# HIPAA penetration testing companies: compared

Source: https://pentestcompare.com/compliance/hipaa/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

HIPAA penetration testing companies whose own pages mention HIPAA, with the BAA, PHI and evidence questions to ask and what the Security Rule does and does not say.

> **Short answer:** The HIPAA Security Rule in force does not name penetration testing. It requires a risk analysis and a periodic evaluation. HHS proposed a pentest at least every 12 months in January 2025, and that proposal is not final. The table lists providers that mention HIPAA, A to Z. Ask about a BAA, PHI in test data and where evidence is stored.

HIPAA penetration testing companies are the providers whose own pages mention HIPAA. That is a statement about their marketing, not about whether your regulator will accept their report. The table lists them A to Z with no ranking, checked on 9 November 2026. Read the questions below before you shortlist.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

## What does HIPAA ask for?

The Security Rule in force asks for a risk analysis and a periodic evaluation. It does not name a penetration test. The full requirement text and the January 2025 proposal are in our guide on [HIPAA penetration testing](https://penetrationtestservices.com/guides/hipaa-penetration-testing/), so we do not repeat them here.

In short: HHS proposed in January 2025 (90 FR 898) to require a pentest at least every 12 months. As of 9 November 2026, the Unified Agenda lists a final rule date of July 2027 and the proposal is not final. This is not legal advice.

## Who needs a test, and when?

Covered entities and business associates that run software holding electronic protected health information (ePHI) should plan a test. Common triggers are a new patient portal, a new integration with an electronic health record system, a risk analysis finding, and a customer's security review. A healthcare customer can still ask a vendor for a recent pentest summary where the rule does not require one.

## What should you ask HIPAA pentest providers?

| Question | Why it matters |
|---|---|
| Will you sign a business associate agreement if testers could see ePHI? | Your counsel decides if one is needed. Ask before scoping ends. |
| How do you keep PHI out of test data? | Use synthetic records and test accounts where you can. |
| Where is evidence stored, and for how long? | Screenshots and logs can contain patient data. |
| Who on your side can see the evidence? | Ask for a role list, not a promise. |
| How do you handle a finding that exposes real PHI during testing? | Agree the stop and notify steps in advance. |
| Do you give a sample report? | Check the Sample report column, then read the report. |

## What drives the price?

Price follows the number of applications and APIs, the roles and tenants tested, the depth of manual work, and the retest terms. The "Published price" column shows a figure only where a provider lists one. A blank figure means we found none, not that the work is cheap. See [penetration testing cost](/guides/penetration-testing-cost/) for sourced ranges.

## How do you read the table?

The filter is a HIPAA mention in the provider's compliance statements, with the source on each provider page. A mention does not show experience with covered entities. Compare the Type column, the Sample report column and the Retest terms, then ask for a reference call on healthcare work. See also [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/).

## What does an auditor check in the report?

We cannot say what your auditor or customer will accept, and no provider can promise it. Ask the party that decides. In general, readers look for a stated scope and dates, the method, a finding list with severity, evidence for each finding, remediation steps and a retest record. Check these in a provider's sample report before you buy.

## Questions

### Does HIPAA require a penetration test?

Not in the rule text now in force. As of 9 November 2026, 45 CFR 164 Subpart C does not contain the word penetration. A 2025 proposal would require one. The proposal is not final. Ask your compliance counsel what applies to you.

### Should a pentest provider sign a business associate agreement?

Ask. If testers could see ePHI, your counsel decides whether a BAA is needed. A provider that cannot say how it handles PHI in test data is a risk. Settle this before testing, not after.

### Where should pentest evidence be stored?

Ask where request logs, screenshots and the report are kept, who can read them, and when they are deleted. Evidence from a health system can contain patient data. Agree the answer in the scope document.

### Does a HIPAA mention on a provider page mean its report is accepted?

No. A mention means the page names HIPAA. No provider can promise that an auditor, customer or regulator will accept a report. Send a sample report to the party that decides.

## Sources

- [Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (NPRM, 90 FR 898, 6 January 2025)](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information)
- [eCFR: 45 CFR Part 164, Subpart C (Security Standards for the Protection of Electronic Protected Health Information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C)
- [Reginfo.gov: Unified Agenda entry for RIN 0945-AA22](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22)
- [HHS: HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html)
- [PentestCompare methodology](https://pentestcompare.com/methodology/)