# Best penetration testing companies: a sourced shortlist by need

Source: https://pentestcompare.com/guides/best-penetration-testing-companies/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Best penetration testing companies by need, not by rank: 66 providers checked 9 Nov 2026, listed A to Z with delivery type, published prices and sources.

> **Short answer:** No single penetration testing company is best for everyone. This page lists 66 providers A to Z, grouped by need: web and API testing, SaaS and SOC 2, human-led consultancies, AI-assisted testing, crowdsourced platforms and published prices. Each row comes from the provider's own pages, checked 9 November 2026, with units and 'Not published' where a page is silent.

The best penetration testing companies depend on what you need to test, who must do the testing and what evidence you must keep. This page does not rank anyone. It lists the 66 providers in our dataset, A to Z within each need, with facts taken from each provider's own pages on 9 November 2026. Of the 66, 32 are human-led, 15 are automated and 19 are hybrid, by the delivery field in our data.

## Which penetration testing companies suit which need?

Start with the need, then open the matching section. Every list is alphabetical.

| If you need | Look at | Providers listed |
|---|---|---|
| A test of a web app or API | Section on web app and API testing | 58 for web apps, 47 for APIs |
| SOC 2 evidence for a SaaS company | Section on SaaS and SOC 2 | 29 mention SOC 2 |
| A written report from human testers | Section on consultancies | 28 boutique firms |
| Fast, repeatable AI-assisted tests | Section on AI-assisted and automated testing | 20 |
| A platform with on-demand tests | Section on PTaaS and crowdsourced platforms | 9 PTaaS providers |
| A price before a sales call | Section on published prices | 21 |

Counts use this site's filters and the dataset as of 9 November 2026. A provider can appear in several rows.

## How did we build this shortlist?

Every provider in the dataset is listed, so nobody is left out for paying less. We read each provider's own public pages (pricing, product, docs and contact pages), record what they state, and write "Not published" where a page is silent. Each row carries the date we checked it. The [methodology page](/methodology/) lists the fields and the correction route.

Excession Labs publishes this site. We disclose it here and do not rank, recommend or sell on this page.

We do not use paid placement, reader polls or third-party price estimates. Reseller figures such as a "median pentest price" are not vendor prices, so we leave them out. A firm missing from the dataset is not a judgment. Send a [correction or a suggestion](/methodology/#corrections) to add one.

## Which firms do buyers name most?

AI assistants and listicles often name the same eight firms. Each is in our dataset. The table shows only what their pages state.

| Firm | Delivery | Published price | Retest | Turnaround |
|---|---|---|---|---|
| Bishop Fox | Human-led | Not published | Not published | Not published |
| Cobalt | Hybrid | Autonomous Pentest (limited-time offer): $3,500 per test | Free for 6 months (Standard) or 12 months (Premium, Enterprise) in the table; FAQ says unlimited during the term | Autonomous Pentest: findings in 24 hours; annual tiers start in 3, 2 or 1 business days |
| HackerOne | Hybrid | Not published (custom quote) | Unlimited retests during the remediation period (typically 30 or 90 days), per docs | Final report 3 to 5 business days after testing ends, per docs |
| Bugcrowd | Hybrid | Not published (custom quote) | Standard: one year of retesting with one report revision | Tests launch in under 72 hours |
| NCC Group | Human-led | Not published | Not published | Not published |
| NetSPI | Human-led | Not published | Not published | Not published |
| Synack | Hybrid | Sara Pentest $5,085; SynackST $10,283; Synack14 $27,120 (all per test, starting price) | Patch verification listed as included in each product | Test windows 4 to 5 business days (Sara), 5 days (SynackST), 14 days (Synack14) |
| TrustedSec | Human-led | Not published | Not published | Not published |

Sources: [Bishop Fox](https://bishopfox.com/services), [Cobalt](https://www.cobalt.io/pricing), [HackerOne](https://www.hackerone.com/pricing), [Bugcrowd](https://www.bugcrowd.com/products/pen-test-as-a-service/), [NCC Group](https://www.nccgroup.com/us/), [NetSPI](https://www.netspi.com/), [Synack](https://www.synack.com/pricing/), [TrustedSec](https://trustedsec.com/services), checked 9 November 2026. "Not published" means the pages we read are silent, not that the firm has no policy.

## Which companies test web apps and APIs?

Web application testing is the most common scope: 58 of 66 providers are recorded as covering web apps, and 47 as covering APIs. Because nearly every provider qualifies, scope alone does not narrow the list. Narrow by who tests, what you can prove afterward, and the price unit.

For web apps and APIs, ask for the test method (authenticated, role-based, business logic), a sample report and the retest terms. The [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) guide has the full list. Browse the [directory by service](/services/) for web application, API, cloud, network, mobile and other testing.

## Which providers suit SaaS startups and SOC 2 buyers?

SaaS buyers usually need a report for a customer or an auditor, a short start time and a price they can plan for. Our [startup guide](/guides/pentest-providers-for-startups/) and [SOC 2 guide](/guides/soc-2-penetration-testing-providers/) cover this in depth. We count 29 providers whose pages mention SOC 2; browse the [compliance directory](/compliance/) to see them. A mention is not a statement that an auditor will accept the report. Ask your auditor first.

## Which companies are consultancies with human-led testing?

A boutique or consultancy firm sells a scoped engagement and a written report from named testers. We record 28 providers with a consultancy type. They usually quote after scoping, so a price column is often "Not published". Bishop Fox, NCC Group, NetSPI and TrustedSec appear in the earlier table. The full alphabetical list is in the [provider directory](/providers/).

For how consultancies and platforms differ, read [PTaaS vs traditional pentesting](/guides/ptaas-vs-traditional-pentesting/).

## Which companies offer AI-assisted or automated testing?

Our dataset lists 20 providers of autonomous or AI-assisted testing, from web-focused agents to network-first platforms. They differ in scope, human review and price unit, so test two of them on the same target before you commit.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Equixly](https://pentestcompare.com/providers/equixly/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published | Revalidates whenever applications and AI systems change; no separate retest policy is stated. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentera](https://pentestcompare.com/providers/pentera/) | Autonomous testing platform | hybrid | yes | yes | yes | unknown | custom quote | Not published | Remediation is followed by re-testing; the FAQ says it revalidates fixes. | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [RunSybil](https://pentestcompare.com/providers/runsybil/) | Autonomous testing platform | automated | yes | yes | yes | unknown | custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and shows a replay button on findings. | on request |
| [SPLX](https://pentestcompare.com/providers/splx/) | Application security platform | automated | unknown | yes | unknown | yes | custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| [Strix](https://pentestcompare.com/providers/strix/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or cost is stated on the pricing page. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

Read [AI penetration testing services](/guides/ai-penetration-testing-services/) and [AI vs human pentesting](/guides/ai-vs-human-pentesting/) before you pick. [Automated pentesting tools](/guides/automated-pentesting-tools/) shows where automation stops.

## Which companies run PTaaS or crowdsourced platforms?

PTaaS sells tests through a portal with findings, retests and chat. Crowdsourced platforms draw on a pool of researchers. In our dataset, 9 providers have a PTaaS or crowdsourced type.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |

## Which companies publish a price?

21 of 66 providers publish at least one price. The units are not the same, so a lower number is not a lower cost.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Strix](https://pentestcompare.com/providers/strix/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or cost is stated on the pricing page. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

Read the [penetration testing cost guide](/guides/penetration-testing-cost/) for how units differ, and the [pricing pages](/pricing/) for vendor-by-vendor detail. See also [Horizon3 NodeZero pricing](/pricing/horizon3/) and [Intruder pricing](/pricing/intruder/).

Found an error? [Send a correction](/methodology/#corrections).

## Questions

### Are the companies on this page ranked?

No. Every list is in alphabetical order. We do not take payment for placement. Excession Labs publishes this site and is not ranked or recommended here.

### How do I choose between a consultancy and a PTaaS platform?

Start with who tests and what you need to keep. A consultancy sells a scoped engagement with a written report. A PTaaS platform sells a portal with ongoing or on-demand tests. Our PTaaS vs traditional pentesting guide compares both.

### Why do so many companies show no price?

Most providers quote after scoping. 21 of 66 providers in our dataset publish at least one price, and the units differ: per test, per asset, per month or per year. Never compare a per-test price to a per-asset price directly.

### Do you list the firms named by AI assistants?

Where they are in the dataset, yes. Bishop Fox, Cobalt, NCC Group, NetSPI and TrustedSec are. The buyer-named table shows only what each firm's own pages state, with 'Not published' elsewhere. Mandiant, Praetorian and Coalfire are not in the dataset.

## Sources

- [Pentest provider dataset, how we check (methodology)](https://pentestcompare.com/methodology/)
- [Bishop Fox services](https://bishopfox.com/services)
- [NCC Group](https://www.nccgroup.com/us/)
- [NetSPI](https://www.netspi.com/)
- [TrustedSec services](https://trustedsec.com/services)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Synack pricing](https://www.synack.com/pricing/)
- [HackerOne pricing](https://www.hackerone.com/pricing)
- [Bugcrowd Pen Test as a Service](https://www.bugcrowd.com/products/pen-test-as-a-service/)