# Boutique penetration testing firms: who they are

Source: https://pentestcompare.com/lists/boutique-penetration-testing-firms/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Boutique penetration testing firms listed A to Z from the PentestCompare dataset, with how we define boutique, trade-offs against platforms and five checks.

> **Short answer:** Boutique penetration testing firms are small or specialist consultancies that sell scoped, mostly human-led tests. This list uses the dataset type consultancy, not firm size, because most firms do not publish headcount. The table is sorted A to Z. Check named testers, sample reports, retest terms and price, and compare against platforms for your scope.

Boutique penetration testing firms are specialist consultancies that sell scoped tests, usually done by named people, with a written report. Facts come from the [PentestCompare dataset](/directory/), checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Black Hills Information Security](https://pentestcompare.com/providers/black-hills-information-security/) | Security consultancy | human-led | yes | unknown | unknown | yes | not published | Not published | Not published | not published |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cure53](https://pentestcompare.com/providers/cure53/) | Boutique consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not published. The site says assignments do not end with the report and that critical bugs are usually fixed by report time. | public |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [Include Security](https://pentestcompare.com/providers/include-security/) | Application security consultancy | human-led | yes | yes | unknown | unknown | not published | Report target: a week after the assessment conclusion. | Not published | not published |
| [IOActive](https://pentestcompare.com/providers/ioactive/) | Security consultancy | human-led | unknown | unknown | unknown | yes | not published | Not published | Not published | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [NCC Group](https://pentestcompare.com/providers/ncc-group/) | Security consultancy | human-led | unknown | unknown | yes | unknown | not published | Not published | Not published | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

## What does this list include, and how does a firm qualify?

A firm qualifies when its dataset type contains "consultancy", for example consultancy, security consultancy or penetration testing consultancy. We chose that rule because firm size is rarely published, and any size cut-off would be a guess. The result includes small specialist firms and larger consultancies. Use the table to shortlist, then read each provider page.

The dataset shows mostly human-led delivery for this list. A few firms add platforms or tools, shown as hybrid. Forum threads often ask for a "big four" of pentest firms, but no source we checked defines one, so this page does not.

## Who do boutique firms help?

They help buyers who want a scoped project, direct contact with testers, a deep manual test of one application or a specialist skill such as mobile, hardware or cryptography. They also suit auditors' requests for a clear report with a method section. Buyers who release weekly and want a portal may prefer a platform. See the [PTaaS providers](/lists/ptaas-providers/) list for that model.

## What should you ask a boutique firm?

Ask these five checks, plus the general questions in our [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) guide:

1. Who will test, and what have they published (research, talks, advisories)?
2. Can I see a sample report?
3. What is the retest policy, and how long does it last?
4. What is the lead time before kickoff, and is it written in the quote?
5. What happens if the lead tester is unavailable?

Our guide on [judging a provider by its sample report](/guides/judge-a-pentest-provider-by-its-sample-report/) shows what to look for in the report.

## What drives the price?

Price follows scope (applications, APIs, hosts, user roles), depth, the report format, retest terms and the tester's time. Most firms in the table quote after scoping, and a few publish a price or a starting figure. Compare only for the same scope. See [penetration testing cost](/guides/penetration-testing-cost/) for named published prices.

## How should you read the table?

Each row is that provider's statement, sorted A to Z. "Not published" means we found no statement, not that the item is absent. Many firms publish no price and no turnaround. That is common for custom quotes. The Sample report column helps most with this group: a public report lets you judge the writing before you talk to sales.

Delivery tells you who does the work. Type tells you how the firm describes itself, and that wording varies.

## What are the limits of this list?

The type field is our classification, so a firm with a different label is not here. The list does not rate quality, depth or fit. It does not show team size, because most firms do not publish it. If you spot a missing or wrong entry, tell us through the [correction form on the methodology page](/methodology/). For a general overview, read our [guide to the best penetration testing companies](/guides/best-penetration-testing-companies/).

## Questions

### What is a boutique penetration testing firm?

There is no standard definition. We use the dataset type: a consultancy that sells scoped tests with a report. Headcount is rarely published, so this page does not claim a size limit.

### Are boutique firms better than platforms?

Neither is better in general. Consultancies sell scoped projects with a final report, and platforms sell tests through a portal. Match the model to your scope, your release rhythm and what your auditor accepts.

### How do I check a small firm before I sign?

Read a sample report, ask who will test and what they have published, and ask for the retest terms in writing. Our guide on judging a provider by its sample report gives a checklist.

### Why is a firm I know missing from the list?

The list uses the dataset type. A firm with another type, or one we have not yet researched, does not appear. Use the correction form on the methodology page to report a missing or wrong entry.

## Sources

- [PentestCompare methodology and provider dataset](https://pentestcompare.com/methodology/)