# CREST penetration testing companies: checked list, Nov 2026

Source: https://pentestcompare.com/lists/crest-accredited-penetration-testing-companies/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing companies that state CREST status on their own pages, with what CREST accreditation covers, five checks to run on the CREST register, and its limits.

> **Short answer:** This list holds providers whose own pages state a CREST credential, A to Z, with the evidence link in each row's credentials note. CREST accreditation applies to a company's testing service, and CREST states that no individual qualification is mandatory for a company to be accredited. Check each claim on the CREST register before you buy.

CREST penetration testing companies can be checked in one place: the CREST register. This page cannot replace it. We list providers whose own pages state a CREST credential, A to Z with no ranking, and each provider page links the evidence. Facts were checked on 9 November 2026.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Claranet](https://pentestcompare.com/providers/claranet/) | Managed services and cyber security provider | human-led | yes | yes | unknown | unknown | custom quote | Not published | Retesting is included as part of the engagement. | not published |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |

## What does this list include, and how does a provider qualify?

A provider qualifies when its own page or a CREST page states a CREST credential and our dataset records an evidence link for it. Wording varies, and we keep the provider's wording in the credentials note. Some entries say the credential covers certain services, for example penetration testing and vulnerability assessment. One entry notes that CREST "may relate to the human-led option" of its product. Others list CREST as a badge. Read the note on each provider page as well as the row.

## Who does a CREST list help?

It helps buyers whose contract, insurer or customer asks for a CREST firm, and buyers who want a third-party check of a company's testing process. It is less useful if you need one specific skill, such as a mobile app test, because the accreditation applies to a company and a service, not to a tester's skill in your stack.

## What does CREST accreditation not tell you?

It does not tell you who will test your system. CREST says there is no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation. It gives no price or date, and no auditor has to accept a report because of it. For UK public sector work, the NCSC separately runs CHECK. The NCSC says that if your organisation is not public sector, testing does not need to be done by a CHECK provider.

## What five checks should you run?

1. Search the company on the CREST Marketplace and note which services the listing covers.
2. Match the listed service to the service you plan to buy.
3. Ask who will test your system, and ask for their qualifications.
4. Ask for a sample report and read it (see [providers with public sample reports](/lists/pentest-companies-with-sample-reports/)).
5. Ask what retest is included and for how long.

## What drives the price?

Price follows scope, depth of manual work, the number of roles and tenants, and the retest terms. CREST status is one factor. Accreditation has a cost for the firm: CREST lists fees for a firm under 1 million pounds of revenue that add up to 10,500 pounds plus VAT in the first year, by our calculation from its fee page. That says nothing about what you pay. The "Published price" column shows a figure only where a provider lists one. See [penetration testing cost](/guides/penetration-testing-cost/).

## How do you read the table?

The CREST filter picks every provider with a CREST credential note. The other columns describe the provider as a whole. The Type column matters here: some are platforms with a human-led option, so ask whether the CREST service is the one you are buying. Also see [boutique penetration testing firms](/lists/boutique-penetration-testing-firms/).

## What are the limits of this list?

The list covers providers in our dataset only. A firm can be on the CREST register and missing here. A badge we could not link to evidence is not counted, and CREST pages sometimes block automated reads, so an entry rests on the provider's own text and links. The CREST register is the source of truth.

## Questions

### Is CREST required for a penetration test?

Most buyers are not required to use a CREST firm. The UK NCSC says that if your organisation is not public sector, penetration testing does not need to be done by a CHECK provider. CREST is a buyer's choice or a contract term. Check your own contract.

### Are all testers at a CREST firm individually CREST qualified?

No. CREST says there is no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation. Ask who will test your system and what their qualifications are.

### Where do I check a CREST claim?

Use the CREST Marketplace and the CREST member pages. Search the company name and read which services the listing covers. A badge on a provider's site is a claim, not proof.

### What is the CREST AI-Enabled Penetration Testing accreditation?

CREST named a first group of 10 firms on 3 September 2026. CREST stresses professional judgement, quality and human accountability. If a provider cites it, check the CREST listing for that provider.

## Sources

- [CREST Marketplace](https://marketplace.crest.org/)
- [CREST membership FAQs](https://www.crest-approved.org/membership/membership-faqs/)
- [CREST annual membership fees](https://www.crest-approved.org/membership/annual-membership-fees/)
- [CREST: first AI penetration testing accredited members](https://www.crest-approved.org/crest-first-ai-pt-accredited-members/)
- [NCSC CHECK: information for buyers](https://www.ncsc.gov.uk/schemes/check/information-for-buyers)
- [PentestCompare methodology](https://pentestcompare.com/methodology/)