# AI red teaming companies

Source: https://pentestcompare.com/lists/ai-red-teaming-companies/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

AI red teaming companies that state AI app or LLM testing on their own pages, A to Z, with price, retest and sample report columns, and six checks before you buy.

> **Short answer:** AI red teaming is structured adversarial testing of an AI system to find flaws. Providers vary: some test models, some test the whole application, some test agents and tools. This list shows providers whose own pages state AI app or LLM testing, A to Z, with price, retest and sample report columns and check dates. Ask which of the three a quote covers.

AI red teaming companies sell three different things under one name. The table lists providers whose own pages state AI application or LLM testing, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Black Hills Information Security](https://pentestcompare.com/providers/black-hills-information-security/) | Security consultancy | human-led | yes | unknown | unknown | yes | not published | Not published | Not published | not published |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [Equixly](https://pentestcompare.com/providers/equixly/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published | Revalidates whenever applications and AI systems change; no separate retest policy is stated. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [IOActive](https://pentestcompare.com/providers/ioactive/) | Security consultancy | human-led | unknown | unknown | unknown | yes | not published | Not published | Not published | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [Lakera](https://pentestcompare.com/providers/lakera/) | Application security platform | hybrid | unknown | unknown | unknown | yes | custom quote | Not published | Not published | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [Mindgard](https://pentestcompare.com/providers/mindgard/) | Application security platform | hybrid | unknown | yes | unknown | yes | custom quote | Not published | Teams can retest fixes; Assure re-triggers when the AI system changes. | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [SPLX](https://pentestcompare.com/providers/splx/) | Application security platform | automated | unknown | yes | unknown | yes | custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |

## What does this list include, and how does a provider qualify?

A provider qualifies when its own pages state testing of AI applications or LLM systems. The dataset records that as "yes" in the AI apps column or as an AI and LLM service. We do not score quality, so qualifying means "states the service". The list is not a ranking, and no provider pays for a position.

NIST AI 600-1 defines red teaming as "A structured testing exercise used to probe an AI system to find flaws and vulnerabilities such as inaccurate, harmful, or discriminatory outputs, often in a controlled environment and in collaboration with system developers." Providers use the word for work that differs a lot.

| Type of work | What is tested | Example question |
|---|---|---|
| Model red teaming | The model's outputs and safety behavior | Can a prompt produce harmful content? |
| AI application testing | The app around the model: prompts, retrieval, auth, data | Can one user read another user's documents? |
| Agent and tool testing | Actions the system can take through tools | Can injected text make the agent call a tool it should not? |

OWASP's GenAI Red Teaming Guide names four areas: model evaluation, implementation testing, infrastructure assessment and runtime behavior analysis.

## Who does this list help?

It helps teams that ship an LLM feature, a copilot, a retrieval system or an agent, and need an outside test. It also helps security teams that answer customer questions about AI risk. Teams that only call a hosted model through a plain API may need an application test and not a model test.

For the narrative comparison and how to choose, read [AI red teaming providers](/guides/ai-red-teaming-providers/). For plain AI pentest providers, see [AI penetration testing companies](/lists/ai-penetration-testing-companies/).

## What should you ask AI red teaming providers?

Ask for these answers in writing before you sign.

| Question | Why it matters |
|---|---|
| Is the quote for the model, the application or the agent? | The three need different skills. |
| Which risk list do findings map to? | OWASP's LLM Top 10 gives a shared language. |
| Which steps involve a person? | Microsoft's AI red team states that AI red teaming is not safety benchmarking. |
| How do you keep test traffic from hitting paid APIs or real users? | Cost and safety limits belong in the scope. |
| Do you retest after fixes? | Compare the Retest column below with the quote. |
| What does the report show for each finding? | Ask for the prompt, the response and the steps to reproduce. |

Our guide [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) has the longer list.

## What drives the price?

Price follows the number of models, tools, data sources and user roles in scope, the depth of testing and the retest terms. Many providers quote after scoping. The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact. See [penetration testing cost](/guides/penetration-testing-cost/) for the ranges we sourced.

## How do you read the table?

Open a provider row for its sources and the date we checked them. The AI apps column shows "yes" only where the provider names that scope. The Sample report column says whether a report is public, on request or not published. Read [how we compare](/methodology/) for the rules. For the service-level view, see [AI and LLM penetration testing](/services/ai-llm-penetration-testing/).

## What are the limits of this list?

The list shows what providers state. It does not show how good their tests are. OWASP's LLM01:2025 entry says that "it is unclear if there are fool-proof methods of prevention for prompt injection", so no test result proves a system is safe. A provider that claims otherwise has gone past the evidence.

Many AI-focused vendors sell software and not a scoped test. Read the type column before you compare quotes. The EU AI Act uses the term "adversarial testing" in Article 55(1)(a), and we did not find a rule that names red teaming for all AI systems.

## Questions

### What is the difference between AI red teaming and an AI pentest?

The terms overlap. NIST describes red teaming as a structured testing exercise that probes an AI system for flaws such as harmful outputs. Many buyers use AI pentest for security flaws in the whole application. Read the scope, not the label.

### Does a law require AI red teaming?

We did not find a general rule that names it. The EU AI Act uses the term adversarial testing in Article 55(1)(a) for providers of general-purpose AI models with systemic risk. Ask counsel whether it applies to you.

### Can prompt injection be fully prevented?

OWASP writes that it is unclear whether fool-proof methods of prevention exist for prompt injection. Testing finds weaknesses in your build today and cannot prove that none remain.

### Do automated red teaming tools replace a human team?

Microsoft's AI red team writes that AI red teaming is not safety benchmarking, and that its work pushes beyond model-level benchmarks by emulating real-world attacks on end-to-end systems. Ask any provider which steps involve a person.

## Sources

- [NIST AI 600-1: Generative AI Profile](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)
- [Microsoft AI Red Team: Lessons From Red Teaming 100 Generative AI Products (arXiv 2501.07238)](https://arxiv.org/abs/2501.07238)
- [OWASP GenAI Red Teaming Guide](https://genai.owasp.org/resource/genai-red-teaming-guide/)
- [OWASP Top 10 for LLM Applications 2025 (LLM01 Prompt Injection)](https://owasp.github.io/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf)
- [Regulation (EU) 2024/1689 (EU AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [PentestCompare provider dataset (each row links to its provider sources)](https://pentestcompare.com/methodology/)