentests can be scoped and started within 24-48 hours. Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive).… on request
BugcrowdPTaaS platform, United States hybrid YesYesYesYesYesYes Custom quote Tests launch in under 72 hours; Standard: launch within 3 business… Standard: one year of retesting with one report revision, for web… Public
CobaltPTaaS platform, United States hybrid YesYesYesYesYesYes $3,500 per test Autonomous Pentest: findings in 24 hours. Annual tiers: start within… Comparison table: free retesting for 6 months (Standard) or 12… on request
CYBRIPenetration testing consultancy, United States human-led YesYesYesYesYesYes $5,000 starts at, per engagement +3 more From 5 business days (Web Application and Custom), 10 (Web, API,… Remediation testing is included in the $9,500 and $20,000 tiers.… not published
DeepStrikePenetration testing consultancy, United States human-led Yes?YesYesYes? Custom quote Basic plan: start pentest within 48 hours. The services page says free unlimited re-testing; the pricing page… not published
GiskardAI-assisted testing service, France hybrid ?Yes???Yes $0 no billing unit given Not published Giskard says it re-runs every test until the fix is confirmed. not published
Halo SecurityPTaaS platform hybrid YesYes?YesYes? Custom quote Not published One round of retesting is included; Halo verifies fixes and issues… not published
ParameterAI-assisted testing service automated YesYes???? Custom quote First findings in 24 hours; most runs finish the same day they start. Free re-testing is listed for Single App and inherited by higher… Public
PentiAI-assisted testing service hybrid YesYesYesYesYesYes $20 per month ($216 per year billed annually) +5 more Pentests done in hours, not months (tagline). On the free first… Every plan includes free unlimited retests. not published
Prescient SecurityConsultancy hybrid YesYesYesYesYes? from $6,000 per engagement (scope-based) +5 more Not published Cait: up to 2 retests within 30 days of each scan. No retest terms… not published
RaxisConsultancy, United States human-led YesYesYesYes?Yes Custom quote Quote requests answered usually in one business day; PTaaS findings… Retesting is built into the PTaaS workflow; Raxis Attack includes… Public
SchellmanConsultancy, United States human-led YesYesYesYesYesYes Custom quote Not published Not stated on the page. Public
Secure IdeasConsultancy human-led YesYes?YesYes? $8,160 per test (flat fee, starting) +4 more Testing usually starts two to four weeks after contracting; one to… Not included by default; retesting is listed as a factor that can… Public
Software SecuredConsultancy, Canada human-led YesYesYesYesYesYes Custom quote Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner;… Request retesting within 12 months of report delivery;… not published
StingraiPenetration testing consultancy and platform, Canada hybrid YesYesYesYesYesYes US$3,000 per assessment +1 more Autonomous Pentest: same-day results. Automated retests are listed on the Autonomous plan; the page says… Public
TrustedSecSecurity consultancy, United States human-led ??Yes??Yes Not published Not published Not published not published
TurboPentestAI-assisted testing service automated YesYes?Yes?Yes $99 per credit (one pentest) +4 more All tiers typically complete in a few hours. A retest is a full new pentest at the same per-target price; no… Public
ZeroThreatAutonomous testing platform automated YesYes???? $100 per target per month +2 more Not published Professional: unlimited retesting. Pay Per Scan: unlimited retesting… not published

"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.

What does HIPAA ask for?#

The Security Rule in force asks for a risk analysis and a periodic evaluation. It does not name a penetration test. The full requirement text and the January 2025 proposal are in our guide on HIPAA penetration testing, so we do not repeat them here.

In short: HHS proposed in January 2025 (90 FR 898) to require a pentest at least every 12 months. As of 9 November 2026, the Unified Agenda lists a final rule date of July 2027 and the proposal is not final. This is not legal advice.

Who needs a test, and when?#

Covered entities and business associates that run software holding electronic protected health information (ePHI) should plan a test. Common triggers are a new patient portal, a new integration with an electronic health record system, a risk analysis finding, and a customer's security review. A healthcare customer can still ask a vendor for a recent pentest summary where the rule does not require one.

What should you ask HIPAA pentest providers?#

Question Why it matters
Will you sign a business associate agreement if testers could see ePHI? Your counsel decides if one is needed. Ask before scoping ends.
How do you keep PHI out of test data? Use synthetic records and test accounts where you can.
Where is evidence stored, and for how long? Screenshots and logs can contain patient data.
Who on your side can see the evidence? Ask for a role list, not a promise.
How do you handle a finding that exposes real PHI during testing? Agree the stop and notify steps in advance.
Do you give a sample report? Check the Sample report column, then read the report.

What drives the price?#

Price follows the number of applications and APIs, the roles and tenants tested, the depth of manual work, and the retest terms. The "Published price" column shows a figure only where a provider lists one. A blank figure means we found none, not that the work is cheap. See penetration testing cost for sourced ranges.

How do you read the table?#

The filter is a HIPAA mention in the provider's compliance statements, with the source on each provider page. A mention does not show experience with covered entities. Compare the Type column, the Sample report column and the Retest terms, then ask for a reference call on healthcare work. See also SOC 2 penetration testing providers.

What does an auditor check in the report?#

We cannot say what your auditor or customer will accept, and no provider can promise it. Ask the party that decides. In general, readers look for a stated scope and dates, the method, a finding list with severity, evidence for each finding, remediation steps and a retest record. Check these in a provider's sample report before you buy.

Questions

Does HIPAA require a penetration test?

Not in the rule text now in force. As of 9 November 2026, 45 CFR 164 Subpart C does not contain the word penetration. A 2025 proposal would require one. The proposal is not final. Ask your compliance counsel what applies to you.

Should a pentest provider sign a business associate agreement?

Ask. If testers could see ePHI, your counsel decides whether a BAA is needed. A provider that cannot say how it handles PHI in test data is a risk. Settle this before testing, not after.

Where should pentest evidence be stored?

Ask where request logs, screenshots and the report are kept, who can read them, and when they are deleted. Evidence from a health system can contain patient data. Agree the answer in the scope document.

Does a HIPAA mention on a provider page mean its report is accepted?

No. A mention means the page names HIPAA. No provider can promise that an auditor, customer or regulator will accept a report. Send a sample report to the party that decides.

Sources

  1. Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (NPRM, 90 FR 898, 6 January 2025) (checked 9 November 2026)
  2. eCFR: 45 CFR Part 164, Subpart C (Security Standards for the Protection of Electronic Protected Health Information) (checked 9 November 2026)
  3. Reginfo.gov: Unified Agenda entry for RIN 0945-AA22 (checked 9 November 2026)
  4. HHS: HIPAA Security Rule guidance (checked 9 November 2026)
  5. PentestCompare methodology (checked 9 November 2026)

Compare like with like

An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.

Back to the comparisonScoping checklist