# PCI DSS penetration testing companies: compared Source: https://pentestcompare.com/compliance/pci-dss/ Publisher: Excession Labs (pentestcompare.com) Last updated: 2026-11-09 PCI DSS penetration testing companies in one sourced table, A to Z, with a segmentation checklist, independence rules and six checks to run before you sign. > **Short answer:** PCI DSS asks for penetration tests under requirement 11.4. The table lists providers whose pages mention PCI DSS, A to Z and unranked. A mention on a provider page is not PCI approval of the provider or its report. Check tester independence, segmentation scope, application-layer coverage and retest terms, and send the scope to your assessor first. Companies that store, process or transmit card data, and service providers that support them, need penetration tests under PCI DSS. This page filters the PentestCompare dataset to providers whose pages mention PCI DSS. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it. A PCI mention on a provider's page does not make the provider or its report acceptable to your assessor. | Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report | |---|---|---|---|---|---|---|---|---|---|---| | [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published | | [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published | | [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request | | [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public | | [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published | | [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published | | [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published | | [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published | | [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published | | [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published | | [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published | | [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request | | [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public | | [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published | | [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published | | [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published | | [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published | | [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public | | [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public | | [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public | | [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published | | [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public | | [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published | | [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published | | [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public | | [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published | | [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request | | [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published | | [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published | ## What does PCI DSS ask of a penetration test? PCI DSS v4.0.1 puts penetration testing under requirement 11.4. PCI SSC published v4.0.1 on 11 June 2024 as a limited revision with no added or deleted requirements, and v4.0 retired on 31 December 2024 ([PCI SSC blog](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1)). We do not repeat the requirement text here. The [PCI DSS penetration testing requirements guide on penetrationtestservices.com](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/) explains requirement 11.4 line by line. Two points from PCI SSC's own summary of changes matter when you choose a provider. Requirement 11.4.1 asks for a defined, documented and implemented methodology, with results retained for at least 12 months. Requirement 11.4.7 is new for multi-tenant service providers, who must support their customers' external penetration tests ([PCI SSC summary of changes](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)). ## Who needs a PCI penetration test, and when? You need one when your cardholder data environment (CDE) falls under PCI DSS validation at a level that includes requirement 11.4. Ask your acquirer which validation level applies. Your Qualified Security Assessor (QSA) or the self-assessment questionnaire you use tells you which requirements apply. Plan the test before the assessment window, with time left to fix findings and retest. A report that lists open critical findings gives your assessor little to accept. PCI DSS keeps scanning and penetration testing apart. Our guide to [pentest versus vulnerability scan](/guides/pentest-vs-vulnerability-scan/) shows the split between requirement 11.3 and 11.4. SOC 2 buyers should read the [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/) guide, because audit evidence works differently there. ## What should you ask PCI pentest providers? Ask for written answers to these six checks. 1. Is the tester organizationally separate from the team that manages the systems under test? PCI SSC guidance says it must be. 2. Does the quote cover the whole CDE perimeter and critical systems, from outside and from inside? 3. Does it include application-layer and network-layer testing? 4. Does it include a segmentation test, if segmentation reduces your PCI scope? 5. Does the retest after fixes appear in the quote, with a date window? 6. Has your assessor seen the scope statement and a sample report? The segmentation question matters most. A provider that tests the web application only leaves the segmentation requirement open. Ask for the segmentation method in plain words: which networks the tester starts from and which targets it tries to reach. ## What drives the price? Scope drives price: the number of in-scope applications and networks, internal and external testing, and segmentation tests. The Published price column shows which providers list prices. As of 9 November 2026 the PCI filter includes both providers with listed prices and many that quote on request. For price ranges and drivers, see our [penetration testing cost guide](/guides/penetration-testing-cost/). Add segmentation testing and internal network testing to the scope when you compare quotes, because a quote for one web application costs less than a quote for a CDE. ## How do you read the table? A "PCI DSS" mention means the provider's pages talk about PCI DSS work. It is a keyword match from the provider's own text. It is not a PCI SSC listing. PCI SSC separates roles. A Qualified Security Assessor (QSA) assesses compliance, and an Approved Scanning Vendor (ASV) runs external scans. The PCI SSC Penetration Testing Guidance has no approved-pentester list. Examples from the dataset show how providers state roles. Schellman states that it is a QSA ([Schellman](https://www.schellman.com/services/penetration-testing)). Halo Security lists PCI SSC Approved Scanning Vendor status, certificate 5078-01-11 ([Halo Security](https://www.halosecurity.com/pci-compliance/)). Check these claims on the PCI SSC lists before you rely on them. On certifications, the PCI guidance says the named examples (OSCP, CEH, GIAC, CREST, CHECK) "are not required certifications", and that qualifications "cannot be met by certifications alone". Ask for the tester's engagement experience as well. ## What does an assessor check in the pentest report? PCI SSC publishes outlines for a report and a retest report. It says they "are only suggested outlines and do not define specific reporting requirements for PCI DSS penetration tests" ([PCI SSC guidance](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)). Your assessor decides what is enough. Expect these items to come up: - The scope and the method, including internal and external testing and application and network layers. - Evidence for each finding: the request, the response and the effect. - Segmentation test results, if you use segmentation. - A retest section that shows the original finding, the retest date and the result. - The tester's independence and qualifications. Send your assessor the provider's sample report and scope statement before you buy. Use the [pentest provider question list](/guides/questions-to-ask-a-pentest-provider/) to cover the rest, and the [scoping checklist](/tools/scoping-checklist/) to set roles, networks and limits. ## Questions ### Does the PCI Security Standards Council approve penetration testing companies? No. The PCI SSC Penetration Testing Guidance says certifications such as OSCP, CREST and CHECK are not required, and the Council does not validate or endorse them. It lists Approved Scanning Vendors and Qualified Security Assessors, which are different roles. ### Can the company that assesses us for PCI DSS also run the pentest? Only if it did not install, maintain or support the systems under test. The PCI SSC guidance says the tester must be organizationally separate from the management of the target systems. Ask your assessor to confirm the setup in writing. ### Is a vulnerability scan enough for PCI DSS? No. PCI DSS treats scans and pentests as separate requirements. Scans fall under 11.3 and pentests under 11.4. One does not replace the other. Our guide on pentest versus vulnerability scan shows the split. ### How long should we keep the pentest report? PCI SSC's summary of changes for v4.0 says the pentest methodology requires results to be retained for at least 12 months. Check the exact wording in the standard with your assessor. ### Does the pentest need to include segmentation testing? Only if you use segmentation to reduce PCI scope. Then the segmentation controls need their own test. Read requirement 11.4 or our requirements guide for the interval, and ask your assessor. ## Sources - [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf) - [PCI DSS v3.2.1 to v4.0 Summary of Changes, r1 (May 2022)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf) - [PCI SSC blog: Just Published, PCI DSS v4.0.1](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1) - [PCI SSC: Qualified Security Assessors list](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors/) - [Schellman: penetration testing](https://www.schellman.com/services/penetration-testing) - [Halo Security: PCI compliance](https://www.halosecurity.com/pci-compliance/)