Pentest sample reports: public examples from providers
These providers publish a sample penetration testing report or public client reports on their own sites, A to Z, with each link checked on 9 November 2026. Some provide a report on request instead. Open the report and check scope, method, evidence for each finding, remediation and retest before you shortlist a provider.
A penetration testing sample report is the best free evidence of what you will receive. The table lists providers whose own pages link a public sample report or public client reports, A to Z with no ranking. We checked each link on 9 November 2026. Names link to the provider pages with sources.
15 of 15 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 7ASecurityBoutique consultancy, Ireland | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and… | Public |
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| Cure53Boutique consultancy, Germany | human-led | Yes | ? | Yes | ? | Yes | ? | Custom quote | Not published | Not published. The site says assignments do not end with the report… | Public |
| DoyensecBoutique consultancy | human-led | Yes | Yes | Yes | ? | Yes | Yes | Custom quote | Not published | Not stated on the homepage or company page. Some public reports are… | Public |
| Excession LabsPublisherSecurity lab (AI-assisted testing) | hybrid | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | Public |
| ParameterAI-assisted testing service | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher… | Public |
| PenligentAI-assisted testing service | automated | Yes | ? | ? | Yes | ? | ? | $0 per month +2 more | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk… | Public |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| Rhino Security LabsPenetration testing firm, United States | human-led | Yes | ? | Yes | Yes | Yes | ? | Not published | Not published | Not published | Public |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does this list include, and how does a provider qualify?#
A provider qualifies when its own site links a report that anyone can open without a sales call. The link can go to a PDF, a form-free download, or a page of public reports. We do not list "on request" providers in the table, because you cannot check what they send. Our dataset marks them separately. For how to read a report once you have it, see how to judge a pentest provider by its sample report. This page answers who publishes one.
Who does it help?#
It helps buyers who want to compare report quality before any call, and engineering teams that need to know what their auditor or customer will read. It also helps first-time buyers who have never seen a pentest report. Open two or three samples side by side.
What should you read in each sample?#
Use this checklist on every report you open.
| Check | What to look for |
|---|---|
| Scope | Named assets, dates, test accounts and exclusions |
| Method | Manual steps named, tools named, standards cited |
| Evidence | Request and response, screenshot or log for each finding |
| Reproduction | Steps a developer can follow |
| Severity | A written scale and a reason for each rating |
| Remediation | A specific fix, not "validate input" |
| Retest | A section or letter that shows a fix was checked |
What drives the price?#
Price follows scope, depth, roles and tenants, and retest terms. A longer report is not a better one. Compare the Published price column with the report depth, and see penetration testing cost for sourced ranges.
How do you read the table?#
The Sample report column says "public" for every row, so use the provider page for the link and the check date. A "public" status can mean one sample PDF, a research page with many client reports, or a product page with a downloadable example. Open the link and see which. The other columns describe the provider as a whole.
What are the limits of this list?#
We confirm that a link works and is on the provider's own site. We do not confirm that a sample matches the report you will get. A sample can be redacted or invented, and it can be old. Some providers share a report only on request. Compass Security, Packetlabs and Vumetric list a request route, and Bridewell offers a redacted report on request. Ask any provider for a sample report from the same service you plan to buy, such as an API test or a cloud test. Also see boutique penetration testing firms.
Questions
Is a public sample report a real client report?
Not always. Some providers publish a redacted or invented example. Others publish real reports with client consent. Check the provider page and the report cover. A sample shows format and depth, not the result for your system.
What if a provider only sends a report on request?
Ask for it before the scoping call. Compass Security, Packetlabs and Vumetric list a request route, and Bridewell offers a redacted report on request. A provider that refuses to show any sample leaves you judging by the pitch alone.
Can I use a sample report as a template for my own?
You can learn the structure from one. Do not copy a provider's text. Write your own scope, severity scale and remediation rules, or ask the provider for its template.
How do I judge a sample report?
Read the finding pages first, not the summary. Check for the request and response, the steps to reproduce, the fix and the severity reason. Our guide on judging a provider by its sample report has the full checklist.
Sources
- 7ASecurity publications (checked 9 November 2026)
- Parameter sample pentest report (checked 9 November 2026)
- Raxis sample report (checked 9 November 2026)
- Secure Ideas sample report (checked 9 November 2026)
- Securitum public reports (checked 9 November 2026)
- Compass Security sample report request (checked 9 November 2026)
- PentestCompare methodology (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.