Penetration testing provider directory

Every page in the directory filters the same sourced dataset. Pages appear only where enough providers match to make a useful comparison.

By service#

• API penetration testing companies: who states API scope 48 providersAPI penetration testing companies compared from their own pages: API scope, published price, retest terms and sample reports, with six questions to ask first.
• Cloud penetration testing companies for AWS, Azure, GCP 45 providersCloud penetration testing companies from one sourced dataset, A to Z, with what AWS, Microsoft and Google allow, what to scope and what to ask each provider.
• IoT penetration testing companies: compared 20 providersIoT penetration testing companies from one sourced dataset, A to Z. See what a device test covers, the ETSI EN 303 645 baseline and what to ask each provider.
• LLM penetration testing companies: who tests AI apps 44 providersLLM penetration testing providers in one sourced table, A to Z, with a scope split of model, app, agent and infrastructure and six questions to ask each.
• Mobile app penetration testing companies 41 providersMobile app penetration testing companies from their own pages, A to Z, with price, retest and sample report columns, plus OWASP MASVS scoping questions.
• Network penetration testing companies: compared by scope 47 providersNetwork penetration testing services compared from provider pages: internal vs external scope, segmentation, Active Directory, price drivers and questions to ask.
• OT and ICS penetration testing companies: compared 12 providersICS and OT penetration testing companies from one sourced dataset, A to Z. Six safety questions, the NIST and IEC 62443 references and what to scope first.
• Physical penetration testing companies: who offers it 8 providersPhysical penetration testing companies whose own pages state the service, with authorization letter, scope rules, price drivers and questions to ask before a site test.
• Red teaming companies: compared, with sources 43 providersRed team services compared from each provider's own pages, with the NIST definition, rules of engagement to agree, price drivers and seven questions to ask first.
• Social engineering testing companies: compared 26 providersSocial engineering penetration testing providers compared from their own pages, with rules of engagement, phishing and vishing scope, price drivers and questions.
• Source code review services 20 providersSource code review providers from their own pages, A to Z, with price, retest and sample report columns, and how manual review differs from SAST tools.
• Vulnerability assessment services: providers compared 17 providersVulnerability assessment services in one sourced table, A to Z, with price, retest and report facts, plus six questions to ask before you buy a scan or review.
• Web application penetration testing companies compared 59 providersWeb application penetration testing companies in one sourced table, A to Z, with price, retest and sample report facts plus six questions to ask each one.
• Wireless penetration testing companies: compared 15 providersWireless penetration testing providers compared from their own pages: on-site work, SSID and guest network segmentation, rogue access points, price drivers.

By compliance framework#

• CMMC penetration testing companies: compared 7 providersCMMC penetration testing companies whose own pages mention CMMC, with what Level 2 and Level 3 say about pentests, CUI handling questions and price drivers.
• DORA penetration testing companies 8 providersDORA penetration testing providers that mention DORA on their own pages, A to Z, with sources and dates, plus TLPT versus yearly testing in plain words.
• FedRAMP penetration testing companies: compared 4 providersFedRAMP penetration testing companies in one sourced table, A to Z, with the 3PAO rule, what providers state and six questions to ask before you hire.
• GDPR penetration testing companies: compared 13 providersGDPR penetration testing companies from one sourced dataset, A to Z. Article 32 in plain words, data handling questions and what to ask before you sign.
• HIPAA penetration testing companies: compared 20 providersHIPAA penetration testing companies whose own pages mention HIPAA, with the BAA, PHI and evidence questions to ask and what the Security Rule does and does not say.
• ISO 27001 penetration testing companies: compared 29 providersISO 27001 penetration testing companies compared from their own pages. ISO 27001 names no pentest, so see what Annex A asks for and what auditors check in a report.
• PCI DSS penetration testing companies: compared 29 providersPCI DSS penetration testing companies in one sourced table, A to Z, with a segmentation checklist, independence rules and six checks to run before you sign.
• SOC 2 penetration testing companies 30 providersSOC 2 penetration testing companies that name SOC 2 on their own pages, A to Z, with sources and dates, plus what auditors check in a pentest report.

By country#

• Penetration testing companies in Canada 4 providersPenetration testing companies headquartered in Canada, A to Z, with published prices, CREST claims and sample reports from their own pages, and six checks.
• Penetration testing companies in Germany: sourced list 3 providersPenetration testing companies headquartered in Germany, A to Z, with sources, plus how we assign country, report language and data location checks to run.
• Penetration testing companies in the USA: sourced list 14 providersPenetration testing companies in the USA, listed A to Z from the PentestCompare dataset with published prices, sample reports and sources, checked 9 November 2026.
• Penetration testing UK: companies compared, CREST and CHECK 3 providersPenetration testing UK companies from one sourced dataset, A to Z, matched by HQ country. CHECK explained from NCSC text, with what to ask and how to read the table.

Lists#

• AI penetration testing companies: who does what 21 providersAI penetration testing companies from one sourced dataset, A to Z, split into AI-driven testing and testing of AI apps, with price, retest and sample report fields.
• AI red teaming companies 44 providersAI red teaming companies that state AI app or LLM testing on their own pages, A to Z, with price, retest and sample report columns, and six checks before you buy.
• Boutique penetration testing firms: who they are 28 providersBoutique penetration testing firms listed A to Z from the PentestCompare dataset, with how we define boutique, trade-offs against platforms and five checks.
• CREST penetration testing companies: checked list, Nov 2026 16 providersPenetration testing companies that state CREST status on their own pages, with what CREST accreditation covers, five checks to run on the CREST register, and its limits.
• Pentest companies with published prices: Nov 2026 list 21 providersPentest companies that publish a price, A to Z, with the price, its unit and the source page for each, checked 9 November 2026. Most firms still quote on request.
• Pentest sample reports: public examples from providers 15 providersPenetration testing sample report links from providers that publish one, with the check date, what to read in each report, and who sends one on request instead.
• PTaaS providers: platforms compared 9 providersPTaaS providers compared from their own pages: delivery, published price, retest terms and sample reports, plus what PTaaS means in a contract. Checked Nov 2026.

Missing a provider? List your company for free, or download the full dataset as CSV or JSON.