Boutique penetration testing firms: who they are
Boutique penetration testing firms are small or specialist consultancies that sell scoped, mostly human-led tests. This list uses the dataset type consultancy, not firm size, because most firms do not publish headcount. The table is sorted A to Z. Check named testers, sample reports, retest terms and price, and compare against platforms for your scope.
Boutique penetration testing firms are specialist consultancies that sell scoped tests, usually done by named people, with a written report. Facts come from the PentestCompare dataset, checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.
28 of 28 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 7ASecurityBoutique consultancy, Ireland | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and… | Public |
| A-LIGNConsultancy | human-led | Yes | ? | Yes | Yes | ? | ? | Custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests… | not published |
| Bishop FoxOffensive security consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| Black Hills Information SecuritySecurity consultancy, United States | human-led | Yes | ? | ? | ? | ? | Yes | Not published | Not published | Not published | not published |
| Compass SecurityConsultancy, Switzerland | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| Cure53Boutique consultancy, Germany | human-led | Yes | ? | Yes | ? | Yes | ? | Custom quote | Not published | Not published. The site says assignments do not end with the report… | Public |
| Cyberis (Cyberis Reply)Penetration testing and cyber security consultancy | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | not published |
| CYBRIPenetration testing consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | $5,000 starts at, per engagement +3 more | From 5 business days (Web Application and Custom), 10 (Web, API,… | Remediation testing is included in the $9,500 and $20,000 tiers.… | not published |
| DeepStrikePenetration testing consultancy, United States | human-led | Yes | ? | Yes | Yes | Yes | ? | Custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page… | not published |
| DoyensecBoutique consultancy | human-led | Yes | Yes | Yes | ? | Yes | Yes | Custom quote | Not published | Not stated on the homepage or company page. Some public reports are… | Public |
| Include SecurityApplication security consultancy, United States | human-led | Yes | Yes | ? | ? | Yes | ? | Not published | Report target: a week after the assessment conclusion. | Not published | not published |
| IOActiveSecurity consultancy, United States | human-led | ? | ? | ? | ? | ? | Yes | Not published | Not published | Not published | not published |
| JUMPSECConsultancy, United Kingdom | human-led | ? | ? | ? | ? | ? | Yes | Custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually… | not published |
| NCC GroupSecurity consultancy, United Kingdom | human-led | ? | ? | Yes | Yes | ? | ? | Not published | Not published | Not published | not published |
| PacketlabsPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | The homepage says Packetlabs supports security teams with retesting;… | on request |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| Pen Test PartnersConsultancy | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | PTaaS: scoped within minutes and can start immediately; results in… | Not published | not published |
| Prescient SecurityConsultancy | hybrid | Yes | Yes | Yes | Yes | Yes | ? | from $6,000 per engagement (scope-based) +5 more | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms… | not published |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
| Software SecuredConsultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner;… | Request retesting within 12 months of report delivery;… | not published |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| SySSConsultancy, Germany | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published. A Quick Penetration Test option can start right after… | A retest after fixes confirms the fixes work and checks for new… | not published |
| TrustedSecSecurity consultancy, United States | human-led | ? | ? | Yes | ? | ? | Yes | Not published | Not published | Not published | not published |
| usd AGConsultancy, Germany | human-led | ? | ? | Yes | ? | Yes | Yes | Custom quote | Not published | Not published | not published |
| VumetricPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Most penetration tests can be performed within a couple of days, but… | Not stated | on request |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does this list include, and how does a firm qualify?#
A firm qualifies when its dataset type contains "consultancy", for example consultancy, security consultancy or penetration testing consultancy. We chose that rule because firm size is rarely published, and any size cut-off would be a guess. The result includes small specialist firms and larger consultancies. Use the table to shortlist, then read each provider page.
The dataset shows mostly human-led delivery for this list. A few firms add platforms or tools, shown as hybrid. Forum threads often ask for a "big four" of pentest firms, but no source we checked defines one, so this page does not.
Who do boutique firms help?#
They help buyers who want a scoped project, direct contact with testers, a deep manual test of one application or a specialist skill such as mobile, hardware or cryptography. They also suit auditors' requests for a clear report with a method section. Buyers who release weekly and want a portal may prefer a platform. See the PTaaS providers list for that model.
What should you ask a boutique firm?#
Ask these five checks, plus the general questions in our questions to ask a pentest provider guide:
- Who will test, and what have they published (research, talks, advisories)?
- Can I see a sample report?
- What is the retest policy, and how long does it last?
- What is the lead time before kickoff, and is it written in the quote?
- What happens if the lead tester is unavailable?
Our guide on judging a provider by its sample report shows what to look for in the report.
What drives the price?#
Price follows scope (applications, APIs, hosts, user roles), depth, the report format, retest terms and the tester's time. Most firms in the table quote after scoping, and a few publish a price or a starting figure. Compare only for the same scope. See penetration testing cost for named published prices.
How should you read the table?#
Each row is that provider's statement, sorted A to Z. "Not published" means we found no statement, not that the item is absent. Many firms publish no price and no turnaround. That is common for custom quotes. The Sample report column helps most with this group: a public report lets you judge the writing before you talk to sales.
Delivery tells you who does the work. Type tells you how the firm describes itself, and that wording varies.
What are the limits of this list?#
The type field is our classification, so a firm with a different label is not here. The list does not rate quality, depth or fit. It does not show team size, because most firms do not publish it. If you spot a missing or wrong entry, tell us through the correction form on the methodology page. For a general overview, read our guide to the best penetration testing companies.
Questions
What is a boutique penetration testing firm?
There is no standard definition. We use the dataset type: a consultancy that sells scoped tests with a report. Headcount is rarely published, so this page does not claim a size limit.
Are boutique firms better than platforms?
Neither is better in general. Consultancies sell scoped projects with a final report, and platforms sell tests through a portal. Match the model to your scope, your release rhythm and what your auditor accepts.
How do I check a small firm before I sign?
Read a sample report, ask who will test and what they have published, and ask for the retest terms in writing. Our guide on judging a provider by its sample report gives a checklist.
Why is a firm I know missing from the list?
The list uses the dataset type. A firm with another type, or one we have not yet researched, does not appear. Use the correction form on the methodology page to report a missing or wrong entry.
Sources
- PentestCompare methodology and provider dataset (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.