# Penetration testing as a service (PTaaS) vs traditional pentesting

Source: https://pentestcompare.com/guides/ptaas-vs-traditional-pentesting/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing as a service explained: how PTaaS platforms, consultancies and automated tools differ in contract, price and retesting, with provider examples.

> **Short answer:** Penetration testing as a service (PTaaS) delivers pentests through an online platform, usually sold as credits or a subscription. Traditional consultancies sell scoped projects with a final report. Automated tools sell software runs. The dataset shows all three, and the labels overlap: several consultancies now sell PTaaS plans.

Penetration testing as a service (PTaaS) is a way of buying pentests through an online platform, where you scope a test, follow findings as testers report them, and request retests. Providers use the term loosely. In the [PentestCompare dataset](/), checked on 9 November 2026, we found three kinds of provider: platforms, consultancies and automated tools. The kinds overlap.

## What is PTaaS?

There is no standard definition of PTaaS, so we describe how providers use the term on their own pages. Cobalt and BreachLock are typed as PTaaS platforms in the dataset. Both give buyers a portal where findings appear during the test. Cobalt says results appear in the platform as testing proceeds. Pen Test Partners, a consultancy, sells a PTaaS plan too: you buy blocks of time, billed in half-day blocks, for tests from half a day to two days, and it describes results in real time with a short report at the end of the test window.

So PTaaS is a delivery and contract model. It does not say who tests or how well.

## How do platforms, consultancies and automated tools differ?

| | PTaaS platform or crowd platform | Traditional consultancy | Automated tool |
|---|---|---|---|
| Examples in the dataset | [Cobalt](/providers/cobalt/), [BreachLock](/providers/breachlock/), [HackerOne](/providers/hackerone/), [Synack](/providers/synack/) | [Pen Test Partners](/providers/pen-test-partners/), [Secure Ideas](/providers/secure-ideas/) | [Horizon3.ai](/providers/horizon3/), [XBOW](/providers/xbow/), [Escape](/providers/escape/) |
| Who tests | Vetted freelancers or researchers, an in-house team, or both with AI agents | Staff of the firm | Software or AI agents |
| How you buy | Credits, annual packages, platform subscriptions | Flat-fee projects, day rates, prepaid credits | Per asset, per test or subscription |
| How you see results | In the platform during the test | Final report; some firms add a portal | In the platform or console |
| Retesting | Often in the platform, with stated windows | Quoted separately in many cases | Often included or re-run on demand |
| Published price | Some (Cobalt, Synack) | Secure Ideas yes; Pen Test Partners no | Horizon3.ai yes; XBOW and Escape no |

The edges blur. Cobalt sells human-led annual tiers and an autonomous pentest. Secure Ideas, a consultancy, sells prepaid credits for what it calls PETaaS. HackerOne sells a human-led product and an agentic product. The [AI vs human guide](/guides/ai-vs-human-pentesting/) covers who does the testing.

## How do contracts and pricing differ?

PTaaS contracts are mostly recurring. Cobalt's Standard, Premium and Enterprise tiers are annual credit packages, and one credit equals 8 hours of testing. Synack bills tests through credits that expire one year after purchase, and it requires a platform subscription, billed separately, with no published price. BreachLock describes Standard, Extended and Extensive tiers with no dollar figures.

Consultancies lean toward scoped projects. Secure Ideas publishes flat-fee starting prices ($8,160, $10,880 and $13,600 for the smallest scope of three test types) and a $340 hourly rate. Pen Test Partners publishes no prices.

Automated tools often sell by asset. Horizon3.ai's unit is a discovered asset such as a server, device or cloud resource, not a test. The [cost guide](/guides/penetration-testing-cost/) has the full table and explains why these units cannot be compared directly.

## How do speed and retesting compare?

Platforms advertise fast starts. Cobalt's annual tiers start within 3, 2 or 1 business days (Standard, Premium, Enterprise), with a footnote that start times vary by engagement type. Pen Test Partners says its PTaaS plan can start immediately, and gives no time for standard tests. Secure Ideas says testing usually starts two to four weeks after contracting, followed by one to two weeks of testing.

Retest terms differ more than speed. Cobalt's pricing table gives 6 or 12 months of free retesting by tier, while its FAQ says unlimited on-demand retesting during the contract. HackerOne docs list unlimited retests during the remediation period, typically 30 or 90 days, and older posts say 60 days and two retests. Secure Ideas does not include retesting by default. These statements are the providers' own, and some conflict. Ask for the retest terms in the contract.

## When does each model fit?

Pick the model by how often you test and how you want to work.

- A platform fits teams that test several times a year and want findings in a tracker as they appear. The annual package suits a stable testing calendar.
- A consultancy fits a single, deep, one-off project, or a buyer with a regulatory requirement for a named accredited firm. Pen Test Partners lists NCSC CHECK, which applies to UK public-sector work.
- An automated tool fits frequent testing of many assets or releases, where you accept limited human review.

A consultancy can also be a platform vendor, so ask what the contract delivers before you choose by label.

## What does a PTaaS platform not tell you?

A platform shows how you receive findings. It does not show who found them or how deep the test went. Cobalt describes vetted freelance testers, and its pricing page also lists AI agents and a separate autonomous pentest. BreachLock describes its team as in-house, expert-led and AI-accelerated. HackerOne and Synack draw on crowds of researchers. These are different labor models behind similar portals, and the dataset has no measure of tester quality for any of them.

Check credentials the same way for every model. Cobalt lists CREST accreditation, SOC 2 Type II and ISO 27001 on its Trust Center. BreachLock and Pen Test Partners list CREST on their homepages. Those are vendor claims and describe the company, not the individual tester on your job. Ask who will test your application.

## What should you ask a PTaaS vendor?

1. Is the price a package, a subscription or a per-test fee? What does it cost for the same scope as a one-off?
2. Who tests, and who reviews findings?
3. What happens to unused credits at the end of the term?
4. How long do retests last, and what happens after the window?
5. Can you export a report, and is a sample report available?

The [questions guide](/guides/questions-to-ask-a-pentest-provider/) has the full list. For bug bounty programs, which are a different model, see [bug bounty vs pentest](/guides/bug-bounty-vs-pentest/).

## Questions

### Is PTaaS the same as continuous pentesting?

Not by definition. PTaaS describes a platform and a buying model. Some providers pair it with continuous or on-demand tests, and others sell point-in-time tests through a platform. Read the contract for the test frequency.

### Do PTaaS tests cost less than consultancy projects?

The published prices do not settle it. Units differ: credits, subscriptions and flat fees. Ask each provider for a total for the same scope and compare.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Pen Test Partners: PTaaS service page](https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/)
- [Secure Ideas pricing](https://secureideas.com/pricing)
- [BreachLock homepage](https://www.breachlock.com/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Synack pricing](https://www.synack.com/pricing/)
- [Horizon3.ai NodeZero pricing](https://horizon3.ai/use-case/pricing/)