Pentest companies with published prices: Nov 2026 list

Buyers who search for penetration testing pricing want a number before they talk to sales. This page lists the companies that print one. A provider qualifies when its own pricing page or product page shows a dollar or euro amount for a pentest or a pentest product. Rows run A to Z, no provider pays for position, and each price links to its source with the date we checked it.

Which pentest prices do providers publish?#

This extract picks one clear entry price for some providers from the full table above, so you can see the range and the units side by side. All prices were read on 9 November 2026.

The units differ, and so do the products. Some are automated tests of one target. Some are manual tests by people. The cheapest entry point is not the cheapest test of your system.

What does the list include, and how does a provider qualify?#

A provider qualifies when we recorded at least one price from its own page. We do not count a price from a review site, a reseller or an article. Free plans and tool subscriptions count when the provider sells them as part of its pentest range, and we show their unit.

Providers that print no amount are not on the list. Many firms say price depends on scope and quote after a call. That is a statement about their sales model and not about their quality.

Who does this list help?#

It helps buyers who need a budget range before they start a procurement, and buyers who want to filter out firms that give no figure. It also helps teams that need to compare an automated product with a manual engagement. Both exist under the same word.

For an explanation of price models, drivers and what a quote should contain, read the penetration testing cost guide. This page answers a narrower question: who prints a number, and what is it.

What should you ask providers?#

Ask for written answers to these questions, even when a price is public.

1. Which scope does the published price assume (number of apps, roles, API endpoints)?
2. Is depth black box, grey box or white box?
3. Does the price include a retest, and for how long?
4. Does a human review every finding?
5. Is the price a limited-time offer, and when does it end?
6. What extra items change the total (extra roles, environments, report formats)?

What drives the price?#

The entries show the main drivers. Scope is the first. Aikido states that its typical $4,000 covers one application plus its primary APIs, and that black-box and grey-box tests cost extra (Aikido). Delivery model is the second. TurboPentest sells automated pentests from $99 per credit, while Secure Ideas starts at $13,600 for its smallest web application test with people (TurboPentest, Secure Ideas). Retest terms are the third. Intruder states unlimited retesting on its single test and 4-pack, (Intruder). TurboPentest treats a retest as a full new pentest at the same per-target price (TurboPentest).

How do you read the table?#

Rows run A to Z. The Published price column shows the provider's own unit, such as a test, a year, a month or a credit. Do not read it as one unit. The Retest and Sample report columns help you judge value beyond the price, because a cheap test without a usable report costs more to act on.

What are the limits of this list?#

• A published price is a start price for a smallest scope. Your scope may cost more.
• Prices change without notice. Some are limited-time offers, like Cobalt's Autonomous Pentest price. Open the source link before you budget.
• The list shows who publishes, not who is best. Firms that quote on request are missing by design.
• A price on a page does not include tax, unless the page says so. Hadrian's price excludes VAT.

To report a price that changed, use the correction form.