Best penetration testing companies: a sourced shortlist by need
No single penetration testing company is best for everyone. This page lists 66 providers A to Z, grouped by need: web and API testing, SaaS and SOC 2, human-led consultancies, AI-assisted testing, crowdsourced platforms and published prices. Each row comes from the provider's own pages, checked 9 November 2026, with units and 'Not published' where a page is silent.
The best penetration testing companies depend on what you need to test, who must do the testing and what evidence you must keep. This page does not rank anyone. It lists the 66 providers in our dataset, A to Z within each need, with facts taken from each provider's own pages on 9 November 2026. Of the 66, 32 are human-led, 15 are automated and 19 are hybrid, by the delivery field in our data.
Which penetration testing companies suit which need?#
Start with the need, then open the matching section. Every list is alphabetical.
| If you need | Look at | Providers listed |
|---|---|---|
| A test of a web app or API | Section on web app and API testing | 58 for web apps, 47 for APIs |
| SOC 2 evidence for a SaaS company | Section on SaaS and SOC 2 | 29 mention SOC 2 |
| A written report from human testers | Section on consultancies | 28 boutique firms |
| Fast, repeatable AI-assisted tests | Section on AI-assisted and automated testing | 20 |
| A platform with on-demand tests | Section on PTaaS and crowdsourced platforms | 9 PTaaS providers |
| A price before a sales call | Section on published prices | 21 |
Counts use this site's filters and the dataset as of 9 November 2026. A provider can appear in several rows.
How did we build this shortlist?#
Every provider in the dataset is listed, so nobody is left out for paying less. We read each provider's own public pages (pricing, product, docs and contact pages), record what they state, and write "Not published" where a page is silent. Each row carries the date we checked it. The methodology page lists the fields and the correction route.
Excession Labs publishes this site. We disclose it here and do not rank, recommend or sell on this page.
We do not use paid placement, reader polls or third-party price estimates. Reseller figures such as a "median pentest price" are not vendor prices, so we leave them out. A firm missing from the dataset is not a judgment. Send a correction or a suggestion to add one.
Which firms do buyers name most?#
AI assistants and listicles often name the same eight firms. Each is in our dataset. The table shows only what their pages state.
| Firm | Delivery | Published price | Retest | Turnaround |
|---|---|---|---|---|
| Bishop Fox | Human-led | Not published | Not published | Not published |
| Cobalt | Hybrid | Autonomous Pentest (limited-time offer): $3,500 per test | Free for 6 months (Standard) or 12 months (Premium, Enterprise) in the table; FAQ says unlimited during the term | Autonomous Pentest: findings in 24 hours; annual tiers start in 3, 2 or 1 business days |
| HackerOne | Hybrid | Not published (custom quote) | Unlimited retests during the remediation period (typically 30 or 90 days), per docs | Final report 3 to 5 business days after testing ends, per docs |
| Bugcrowd | Hybrid | Not published (custom quote) | Standard: one year of retesting with one report revision | Tests launch in under 72 hours |
| NCC Group | Human-led | Not published | Not published | Not published |
| NetSPI | Human-led | Not published | Not published | Not published |
| Synack | Hybrid | Sara Pentest $5,085; SynackST $10,283; Synack14 $27,120 (all per test, starting price) | Patch verification listed as included in each product | Test windows 4 to 5 business days (Sara), 5 days (SynackST), 14 days (Synack14) |
| TrustedSec | Human-led | Not published | Not published | Not published |
Sources: Bishop Fox, Cobalt, HackerOne, Bugcrowd, NCC Group, NetSPI, Synack, TrustedSec, checked 9 November 2026. "Not published" means the pages we read are silent, not that the firm has no policy.
Which companies test web apps and APIs?#
Web application testing is the most common scope: 58 of 66 providers are recorded as covering web apps, and 47 as covering APIs. Because nearly every provider qualifies, scope alone does not narrow the list. Narrow by who tests, what you can prove afterward, and the price unit.
For web apps and APIs, ask for the test method (authenticated, role-based, business logic), a sample report and the retest terms. The questions to ask a pentest provider guide has the full list. Browse the directory by service for web application, API, cloud, network, mobile and other testing.
Which providers suit SaaS startups and SOC 2 buyers?#
SaaS buyers usually need a report for a customer or an auditor, a short start time and a price they can plan for. Our startup guide and SOC 2 guide cover this in depth. We count 29 providers whose pages mention SOC 2; browse the compliance directory to see them. A mention is not a statement that an auditor will accept the report. Ask your auditor first.
Which companies are consultancies with human-led testing?#
A boutique or consultancy firm sells a scoped engagement and a written report from named testers. We record 28 providers with a consultancy type. They usually quote after scoping, so a price column is often "Not published". Bishop Fox, NCC Group, NetSPI and TrustedSec appear in the earlier table. The full alphabetical list is in the provider directory.
For how consultancies and platforms differ, read PTaaS vs traditional pentesting.
Which companies offer AI-assisted or automated testing?#
Our dataset lists 20 providers of autonomous or AI-assisted testing, from web-focused agents to network-first platforms. They differ in scope, human review and price unit, so test two of them on the same target before you commit.
21 of 21 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| DetectifyApplication security platform | automated | Yes | Yes | ? | ? | ? | ? | from EUR 0 per year (annual platform fee) +4 more | Not published | Not stated on the pricing page. | not published |
| EquixlyAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Revalidates whenever applications and AI systems change; no separate… | not published |
| EscapeApplication security platform, France | automated | Yes | Yes | ? | Yes | ? | Yes | Custom quote | Continuous AI pentesting: results in minutes on merge, deploy or… | Open issues are re-checked; external network pentesting is followed… | not published |
| Excession LabsPublisherSecurity lab (AI-assisted testing) | hybrid | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | Public |
| GiskardAI-assisted testing service, France | hybrid | ? | Yes | ? | ? | ? | Yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| HadrianAutonomous testing platform, Netherlands | hybrid | Yes | ? | ? | ? | ? | ? | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| Horizon3.ai (NodeZero)Autonomous testing platform, United States | automated | Yes | Yes | Yes | Yes | ? | ? | $15 per asset, per test (12-month term) +4 more | Not published as a time. WebApp page says tests can be set up… | Findings include fix actions with one-click verify. On Core, Pro and… | not published |
| IntruderApplication security platform, United Kingdom | automated | Yes | ? | ? | ? | ? | ? | $3,500 per test +2 more | Setup in minutes; results within hours; the pricing page says… | Unlimited retesting on the single test and the 4-pack. Packs expire… | not published |
| NoveeAutonomous testing platform | automated | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code… | not published |
| ParameterAI-assisted testing service | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher… | Public |
| PenligentAI-assisted testing service | automated | Yes | ? | ? | Yes | ? | ? | $0 per month +2 more | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk… | Public |
| PenteraAutonomous testing platform | hybrid | Yes | Yes | Yes | Yes | ? | ? | Custom quote | Not published | Remediation is followed by re-testing; the FAQ says it revalidates… | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| RunSybilAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | Custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and… | on request |
| SPLXApplication security platform | automated | ? | Yes | ? | ? | ? | Yes | Custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| StrixAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or… | not published |
| Terra SecurityAI-assisted testing service | hybrid | Yes | ? | ? | Yes | ? | Yes | Custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus… | Not published | not published |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
| XBOWAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First validated findings arrive in hours; testing is continuous or… | Retests after a fix are described as free and unlimited. | not published |
| ZeroThreatAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | $100 per target per month +2 more | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting… | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
Read AI penetration testing services and AI vs human pentesting before you pick. Automated pentesting tools shows where automation stops.
Which companies run PTaaS or crowdsourced platforms?#
PTaaS sells tests through a portal with findings, retests and chat. Crowdsourced platforms draw on a pool of researchers. In our dataset, 9 providers have a PTaaS or crowdsourced type.
9 of 9 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Astra SecurityPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $2,999 per year (card also shows $199 per month) +3 more | Manual pentest: 10-15 working days. Pentest Auto: first report the… | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… | not published |
| BreachLockPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive).… | on request |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| CobaltPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within… | Comparison table: free retesting for 6 months (Standard) or 12… | on request |
| HackerOneCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Product page gives no start time or test length. HackerOne docs list… | Retesting is included after remediation. Docs say unlimited retests… | not published |
| Halo SecurityPTaaS platform | hybrid | Yes | Yes | ? | Yes | Yes | ? | Custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues… | not published |
| NetSPIPenetration testing as a service (PTaaS) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| Outpost24PTaaS platform | hybrid | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT… | Snapshot and Assure each include a 60-day retest window. SWAT checks… | not published |
| SynackCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $5,085 per test (starting price) +2 more | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days… | Patch verification is listed as included in each product; the… | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
Which companies publish a price?#
21 of 66 providers publish at least one price. The units are not the same, so a lower number is not a lower cost.
21 of 21 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| Astra SecurityPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $2,999 per year (card also shows $199 per month) +3 more | Manual pentest: 10-15 working days. Pentest Auto: first report the… | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… | not published |
| CobaltPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within… | Comparison table: free retesting for 6 months (Standard) or 12… | on request |
| CYBRIPenetration testing consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | $5,000 starts at, per engagement +3 more | From 5 business days (Web Application and Custom), 10 (Web, API,… | Remediation testing is included in the $9,500 and $20,000 tiers.… | not published |
| DetectifyApplication security platform | automated | Yes | Yes | ? | ? | ? | ? | from EUR 0 per year (annual platform fee) +4 more | Not published | Not stated on the pricing page. | not published |
| GiskardAI-assisted testing service, France | hybrid | ? | Yes | ? | ? | ? | Yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| HadrianAutonomous testing platform, Netherlands | hybrid | Yes | ? | ? | ? | ? | ? | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| Horizon3.ai (NodeZero)Autonomous testing platform, United States | automated | Yes | Yes | Yes | Yes | ? | ? | $15 per asset, per test (12-month term) +4 more | Not published as a time. WebApp page says tests can be set up… | Findings include fix actions with one-click verify. On Core, Pro and… | not published |
| IntruderApplication security platform, United Kingdom | automated | Yes | ? | ? | ? | ? | ? | $3,500 per test +2 more | Setup in minutes; results within hours; the pricing page says… | Unlimited retesting on the single test and the 4-pack. Packs expire… | not published |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| PenligentAI-assisted testing service | automated | Yes | ? | ? | Yes | ? | ? | $0 per month +2 more | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk… | Public |
| Pentest-Tools.comVulnerability scanning and pentest platform | hybrid | Yes | Yes | Yes | Yes | ? | Yes | from $96 per month, 16 assets +3 more | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| Prescient SecurityConsultancy | hybrid | Yes | Yes | Yes | Yes | Yes | ? | from $6,000 per engagement (scope-based) +5 more | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms… | not published |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| StrixAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or… | not published |
| SynackCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $5,085 per test (starting price) +2 more | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days… | Patch verification is listed as included in each product; the… | not published |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
| ZeroThreatAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | $100 per target per month +2 more | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting… | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
Read the penetration testing cost guide for how units differ, and the pricing pages for vendor-by-vendor detail. See also Horizon3 NodeZero pricing and Intruder pricing.
Found an error? Send a correction.
Questions
Are the companies on this page ranked?
No. Every list is in alphabetical order. We do not take payment for placement. Excession Labs publishes this site and is not ranked or recommended here.
How do I choose between a consultancy and a PTaaS platform?
Start with who tests and what you need to keep. A consultancy sells a scoped engagement with a written report. A PTaaS platform sells a portal with ongoing or on-demand tests. Our PTaaS vs traditional pentesting guide compares both.
Why do so many companies show no price?
Most providers quote after scoping. 21 of 66 providers in our dataset publish at least one price, and the units differ: per test, per asset, per month or per year. Never compare a per-test price to a per-asset price directly.
Do you list the firms named by AI assistants?
Where they are in the dataset, yes. Bishop Fox, Cobalt, NCC Group, NetSPI and TrustedSec are. The buyer-named table shows only what each firm's own pages state, with 'Not published' elsewhere. Mandiant, Praetorian and Coalfire are not in the dataset.
Sources
- Pentest provider dataset, how we check (methodology) (checked 9 November 2026)
- Bishop Fox services (checked 9 November 2026)
- NCC Group (checked 9 November 2026)
- NetSPI (checked 9 November 2026)
- TrustedSec services (checked 9 November 2026)
- Cobalt pricing (checked 9 November 2026)
- Synack pricing (checked 9 November 2026)
- HackerOne pricing (checked 9 November 2026)
- Bugcrowd Pen Test as a Service (checked 9 November 2026)