# Compare penetration testing providers

Source: https://pentestcompare.com/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Compare pentest providers on testing scope, human or automated delivery, published prices and units, turnaround, retesting and sample reports. Sourced and dated.

Pentest provider comparison · Published by Excession Labs
Compare penetration testing providers on the facts that change the result
What each provider tests, who or what does the testing, published prices with their units, turnaround, retesting and sample reports. Every fact links to the provider's own page and the date we checked it.
Sorted A–Z, not rankedUnknown means "not published"No paid placementHow we compare

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | AI-assisted testing service | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |

What to check before price

DeliveryWho does the testing?Human-led means named testers do the work, with tools. Automated means software runs the test. Hybrid mixes both: for example an AI agent with human review, or a platform with a pentester. The difference shows up most in business logic and access control.
ScopeDoes it test what you have?Check each surface you need: web app, API, cloud, network, mobile or AI features. A provider that tests networks well may not test multi-tenant SaaS authorization at all.
Price unitsWhat does the price buy?One test, a year of scans, a number of credits or a monthly subscription. Check what is included: retest, report letter, readout call. Cost guide

Send every provider the same scopeQuotes only compare when the scope matches. The scoping checklist collects what providers ask for: hosts, roles, API size, environments, deadlines and report needs. It produces a summary you can paste into each request. Nothing leaves your browser.Open the scoping checklist
Buyer guides

How much does a penetration test cost?
Pentest providers for startups
Providers for SOC 2 evidence
AI vs human pentesting
PTaaS vs traditional pentesting
Judge a provider by its sample report

All guides · Head-to-head comparisons

Disclosure: we sell pentests tooExcession Labs publishes PentestCompare and also sells penetration testing. We are listed as one provider, under the same rules as everyone else. We are not placed first, and our unknowns say "not published" like any other.If you want to talk to us about your own test, that is a separate, clearly labeled form: contact Excession Labs. It does not go to the other providers.
Use the datasetThe full table is available as JSON and CSV under CC BY 4.0, with sources and check dates for every field. Found something wrong or out of date? Send a correction.

## Questions

### Who publishes PentestCompare?

Excession Labs, which also sells penetration testing and appears in the table as one provider. We disclose this on every page. The table is sorted alphabetically, not ranked, and every profile uses the same fields and rules. [Methodology](/methodology/)

### Why do some cells show a question mark?

A question mark means the provider does not say on its public pages. It does not mean no. We do not guess or estimate missing values. If you know a published source, [send a correction](/methodology/#corrections).

### Can I compare the prices directly?

Only with care. Providers price per test, per year, per month or with credits, and an automated scan is a different product from a manual engagement. Read the unit and what the price covers in each profile. The [cost guide](/guides/penetration-testing-cost/) explains the pricing models.

### How often is the data checked?

Each profile shows the date we last checked the provider's own pages, and every fact links to its source. We recheck when a provider asks for a correction and when we update the guides.

### Do providers pay to be listed?

No. Providers do not pay for listings, placement or clicks, and we do not use affiliate links.