# Penetration testing provider directory Source: https://pentestcompare.com/directory/ Publisher: Excession Labs (pentestcompare.com) Last updated: 2026-11-09 Browse penetration testing providers by service, compliance framework, country and list. Every listing uses facts from the provider's own pages, with dates. Every page in the directory filters the same sourced dataset. Pages appear only where enough providers match to make a useful comparison. ## By service - [LLM penetration testing companies: who tests AI apps](https://pentestcompare.com/services/ai-llm-penetration-testing/): LLM penetration testing providers in one sourced table, A to Z, with a scope split of model, app, agent and infrastructure and six questions to ask each. - [API penetration testing companies: who states API scope](https://pentestcompare.com/services/api-penetration-testing/): API penetration testing companies compared from their own pages: API scope, published price, retest terms and sample reports, with six questions to ask first. - [Cloud penetration testing companies for AWS, Azure, GCP](https://pentestcompare.com/services/cloud-penetration-testing/): Cloud penetration testing companies from one sourced dataset, A to Z, with what AWS, Microsoft and Google allow, what to scope and what to ask each provider. - [IoT penetration testing companies: compared](https://pentestcompare.com/services/iot-penetration-testing/): IoT penetration testing companies from one sourced dataset, A to Z. See what a device test covers, the ETSI EN 303 645 baseline and what to ask each provider. - [Mobile app penetration testing companies](https://pentestcompare.com/services/mobile-app-penetration-testing/): Mobile app penetration testing companies from their own pages, A to Z, with price, retest and sample report columns, plus OWASP MASVS scoping questions. - [Network penetration testing companies: compared by scope](https://pentestcompare.com/services/network-penetration-testing/): Network penetration testing services compared from provider pages: internal vs external scope, segmentation, Active Directory, price drivers and questions to ask. - [OT and ICS penetration testing companies: compared](https://pentestcompare.com/services/ot-ics-penetration-testing/): ICS and OT penetration testing companies from one sourced dataset, A to Z. Six safety questions, the NIST and IEC 62443 references and what to scope first. - [Physical penetration testing companies: who offers it](https://pentestcompare.com/services/physical-penetration-testing/): Physical penetration testing companies whose own pages state the service, with authorization letter, scope rules, price drivers and questions to ask before a site test. - [Red teaming companies: compared, with sources](https://pentestcompare.com/services/red-teaming/): Red team services compared from each provider's own pages, with the NIST definition, rules of engagement to agree, price drivers and seven questions to ask first. - [Social engineering testing companies: compared](https://pentestcompare.com/services/social-engineering-testing/): Social engineering penetration testing providers compared from their own pages, with rules of engagement, phishing and vishing scope, price drivers and questions. - [Source code review services](https://pentestcompare.com/services/source-code-review/): Source code review providers from their own pages, A to Z, with price, retest and sample report columns, and how manual review differs from SAST tools. - [Vulnerability assessment services: providers compared](https://pentestcompare.com/services/vulnerability-assessment/): Vulnerability assessment services in one sourced table, A to Z, with price, retest and report facts, plus six questions to ask before you buy a scan or review. - [Web application penetration testing companies compared](https://pentestcompare.com/services/web-application-penetration-testing/): Web application penetration testing companies in one sourced table, A to Z, with price, retest and sample report facts plus six questions to ask each one. - [Wireless penetration testing companies: compared](https://pentestcompare.com/services/wireless-penetration-testing/): Wireless penetration testing providers compared from their own pages: on-site work, SSID and guest network segmentation, rogue access points, price drivers. ## By compliance framework - [CMMC penetration testing companies: compared](https://pentestcompare.com/compliance/cmmc/): CMMC penetration testing companies whose own pages mention CMMC, with what Level 2 and Level 3 say about pentests, CUI handling questions and price drivers. - [DORA penetration testing companies](https://pentestcompare.com/compliance/dora/): DORA penetration testing providers that mention DORA on their own pages, A to Z, with sources and dates, plus TLPT versus yearly testing in plain words. - [FedRAMP penetration testing companies: compared](https://pentestcompare.com/compliance/fedramp/): FedRAMP penetration testing companies in one sourced table, A to Z, with the 3PAO rule, what providers state and six questions to ask before you hire. - [GDPR penetration testing companies: compared](https://pentestcompare.com/compliance/gdpr/): GDPR penetration testing companies from one sourced dataset, A to Z. Article 32 in plain words, data handling questions and what to ask before you sign. - [HIPAA penetration testing companies: compared](https://pentestcompare.com/compliance/hipaa/): HIPAA penetration testing companies whose own pages mention HIPAA, with the BAA, PHI and evidence questions to ask and what the Security Rule does and does not say. - [ISO 27001 penetration testing companies: compared](https://pentestcompare.com/compliance/iso-27001/): ISO 27001 penetration testing companies compared from their own pages. ISO 27001 names no pentest, so see what Annex A asks for and what auditors check in a report. - [PCI DSS penetration testing companies: compared](https://pentestcompare.com/compliance/pci-dss/): PCI DSS penetration testing companies in one sourced table, A to Z, with a segmentation checklist, independence rules and six checks to run before you sign. - [SOC 2 penetration testing companies](https://pentestcompare.com/compliance/soc-2/): SOC 2 penetration testing companies that name SOC 2 on their own pages, A to Z, with sources and dates, plus what auditors check in a pentest report. ## By country - [Penetration testing companies in Canada](https://pentestcompare.com/locations/canada/): Penetration testing companies headquartered in Canada, A to Z, with published prices, CREST claims and sample reports from their own pages, and six checks. - [Penetration testing companies in Germany: sourced list](https://pentestcompare.com/locations/germany/): Penetration testing companies headquartered in Germany, A to Z, with sources, plus how we assign country, report language and data location checks to run. - [Penetration testing UK: companies compared, CREST and CHECK](https://pentestcompare.com/locations/united-kingdom/): Penetration testing UK companies from one sourced dataset, A to Z, matched by HQ country. CHECK explained from NCSC text, with what to ask and how to read the table. - [Penetration testing companies in the USA: sourced list](https://pentestcompare.com/locations/united-states/): Penetration testing companies in the USA, listed A to Z from the PentestCompare dataset with published prices, sample reports and sources, checked 9 November 2026. ## Lists - [AI penetration testing companies: who does what](https://pentestcompare.com/lists/ai-penetration-testing-companies/): AI penetration testing companies from one sourced dataset, A to Z, split into AI-driven testing and testing of AI apps, with price, retest and sample report fields. - [AI red teaming companies](https://pentestcompare.com/lists/ai-red-teaming-companies/): AI red teaming companies that state AI app or LLM testing on their own pages, A to Z, with price, retest and sample report columns, and six checks before you buy. - [Boutique penetration testing firms: who they are](https://pentestcompare.com/lists/boutique-penetration-testing-firms/): Boutique penetration testing firms listed A to Z from the PentestCompare dataset, with how we define boutique, trade-offs against platforms and five checks. - [CREST penetration testing companies: checked list, Nov 2026](https://pentestcompare.com/lists/crest-accredited-penetration-testing-companies/): Penetration testing companies that state CREST status on their own pages, with what CREST accreditation covers, five checks to run on the CREST register, and its limits. - [Pentest companies with published prices: Nov 2026 list](https://pentestcompare.com/lists/pentest-companies-with-published-prices/): Pentest companies that publish a price, A to Z, with the price, its unit and the source page for each, checked 9 November 2026. Most firms still quote on request. - [Pentest sample reports: public examples from providers](https://pentestcompare.com/lists/pentest-companies-with-sample-reports/): Penetration testing sample report links from providers that publish one, with the check date, what to read in each report, and who sends one on request instead. - [PTaaS providers: platforms compared](https://pentestcompare.com/lists/ptaas-providers/): PTaaS providers compared from their own pages: delivery, published price, retest terms and sample reports, plus what PTaaS means in a contract. Checked Nov 2026. Missing a provider? [List your company](/list-your-company/) for free, or download the full dataset as [CSV](/data/providers.csv) or [JSON](/data/providers.json).