{
  "publisher": "Excession Labs",
  "source": "https://pentestcompare.com/methodology/",
  "note": "Provider facts from each provider's public pages. Unknown values are 'Not published'.",
  "providers": [
    {
      "slug": "aikido",
      "name": "Aikido",
      "website": "https://www.aikido.dev/",
      "type": "Application security platform",
      "delivery": "automated",
      "delivery_note": "AI agents map, attack and verify; a human-led CREST pentest is available on request.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "yes"
      },
      "pricing_model": "mixed",
      "prices": [
        {
          "label": "TYPICAL Pentest",
          "amount": "$4,000",
          "unit": "per assessment",
          "covers": "One application plus its primary APIs, whitebox; black-box and grey-box cost extra; same-day results; free retests for up to 6 months; no High or Critical finding means no charge.",
          "source": "https://www.aikido.dev/pricing"
        },
        {
          "label": "Rightsized Pentest",
          "amount": "$50 to $30,000+",
          "unit": "per assessment",
          "covers": "Scoped to the application from the repos, endpoints and roles; priced by number of AI agents and credits.",
          "source": "https://www.aikido.dev/pricing"
        }
      ],
      "pricing_note": "Both prices are one-off assessments, not subscriptions. Continuous testing is custom priced. Aikido's platform subscriptions (separate from pentests) are not listed here. Prices are also shown in EUR, GBP and INR.",
      "turnaround": {
        "claim": "TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days.",
        "meaning": "Time to results for an automated run; the page's statements are not consistent.",
        "source": "https://www.aikido.dev/pricing"
      },
      "retesting": {
        "claim": "Free retesting for up to 6 months, including checks for bypasses of fixes.",
        "source": "https://www.aikido.dev/pricing"
      },
      "sample_report": {
        "status": "public",
        "url": "https://www.aikido.dev/attack/aipentest"
      },
      "credentials": [
        {
          "name": "SOC 2, ISO 27001, ISO 42001, CREST (as listed on the AI pentest page; CREST may relate to the human-led option)",
          "evidence": "https://www.aikido.dev/attack/aipentest"
        }
      ],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "HIPAA"
      ],
      "integrations": [
        "Code repositories (AutoFix pull requests)",
        "CI/CD"
      ],
      "best_fit": "Small and mid-size teams that need a low-cost, fast automated pentest for audit evidence, with a pay-only-if-serious-findings guarantee.",
      "tradeoffs": "The Rightsized range is very wide, so the real price is only known after scoping. Sample reports found cover network, mobile and AI, not web/API.",
      "summary": "Aikido sells an AI pentest with fixed and scoped pricing, plus continuous testing. Reports are aimed at SOC 2, ISO 27001 and HIPAA evidence, and a human-led CREST pentest can be requested.",
      "sources": [
        {
          "url": "https://www.aikido.dev/pricing",
          "title": "Aikido pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.aikido.dev/attack/aipentest",
          "title": "Aikido AI pentest",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "breachlock",
      "name": "BreachLock",
      "website": "https://www.breachlock.com/",
      "type": "PTaaS platform",
      "delivery": "hybrid",
      "delivery_note": "Human-led PTaaS by an in-house team described as expert-led and AI-accelerated, plus a separate autonomous product (Breach360).",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "unknown"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "The pricing page describes Standard, Extended and Extensive tiers but lists no dollar figures; every tier links to a quote or discovery call.",
      "turnaround": {
        "claim": "Pentests can be scoped and started within 24-48 hours.",
        "meaning": "Time to start a test. Test length and report delivery are not stated.",
        "source": "https://www.breachlock.com/"
      },
      "retesting": {
        "claim": "Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting.",
        "source": "https://www.breachlock.com/pricing/penetration-testing-pricing/"
      },
      "sample_report": {
        "status": "on request",
        "url": null
      },
      "credentials": [
        {
          "name": "CREST-accredited provider",
          "evidence": "https://www.breachlock.com/"
        }
      ],
      "compliance_mentions": [
        "PCI DSS",
        "ISO 27001",
        "HIPAA",
        "SOC 2",
        "GDPR",
        "DORA",
        "NIST CSF 2.0"
      ],
      "integrations": [],
      "best_fit": "Buyers who want a CREST-accredited in-house human team with audit-ready reports and a defined free-retest count per tier.",
      "tradeoffs": "No prices or sample report are published. Retest allowances are stated differently in the tier table and the product text.",
      "summary": "BreachLock offers human-led pentesting as a service from an in-house team, alongside attack surface discovery and an autonomous testing product. Pricing is tiered but quote-only.",
      "sources": [
        {
          "url": "https://www.breachlock.com/pricing/penetration-testing-pricing/",
          "title": "BreachLock pentest pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.breachlock.com/",
          "title": "BreachLock homepage",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "cobalt",
      "name": "Cobalt",
      "website": "https://www.cobalt.io/",
      "type": "PTaaS platform",
      "delivery": "hybrid",
      "delivery_note": "Testing is done by a network of vetted freelance pentesters (the Cobalt Core), with AI agents and a separate autonomous pentest option.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "yes"
      },
      "pricing_model": "mixed",
      "prices": [
        {
          "label": "Autonomous Pentest (limited-time offer)",
          "amount": "$3,500",
          "unit": "per test",
          "covers": "Web application test started through the platform; findings in 24 hours; offer says the test must start and finish before Dec 31, 2026.",
          "source": "https://www.cobalt.io/pricing"
        }
      ],
      "pricing_note": "Only the Autonomous Pentest has a dollar price, and it is a one-off test on a limited-time offer. Standard, Premium and Enterprise tiers are annual credit packages with no published price; one credit equals 8 hours of testing. Credits deducted for a test can vary with the contracted per-credit rate.",
      "turnaround": {
        "claim": "Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type.",
        "meaning": "Time to start a test (annual tiers) or time to first findings (autonomous test). Not the time to the final report.",
        "source": "https://www.cobalt.io/pricing"
      },
      "retesting": {
        "claim": "Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ.",
        "source": "https://www.cobalt.io/pricing"
      },
      "sample_report": {
        "status": "on request",
        "url": null
      },
      "credentials": [
        {
          "name": "SOC 2 Type II (Cobalt's own audit)",
          "evidence": "https://www.cobalt.io/trust-center"
        },
        {
          "name": "ISO 27001 certified",
          "evidence": "https://www.cobalt.io/trust-center"
        },
        {
          "name": "CREST Penetration Testing Service accreditation",
          "evidence": "https://www.cobalt.io/trust-center"
        }
      ],
      "compliance_mentions": [
        "HIPAA"
      ],
      "integrations": [
        "Jira",
        "GitHub",
        "Slack"
      ],
      "best_fit": "Teams that want human pentesters on a platform with fast starts and in-platform retesting, and that are happy to buy an annual credit package. The $3,500 autonomous option gives a published entry price for a web app test.",
      "tradeoffs": "Prices for the human-led annual tiers are not published; you must ask for a quote. The retest window is stated two different ways on the pricing page.",
      "summary": "Cobalt sells pentests through a platform that connects buyers with a network of vetted freelance testers, plus an autonomous pentest product. Work is bought mostly as annual credit packages, and results appear in the platform as testing proceeds.",
      "sources": [
        {
          "url": "https://www.cobalt.io/pricing",
          "title": "Cobalt pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.cobalt.io/",
          "title": "Cobalt homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.cobalt.io/trust-center",
          "title": "Cobalt Trust Center",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "escape",
      "name": "Escape",
      "website": "https://escape.tech/",
      "type": "Application security platform",
      "delivery": "automated",
      "delivery_note": "Testing is run by AI; the vendor describes AI pentesting as having no human in the loop, with an AI assistant for setup.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "yes",
        "mobile": "unknown",
        "ai_apps": "yes"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "No prices, plans or units on the pricing page. It says the bill does not rise with scan volume, but names no billing unit. Also sold through AWS Marketplace and resellers.",
      "turnaround": {
        "claim": "Continuous AI pentesting: results in minutes on merge, deploy or schedule.",
        "meaning": "Time to results for an automated run, not a manual engagement.",
        "source": "https://escape.tech/pricing"
      },
      "retesting": {
        "claim": "Open issues are re-checked; external network pentesting is followed by a retest. No limits stated.",
        "source": "https://escape.tech/pricing"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "PCI DSS"
      ],
      "integrations": [
        "Wiz"
      ],
      "best_fit": "Developer-centred teams that want pentest-style testing triggered on every release alongside DAST, and external network checks.",
      "tradeoffs": "No price or sample report is published. The vendor states it does not test internal network lateral movement. No company certifications are listed on the pages checked.",
      "summary": "Escape is an application security platform with AI-driven continuous pentesting, business-logic-aware DAST and external network pentesting. Tests can run on merge, deploy or a schedule.",
      "sources": [
        {
          "url": "https://escape.tech/pricing",
          "title": "Escape pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://escape.tech/product/ai-pentesting",
          "title": "Escape AI pentesting",
          "checked": "2026-11-09"
        },
        {
          "url": "https://escape.tech/solutions/external-pentesting",
          "title": "Escape external network pentesting (found via search; not opened directly)",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "excession-labs",
      "name": "Excession Labs",
      "website": "https://penetrationtestservices.com/",
      "type": "AI-assisted testing service",
      "delivery": "hybrid",
      "delivery_note": "Incursion, the Excession Labs testing agent, runs the testing tasks under tool rules. Excession Labs scopes the work, checks the evidence for each finding and writes the report.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "unknown",
        "mobile": "unknown",
        "ai_apps": "yes"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "Quotes follow a scoping call. A free pilot with a small written scope is available. No prices are published.",
      "turnaround": {
        "claim": "Not published",
        "meaning": "",
        "source": null
      },
      "retesting": {
        "claim": "Retest of fixed findings is offered; terms are set in each quote.",
        "source": "https://penetrationtestservices.com/pricing/"
      },
      "sample_report": {
        "status": "public",
        "url": "https://penetrationtestservices.com/sample-report/"
      },
      "credentials": [],
      "compliance_mentions": [
        "SOC 2"
      ],
      "integrations": [],
      "best_fit": "Teams that want web app, API or multi-tenant SaaS testing with request-level evidence for each finding, and that want to judge the provider first through a free scoped pilot.",
      "tradeoffs": "No published prices, turnaround or credentials. The public sample report is a demonstration for a fictional app, not a customer report. Network, cloud and mobile testing are not described on its pages.",
      "summary": "Excession Labs tests web applications, APIs and multi-tenant SaaS platforms with Incursion, its own AI testing agent, and checks the evidence for each finding before it goes in the report. It also assesses LLM applications and AI agents. Excession Labs publishes PentestCompare.",
      "sources": [
        {
          "url": "https://penetrationtestservices.com/",
          "title": "Penetration Test Services home page",
          "checked": "2026-11-09"
        },
        {
          "url": "https://penetrationtestservices.com/pricing/",
          "title": "Pricing and scope",
          "checked": "2026-11-09"
        },
        {
          "url": "https://penetrationtestservices.com/methodology/",
          "title": "Methodology",
          "checked": "2026-11-09"
        },
        {
          "url": "https://aipentestservices.com/how-it-works/",
          "title": "How AI-assisted testing works",
          "checked": "2026-11-09"
        },
        {
          "url": "https://airedteamingservices.com/",
          "title": "AI red teaming services",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "hackerone",
      "name": "HackerOne",
      "website": "https://www.hackerone.com/",
      "type": "Crowdsourced platform",
      "delivery": "hybrid",
      "delivery_note": "H1 Pentest is fully human-led; H1 Agentic Pentest pairs AI agents with human pentesters who review every agent finding.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "yes"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "No dollar amounts on the pricing page; all tiers route to sales. The only metered unit shown is monthly automations for the platform tiers, which is not a pentest price. The agentic tier currently covers web apps and APIs only; the wider scope list applies to the human-led H1 Pentest.",
      "turnaround": {
        "claim": "Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends.",
        "meaning": "Docs figure is report delivery after the testing phase, not time to start.",
        "source": "https://www.hackerone.com/product/pentest"
      },
      "retesting": {
        "claim": "Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording.",
        "source": "https://www.hackerone.com/product/pentest"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "PCI DSS",
        "DORA",
        "NIST CSF 2.0",
        "GDPR"
      ],
      "integrations": [
        "GitHub",
        "Jira",
        "Slack",
        "ServiceNow"
      ],
      "best_fit": "Organisations that already use HackerOne or want pentests from the same vendor as a bug bounty or disclosure program, and that want a choice between fully human and AI-assisted testing.",
      "tradeoffs": "Pricing is quote-only, no sample report is offered and no testing lead time is published. Retest terms differ between product page, docs and older posts.",
      "summary": "HackerOne offers pentest as a service in two forms: a human-led H1 Pentest and an H1 Agentic Pentest where AI agents work under human review. Results stream into the HackerOne platform and a final report closes the engagement.",
      "sources": [
        {
          "url": "https://www.hackerone.com/pricing",
          "title": "HackerOne pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.hackerone.com/product/pentest",
          "title": "HackerOne pentest product page",
          "checked": "2026-11-09"
        },
        {
          "url": "https://docs.hackerone.com/en/articles/8541386-retesting-pentests",
          "title": "HackerOne docs: retesting pentests (found via search; not opened directly)",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "hadrian",
      "name": "Hadrian",
      "website": "https://hadrian.io/products/nova",
      "type": "Autonomous testing platform",
      "delivery": "hybrid",
      "delivery_note": "A fleet of AI agents runs the Nova tests; findings are described as human-reviewed, but who reviews them is not stated.",
      "scope": {
        "web_app": "yes",
        "api": "unknown",
        "cloud": "unknown",
        "network": "unknown",
        "mobile": "unknown",
        "ai_apps": "unknown"
      },
      "pricing_model": "mixed",
      "prices": [
        {
          "label": "Nova test",
          "amount": "From EUR 1,250",
          "unit": "per test, excluding VAT",
          "covers": "One agentic pentest with full reporting; bundles are available; what one test covers is not defined.",
          "source": "https://hadrian.io/pricing"
        }
      ],
      "pricing_note": "Priced in euros, as a starting price per test. Bundle sizes and prices are not published. Hadrian's Atlas attack surface product is priced by asset count with no figures shown.",
      "turnaround": {
        "claim": "Most tests finish within 24 to 48 hours; same-day start possible.",
        "meaning": "Test duration after start; the page also uses hours and days elsewhere.",
        "source": "https://hadrian.io/products/nova"
      },
      "retesting": {
        "claim": "Not published",
        "source": "https://hadrian.io/pricing"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [
        {
          "name": "SOC 2 Type 2 (badge on page)",
          "evidence": "https://hadrian.io/products/nova"
        }
      ],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "NIS2",
        "DORA"
      ],
      "integrations": [],
      "best_fit": "Teams that want a published starting price per test and a quick agentic test of an application before launch or after a major change.",
      "tradeoffs": "The unit is not defined, retest terms are not stated, and no sample report is offered. The scope list does not name APIs, cloud or mobile.",
      "summary": "Hadrian Nova runs AI agent pentests against an application or environment the customer defines. Results stream live and a compliance-mapped PDF report is included.",
      "sources": [
        {
          "url": "https://hadrian.io/products/nova",
          "title": "Hadrian Nova",
          "checked": "2026-11-09"
        },
        {
          "url": "https://hadrian.io/pricing",
          "title": "Hadrian pricing",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "horizon3",
      "name": "Horizon3.ai (NodeZero)",
      "website": "https://www.horizon3.ai/",
      "type": "Autonomous testing platform",
      "delivery": "automated",
      "delivery_note": "NodeZero is software that runs the attacks itself; no human pentesters are described on the pages checked.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "unknown",
        "ai_apps": "unknown"
      },
      "pricing_model": "published",
      "prices": [
        {
          "label": "Flex",
          "amount": "$15",
          "unit": "per asset, per test (12-month term)",
          "covers": "Internal, external, cloud (AWS/Azure) and Kubernetes pentests, reports, fix verification; no add-ons.",
          "source": "https://horizon3.ai/use-case/pricing/"
        },
        {
          "label": "Core",
          "amount": "$50",
          "unit": "per asset, annual subscription",
          "covers": "Unlimited testing; each asset billed once per 12 months; adds scheduling.",
          "source": "https://horizon3.ai/use-case/pricing/"
        },
        {
          "label": "Pro",
          "amount": "$65",
          "unit": "per asset, annual subscription",
          "covers": "Core plus tripwires and rapid response.",
          "source": "https://horizon3.ai/use-case/pricing/"
        },
        {
          "label": "Elite",
          "amount": "$85",
          "unit": "per asset, annual subscription",
          "covers": "Pro plus insights, high-value targeting, advanced data pilfering, threat actor intelligence and vulnerability prioritization.",
          "source": "https://horizon3.ai/use-case/pricing/"
        },
        {
          "label": "WebApp Flex",
          "amount": "$10,000",
          "unit": "per app, per test (12-month term)",
          "covers": "Web application pentesting, sold as add-on or standalone; the page does not define the scope of one test.",
          "source": "https://horizon3.ai/use-case/pricing/"
        }
      ],
      "pricing_note": "The unit is a discovered asset (server, device, cloud resource or service), not a test or an engagement. Flex is per asset per test; Core, Pro and Elite are annual subscriptions. WebApp pricing is per app. Support tiers cost extra (Enhanced 10% of subscription, minimum $7,500/year; Premier 20%, minimum $25,000/year). Totals depend on asset count, which is not known in advance.",
      "turnaround": {
        "claim": "Not published as a time. WebApp page says tests can be set up quickly and run as often as needed.",
        "meaning": "No start time, test length or report time is stated.",
        "source": "https://horizon3.ai/nodezero/webapp/"
      },
      "retesting": {
        "claim": "Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test.",
        "source": "https://horizon3.ai/use-case/pricing/"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [],
      "compliance_mentions": [
        "PCI DSS",
        "NIS 2"
      ],
      "integrations": [
        "MCP Server"
      ],
      "best_fit": "Security teams that want to test internal and external networks, cloud and Active Directory often, and can count their assets. The published per-asset prices make budgeting possible once the asset count is known.",
      "tradeoffs": "Costs scale with asset count and are hard to compare with per-test prices. The pages checked do not mention mobile or human review of findings, and no sample report is offered.",
      "summary": "NodeZero is an autonomous pentesting platform covering internal, external, cloud, Kubernetes and Active Directory testing, with a newer web application module. List prices are published per asset.",
      "sources": [
        {
          "url": "https://horizon3.ai/use-case/pricing/",
          "title": "NodeZero pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.horizon3.ai/",
          "title": "Horizon3.ai homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://horizon3.ai/nodezero/webapp/",
          "title": "NodeZero WebApp",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "parameter",
      "name": "Parameter",
      "website": "https://www.parameter.ai/",
      "type": "AI-assisted testing service",
      "delivery": "automated",
      "delivery_note": "Autonomous AI agents run the pentest; they pause for the customer's approval before chaining or escalating.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "unknown",
        "mobile": "unknown",
        "ai_apps": "unknown"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "Three tiers (Single App, Rightsized, Continuous) with no dollar amounts; all go to sales. Pricing follows the size of what is tested, not seats.",
      "turnaround": {
        "claim": "First findings in 24 hours; most runs finish the same day they start.",
        "meaning": "Time from start to first findings and typical run length.",
        "source": "https://www.parameter.ai/pentesting"
      },
      "retesting": {
        "claim": "Free re-testing is listed for Single App and inherited by higher tiers.",
        "source": "https://www.parameter.ai/pentesting"
      },
      "sample_report": {
        "status": "public",
        "url": "https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf"
      },
      "credentials": [
        {
          "name": "SOC 2 Type I report (Type II observation period in progress)",
          "evidence": "https://www.parameter.ai/security"
        }
      ],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "PCI DSS",
        "FedRAMP",
        "HIPAA"
      ],
      "integrations": [
        "Linear"
      ],
      "best_fit": "Teams that want a quick automated web app and API pentest with auditor-mapped reports and a public sample to review first.",
      "tradeoffs": "No prices are published. The SOC 2 report is Type I only, and the Type II period is not complete.",
      "summary": "Parameter offers AI-agent pentesting for web apps, APIs and infrastructure, needing only a URL and credentials. One run produces executive, customer, auditor and remediation reports.",
      "sources": [
        {
          "url": "https://www.parameter.ai/pentesting",
          "title": "Parameter pentesting",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.parameter.ai/",
          "title": "Parameter homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.parameter.ai/security",
          "title": "Parameter security",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "pen-test-partners",
      "name": "Pen Test Partners",
      "website": "https://www.pentestpartners.com/",
      "type": "Consultancy",
      "delivery": "human-led",
      "delivery_note": "A UK and US consultancy whose staff perform the tests, including CHECK testing for UK public sector; it also offers a time-block PTaaS service.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "yes"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "No prices published. PTaaS is a subscription where you buy a block of time, billed in half-day blocks, for tests from half a day to two days.",
      "turnaround": {
        "claim": "PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published.",
        "meaning": "PTaaS start time after a contract is in place. Time to start a standard test is not stated.",
        "source": "https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/"
      },
      "retesting": {
        "claim": "Not published",
        "source": null
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [
        {
          "name": "NCSC CHECK penetration testing",
          "evidence": "https://www.pentestpartners.com/"
        },
        {
          "name": "CREST member",
          "evidence": "https://www.pentestpartners.com/"
        },
        {
          "name": "ISO 27001",
          "evidence": "https://www.pentestpartners.com/"
        },
        {
          "name": "PCI QSA",
          "evidence": "https://www.pentestpartners.com/"
        }
      ],
      "compliance_mentions": [
        "PCI DSS",
        "ISO 27001",
        "Cyber Essentials",
        "CBEST",
        "TIBER"
      ],
      "integrations": [],
      "best_fit": "Regulated and public-sector buyers (UK especially), and organisations needing OT, IoT, transport or red team work from an accredited human team.",
      "tradeoffs": "No prices, standard-test turnaround, retest terms or sample report are published. Credentials were read from homepage badges and links.",
      "summary": "Pen Test Partners is a cyber security consultancy offering manual pentesting, red teaming and compliance services across many sectors. A PTaaS subscription covers short tests of changes to web apps, mobile apps, APIs and external infrastructure.",
      "sources": [
        {
          "url": "https://www.pentestpartners.com/",
          "title": "Pen Test Partners homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/",
          "title": "Pen Test Partners PTaaS",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "secure-ideas",
      "name": "Secure Ideas",
      "website": "https://secureideas.com/",
      "type": "Consultancy",
      "delivery": "human-led",
      "delivery_note": "In-house consultants run the tests and write the reports; the vendor says it does not rely on automated scans.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "unknown"
      },
      "pricing_model": "published",
      "prices": [
        {
          "label": "External Penetration Test (smallest scope)",
          "amount": "$8,160",
          "unit": "per test (flat fee, starting)",
          "covers": "Smallest of four scope tiers.",
          "source": "https://secureideas.com/pricing"
        },
        {
          "label": "API Penetration Test (smallest scope)",
          "amount": "$10,880",
          "unit": "per test (flat fee, starting)",
          "covers": "Smallest of four scope tiers.",
          "source": "https://secureideas.com/pricing"
        },
        {
          "label": "Web Application Test (smallest scope)",
          "amount": "$13,600",
          "unit": "per test (flat fee, starting)",
          "covers": "Smallest of four scope tiers.",
          "source": "https://secureideas.com/pricing"
        },
        {
          "label": "Hourly rate",
          "amount": "$340",
          "unit": "per hour ($2,720 per day)",
          "covers": "Standard consulting rate for flat fee or credits.",
          "source": "https://secureideas.com/pricing"
        },
        {
          "label": "PETaaS credit",
          "amount": "$2,520",
          "unit": "per credit (up to one day of expert work)",
          "covers": "Minimum purchase 25 credits; volume discounts of 5-15% from 30 credits.",
          "source": "https://secureideas.com/pricing"
        }
      ],
      "pricing_note": "Flat-fee prices are starting prices for the smallest scope; larger scopes cost more, and the homepage says most tests cost $10K-$45K. Credits are a prepaid pool of effort-days, not a per-test price. Attestation letters and retesting can change the quote.",
      "turnaround": {
        "claim": "Testing usually starts two to four weeks after contracting; one to two weeks of testing.",
        "meaning": "Time from contract to test start, and typical test duration, per the homepage. Report delivery time is not stated.",
        "source": "https://secureideas.com/"
      },
      "retesting": {
        "claim": "Not included by default; retesting is listed as a factor that can change the quote.",
        "source": "https://secureideas.com/pricing"
      },
      "sample_report": {
        "status": "public",
        "url": "https://secureideas.com/sample-report"
      },
      "credentials": [
        {
          "name": "CREST accredited company",
          "evidence": "https://secureideas.com/"
        }
      ],
      "compliance_mentions": [
        "PCI DSS",
        "HIPAA",
        "SOC 2",
        "DORA"
      ],
      "integrations": [],
      "best_fit": "Buyers who want an experienced manual team with published rates and a sample report to review before talking to sales.",
      "tradeoffs": "Entry prices are higher than automated options and the test starts weeks after contracting. The PETaaS credit plan needs a minimum purchase of 25 credits (about $63,000).",
      "summary": "Secure Ideas is a boutique offensive security consultancy. It sells fixed-fee projects and PETaaS prepaid credits, with published hourly rates and starting prices by test type.",
      "sources": [
        {
          "url": "https://secureideas.com/pricing",
          "title": "Secure Ideas pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://secureideas.com/",
          "title": "Secure Ideas homepage",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "synack",
      "name": "Synack",
      "website": "https://www.synack.com/",
      "type": "Crowdsourced platform",
      "delivery": "hybrid",
      "delivery_note": "Combines Sara, an autonomous AI agent, with the Synack Red Team of vetted human researchers; the SynackST product uses a single human tester.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "yes",
        "network": "yes",
        "mobile": "yes",
        "ai_apps": "yes"
      },
      "pricing_model": "mixed",
      "prices": [
        {
          "label": "Sara Pentest",
          "amount": "$5,085",
          "unit": "per test (starting price)",
          "covers": "One Standard Sara Pentest, external web or host only; 4-5 business day window; patch verification and report included.",
          "source": "https://www.synack.com/pricing/"
        },
        {
          "label": "SynackST (compliance)",
          "amount": "$10,283",
          "unit": "per test (starting price)",
          "covers": "One Standard pentest by a single tester for one framework; up to 25 unauthenticated web apps, or 1 low-complexity authenticated web app, or 100 host IPs; 5-day window.",
          "source": "https://www.synack.com/pricing/"
        },
        {
          "label": "Synack14",
          "amount": "$27,120",
          "unit": "per test (starting price)",
          "covers": "One Synack14 pentest by a team; up to 50 unauthenticated web apps, or 1 authenticated web app, or 250 host IPs; 14-day window.",
          "source": "https://www.synack.com/pricing/"
        }
      ],
      "pricing_note": "Prices are starting prices per test, bought with credits that expire one year after purchase. The Synack Platform is required for any test and is billed separately with no published price (a free Basic tier exists). Enterprise is custom.",
      "turnaround": {
        "claim": "Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14).",
        "meaning": "Length of the testing window, not time to start or time to report.",
        "source": "https://www.synack.com/pricing/"
      },
      "retesting": {
        "claim": "Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests.",
        "source": "https://www.synack.com/pricing/"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [
        {
          "name": "FedRAMP authorized (level not stated on the pages checked)",
          "evidence": "https://www.synack.com/pricing/"
        }
      ],
      "compliance_mentions": [
        "FISMA",
        "CMMC",
        "NIST",
        "SOC 2",
        "PCI DSS"
      ],
      "integrations": [
        "ServiceNow",
        "Jira",
        "Splunk",
        "Qualys",
        "Palo Alto Networks",
        "Microsoft"
      ],
      "best_fit": "Buyers who want published starting prices for a range of depth levels, including a team-based 14-day test, and public-sector buyers who need FedRAMP-aligned procurement paths.",
      "tradeoffs": "The mandatory platform subscription is not priced, so the all-in cost is not visible. Prices are starting prices that depend on scope. Synack merged with NetSPI (announced Sept 2, 2026), so offerings may change.",
      "summary": "Synack sells pentests that mix an AI agent (Sara) with a vetted crowd of researchers, in point-in-time or continuous form. Pricing is published per product as a starting price, bought through credits.",
      "sources": [
        {
          "url": "https://www.synack.com/pricing/",
          "title": "Synack pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.synack.com/",
          "title": "Synack homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://www.synack.com/netspi-and-synack/",
          "title": "NetSPI and Synack merger notice (found via search; not opened directly)",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "terra-security",
      "name": "Terra Security",
      "website": "https://www.terra.security/",
      "type": "AI-assisted testing service",
      "delivery": "hybrid",
      "delivery_note": "AI agents run the tests with human pentesters supervising; reports are signed by certified pentesters (certifications not named).",
      "scope": {
        "web_app": "yes",
        "api": "unknown",
        "cloud": "unknown",
        "network": "yes",
        "mobile": "unknown",
        "ai_apps": "yes"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "No pricing page found (it returned not found) and no prices on the homepage; the only path is to book a demo.",
      "turnaround": {
        "claim": "Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests.",
        "meaning": "A marketing comparison of testing time, not a defined service level.",
        "source": "https://www.terra.security/"
      },
      "retesting": {
        "claim": "Not published",
        "source": null
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [
        {
          "name": "SOC 2 Type II (badge)",
          "evidence": "https://www.terra.security/"
        },
        {
          "name": "CREST Member 2025 (badge)",
          "evidence": "https://www.terra.security/"
        }
      ],
      "compliance_mentions": [],
      "integrations": [],
      "best_fit": "Teams that want continuous AI testing with a human on the loop and signed reports, including AI application red teaming.",
      "tradeoffs": "No prices, retest terms, named integrations or sample report are published, and the page names no frameworks.",
      "summary": "Terra Security offers an AI-agent pentesting platform with human oversight through a workspace called TORCH. It covers web apps, AI red teaming, and external and internal networks.",
      "sources": [
        {
          "url": "https://www.terra.security/",
          "title": "Terra Security homepage",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "turbopentest",
      "name": "TurboPentest",
      "website": "https://turbopentest.com/",
      "type": "AI-assisted testing service",
      "delivery": "automated",
      "delivery_note": "Self-service AI agents run the pentest; the page does not say humans validate findings, and it provides a threat model for human follow-up.",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "yes",
        "mobile": "unknown",
        "ai_apps": "yes"
      },
      "pricing_model": "published",
      "prices": [
        {
          "label": "Audit-Ready",
          "amount": "$99",
          "unit": "per credit (one pentest)",
          "covers": "1 target, 4 agents, up to 4 agent-hours; report and signed attestation letter.",
          "source": "https://turbopentest.com/pricing"
        },
        {
          "label": "Threat-Hunt",
          "amount": "$299",
          "unit": "per credit (one pentest)",
          "covers": "Up to 4 targets, 10 agents, up to 20 agent-hours.",
          "source": "https://turbopentest.com/pricing"
        },
        {
          "label": "Adversarial-Depth",
          "amount": "$699",
          "unit": "per credit (one pentest)",
          "covers": "Up to 8 targets, 20 agents, up to 80 agent-hours.",
          "source": "https://turbopentest.com/pricing"
        },
        {
          "label": "Monthly pentest",
          "amount": "$99",
          "unit": "per month",
          "covers": "One verified target re-tested each month; cancel anytime.",
          "source": "https://turbopentest.com/pricing"
        },
        {
          "label": "Enterprise dedicated instance",
          "amount": "$49,990",
          "unit": "per year ($4,999 per month)",
          "covers": "Unlimited targets and tiers in the customer's own cloud; cloud and model costs are paid separately.",
          "source": "https://turbopentest.com/pricing"
        }
      ],
      "pricing_note": "Credit prices are one-off tests; the monthly plan and enterprise instance are subscriptions. Extra targets cost $99 each (the 11-08 report cites a five-target example at $398: $299 for four plus $99 for one more). Bulk credit discounts of 10-30% apply from 10 credits.",
      "turnaround": {
        "claim": "All tiers typically complete in a few hours.",
        "meaning": "Run time for the automated test until the report is ready.",
        "source": "https://turbopentest.com/pricing"
      },
      "retesting": {
        "claim": "A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain).",
        "source": "https://turbopentest.com/pricing"
      },
      "sample_report": {
        "status": "public",
        "url": "https://turbopentest.com/sample-report"
      },
      "credentials": [
        {
          "name": "States its own operations are PCI DSS and CMMC compliant (vendor claim)",
          "evidence": "https://turbopentest.com/"
        }
      ],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "HIPAA",
        "PCI DSS",
        "CMMC"
      ],
      "integrations": [
        "GitHub",
        "GitHub Actions",
        "VS Code",
        "Burp Suite Pro"
      ],
      "best_fit": "Teams that need a very low-cost, fast external web and API test with a signed letter for questionnaires and common audits, and are comfortable with automation only.",
      "tradeoffs": "Business logic areas are flagged for manual follow-up and the report lists what automation could not test. Retests are paid new runs. Mobile and internal network testing are not mentioned.",
      "summary": "TurboPentest sells self-service AI pentests bought as credits online, with three depth tiers and a monthly option. Each test includes a report and a signed attestation letter.",
      "sources": [
        {
          "url": "https://turbopentest.com/pricing",
          "title": "TurboPentest pricing",
          "checked": "2026-11-09"
        },
        {
          "url": "https://turbopentest.com/",
          "title": "TurboPentest homepage",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    },
    {
      "slug": "xbow",
      "name": "XBOW",
      "website": "https://xbow.com/",
      "type": "Autonomous testing platform",
      "delivery": "automated",
      "delivery_note": "The vendor says no human drives the attack: autonomous AI agents test and findings are reviewed before delivery (who reviews is not stated).",
      "scope": {
        "web_app": "yes",
        "api": "yes",
        "cloud": "unknown",
        "network": "unknown",
        "mobile": "unknown",
        "ai_apps": "unknown"
      },
      "pricing_model": "custom quote",
      "prices": [],
      "pricing_note": "Pricing is described as usage-based and scoped to your environment; no unit or amount is published. A $50,000 AWS Marketplace credit package noted on 2026-11-08 was not re-verified today, so it is not listed.",
      "turnaround": {
        "claim": "First validated findings arrive in hours; testing is continuous or on demand.",
        "meaning": "Time to first findings, not a full report.",
        "source": "https://xbow.com/"
      },
      "retesting": {
        "claim": "Retests after a fix are described as free and unlimited.",
        "source": "https://xbow.com/"
      },
      "sample_report": {
        "status": "not published",
        "url": null
      },
      "credentials": [],
      "compliance_mentions": [
        "SOC 2",
        "ISO 27001",
        "ISO 42001",
        "PCI DSS",
        "NIS 2"
      ],
      "integrations": [
        "CI/CD API"
      ],
      "best_fit": "Engineering-led teams that want continuous automated testing of many web apps and APIs, with controls over scope, rate limits and test windows.",
      "tradeoffs": "No price is published and the compliance list on the page does not make clear whether XBOW holds these certifications or supports the frameworks. Scope is web apps and APIs only on the page checked.",
      "summary": "XBOW is an autonomous testing platform that runs many AI agents in parallel against web applications and APIs and validates findings with exploits. Buyers set scope, impact level and testing windows.",
      "sources": [
        {
          "url": "https://xbow.com/",
          "title": "XBOW homepage",
          "checked": "2026-11-09"
        },
        {
          "url": "https://xbow.com/pricing",
          "title": "XBOW pricing",
          "checked": "2026-11-09"
        }
      ],
      "last_checked": "2026-11-09"
    }
  ]
}