ISO 27001 penetration testing companies: compared

ISO 27001 penetration testing companies are providers whose pages mention the standard. ISO/IEC 27001:2022 does not name a penetration test as mandatory, so the choice follows your risk assessment. Facts come from the PentestCompare dataset, checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

What does ISO 27001 ask for?#

It asks for an information security management system (ISMS) that manages risk. The Annex A control text does not name pentests. Two controls are where pentest evidence usually fits: 8.8 Management of technical vulnerabilities and 8.29 Security testing in development and acceptance. Control 8.34 covers protecting systems during audit testing, which applies to the rules of engagement for the test.

ISO text is paid and copyrighted, so we name the controls and describe them in our own words. For the control-by-control view, an evidence pack and auditor questions, read our guide ISO 27001 penetration testing on penetrationtestservices.com. We do not repeat it here.

Who needs a pentest for ISO 27001, and when?#

Teams that hold or seek certification and run software or networks in scope need to decide how they meet 8.8 and 8.29. The standard sets no interval, so your risk assessment and Statement of Applicability decide. Many teams test before major releases and once a year, because that is easy to defend.

Your certificate scope matters. If it covers a SaaS product, test the product. If it covers only an office network, a web app test may fall outside the audit. Compare with SOC 2: our SOC 2 penetration testing providers page covers the other framework buyers often hold.

What should you ask a provider?#

Ask these before you buy:

1. Can you scope the test to our ISMS scope statement?
2. Which of our Annex A controls will the report support, in your view? (The auditor decides.)
3. What does the report contain: method, scope, dated findings, severity scale?
4. What is the retest policy, and does it fall within our audit cycle?
5. Can I see a sample report?
6. How do you show tester competence? (Clause 7.2 asks for competence in general.)
7. Who signs the report?

Our guide on questions to ask a pentest provider lists more.

What drives the price?#

Price follows the size of the scope (applications, APIs, hosts), the depth (black box or credentialed), the number of user roles, the report format and the retest terms. ISO 27001 itself adds no fixed price element. Many providers in the table quote after scoping, and a few publish a price for a product or tier. Compare prices only for the same scope.

How should you read the table?#

The table includes every provider whose pages mention ISO 27001. That mention takes several forms. A certificate listed with an evidence link is stronger than a logo on a page. A line that says the provider "supports" the framework describes a service, not a certificate. Open the provider page for the wording and the source.

A provider's own certificate covers the provider's management system. It does not make your audit pass. Check delivery type as well: human-led, hybrid and automated providers all appear, and an auditor may care who tested.

What does an auditor check in the report?#

Auditors usually look for four things: a documented process that says when tests happen, a link to your risk assessment, a dated report with scope, method and findings, and proof that you acted on the results. A retest note or a closed ticket with evidence supports the last point. Open high findings with no plan can draw questions.

Keep the report, the written authorization, the tracker and the retest result in one folder. Ask your certification body which format it prefers, and how it views a tester from your own company.