# ISO 27001 penetration testing companies: compared

Source: https://pentestcompare.com/compliance/iso-27001/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

ISO 27001 penetration testing companies compared from their own pages. ISO 27001 names no pentest, so see what Annex A asks for and what auditors check in a report.

> **Short answer:** ISO/IEC 27001:2022 does not name a penetration test as mandatory. Annex A controls 8.8 and 8.29 are where pentest evidence usually fits, and your risk assessment sets the need. The table lists providers whose pages mention ISO 27001. A provider's own certificate covers the provider, not your audit. Ask your certification body what it accepts.

ISO 27001 penetration testing companies are providers whose pages mention the standard. ISO/IEC 27001:2022 does not name a penetration test as mandatory, so the choice follows your risk assessment. Facts come from the [PentestCompare dataset](/directory/), checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

## What does ISO 27001 ask for?

It asks for an information security management system (ISMS) that manages risk. The Annex A control text does not name pentests. Two controls are where pentest evidence usually fits: 8.8 Management of technical vulnerabilities and 8.29 Security testing in development and acceptance. Control 8.34 covers protecting systems during audit testing, which applies to the rules of engagement for the test.

ISO text is paid and copyrighted, so we name the controls and describe them in our own words. For the control-by-control view, an evidence pack and auditor questions, read our guide [ISO 27001 penetration testing](https://penetrationtestservices.com/guides/iso-27001-penetration-testing/) on penetrationtestservices.com. We do not repeat it here.

## Who needs a pentest for ISO 27001, and when?

Teams that hold or seek certification and run software or networks in scope need to decide how they meet 8.8 and 8.29. The standard sets no interval, so your risk assessment and Statement of Applicability decide. Many teams test before major releases and once a year, because that is easy to defend.

Your certificate scope matters. If it covers a SaaS product, test the product. If it covers only an office network, a web app test may fall outside the audit. Compare with SOC 2: our [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/) page covers the other framework buyers often hold.

## What should you ask a provider?

Ask these before you buy:

1. Can you scope the test to our ISMS scope statement?
2. Which of our Annex A controls will the report support, in your view? (The auditor decides.)
3. What does the report contain: method, scope, dated findings, severity scale?
4. What is the retest policy, and does it fall within our audit cycle?
5. Can I see a sample report?
6. How do you show tester competence? (Clause 7.2 asks for competence in general.)
7. Who signs the report?

Our guide on [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) lists more.

## What drives the price?

Price follows the size of the scope (applications, APIs, hosts), the depth (black box or credentialed), the number of user roles, the report format and the retest terms. ISO 27001 itself adds no fixed price element. Many providers in the table quote after scoping, and a few publish a price for a product or tier. Compare prices only for the same scope.

## How should you read the table?

The table includes every provider whose pages mention ISO 27001. That mention takes several forms. A certificate listed with an evidence link is stronger than a logo on a page. A line that says the provider "supports" the framework describes a service, not a certificate. Open the provider page for the wording and the source.

A provider's own certificate covers the provider's management system. It does not make your audit pass. Check delivery type as well: human-led, hybrid and automated providers all appear, and an auditor may care who tested.

## What does an auditor check in the report?

Auditors usually look for four things: a documented process that says when tests happen, a link to your risk assessment, a dated report with scope, method and findings, and proof that you acted on the results. A retest note or a closed ticket with evidence supports the last point. Open high findings with no plan can draw questions.

Keep the report, the written authorization, the tracker and the retest result in one folder. Ask your certification body which format it prefers, and how it views a tester from your own company.

## Questions

### Do ISO 27001 pentest providers need to be ISO 27001 certified?

No standard text we read requires it. A provider's certificate covers its own management system, not your audit. Some buyers ask for it as a vendor check. Ask your certification body what evidence of tester competence it expects.

### Does the table show providers certified to ISO 27001?

It shows providers whose pages mention ISO 27001. Some hold a certificate, some say they support the framework. The provider page and the Credentials field in the dataset show the wording and the evidence link.

### How often should I test for ISO 27001?

The standard sets no interval. Your risk assessment sets it, and a common pattern is a test every year and after major changes. Write the interval into your procedure and follow it.

### Will an ISO 27001 auditor accept any provider's report?

No provider can promise acceptance. The certification body sets its own evidence standard. Send the sample report and scope statement to your auditor before you buy.

## Sources

- [ISO: ISO/IEC 27001:2022 Information security management systems](https://www.iso.org/standard/27001)
- [ISO: ISO/IEC 27002:2022 Information security controls](https://www.iso.org/standard/75652.html)
- [ISMS.online: ISO 27001 Annex A 8.29 Security testing in development and acceptance](https://www.isms.online/iso-27001/annex-a-2022/8-29-security-testing-in-development-acceptance-2022/)
- [PentestCompare methodology and provider dataset](https://pentestcompare.com/methodology/)