Pentest buyer guides
Buyer guides for penetration testing: cost and pricing models, providers for startups and SOC 2, AI vs human testing, PTaaS, and how to judge sample reports.
Guides for people choosing a penetration testing provider. They use the provider dataset and primary sources, and they say where the evidence stops.
Testing types
AI red teaming companies: who tests LLM apps and agentsAI red teaming companies that test LLM apps and agents: eight dataset providers, the publisher and two specialists, with scope, method and sources. Nov 2026.Bug bounty vs pentest: how to chooseBug bounty vs pentest compared on payment, tester count, coverage, audit use and retests, with quotes from Bugcrowd and HackerOne docs, checked Nov 2026.Pentest vs vulnerability scan: which one do you need?Pen test vs vulnerability scan: what each does, how NIST defines them, how PCI DSS 11.3 (scans) differs from 11.4 (pentests), and a table to pick one.
Delivery models
AI vs human pentesting: what 15 providers say they doAI vs human pentesting across 15 providers: who sorts into human-led, hybrid and automated by their own words, the tradeoffs, and where human judgment still matters.Automated penetration testing tools: four categories, namedAutomated penetration testing tools in four types: autonomous platforms, AI pentest services, AI-assisted DAST and open-source agents, with sourced prices.Penetration testing as a service (PTaaS) vs traditional pentestingPenetration testing as a service explained: how PTaaS platforms, consultancies and automated tools differ in contract, price and retesting, with provider examples.
Comparisons
Cobalt alternatives for penetration testingCobalt.io alternatives for pentesting, grouped by need: published per-test prices, human-led testing, fast automated tests. Sources checked 9 November 2026.Cobalt vs HackerOne for penetration testingCobalt vs HackerOne pentest compared on delivery, scope, pricing, turnaround, retests, sample reports and credentials, with vendor sources checked on 9 November 2026.HackerOne pentest alternativesHackerOne pentest alternatives grouped by need: published prices, a sample report, set retest terms, or a consultancy. Sourced from vendor pages on 9 November 2026.Synack vs Cobalt for penetration testingSynack vs Cobalt compared on delivery, scope, price units, turnaround, retests, sample reports and credentials, with vendor sources checked on 9 November 2026.XBOW alternatives for autonomous and AI-assisted pentestingXBOW alternatives grouped by need: a published price, a sample report, a human reviewer, or network coverage. Facts sourced from vendor pages on 9 November 2026.XBOW vs Horizon3 NodeZeroXBOW vs Horizon3 NodeZero compared: an autonomous web and API agent vs a network-first platform with a web module. Prices, units and sources checked 9 Nov 2026.
Choosing a provider
How to judge a pentest provider by its sample reportNine signals to check in a pentest sample report before you buy, plus which of 14 providers publish one, with links and the date we checked them.Penetration testing for startups: how to choose a providerPenetration testing for startups: which delivery type fits which need, tradeoffs of 15 providers from published data, and what evidence to ask for before you buy.Questions to ask a pentest provider before you sign24 questions to ask a pentest provider, grouped by scope, people, method, report, retest and contract. Each has the reason to ask and a good answer signal.SOC 2 penetration testing providers: what to compareSOC 2 penetration testing providers compared on sample reports, credentials and retest terms, with the AICPA wording and the evidence to request.
Cost and pricing
More: head-to-head comparisons · glossary · scoping checklist
Prepare before you talk to providers
Use the scoping checklist to collect what every provider asks for. You get quotes you can compare.