PTaaS providers: platforms compared

PTaaS providers sell penetration testing through an online platform. You scope, track findings and request retests in a portal instead of waiting for a final PDF. Facts come from the PentestCompare dataset, checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

What does this list include, and how does a provider qualify?#

A provider qualifies when its dataset type reads PTaaS platform, penetration testing as a service, or crowdsourced platform. We assign that type from the provider's own pages. The list is not a market census. Some consultancies sell PTaaS plans and sit under a consultancy type, so they are missing here. For a view of all three models, read PTaaS vs traditional pentesting.

The dataset shows mostly hybrid delivery for this list, which means tools and human testers work together. Check each provider page for the split.

Who does a PTaaS platform help?#

It helps teams that release often, need results in a shared place, and want retests without a new project each time. Buyers who need one report for an audit may find a traditional project simpler. Platforms also suit teams that want several tests across a year under one contract.

If you are choosing between platforms, our comparison pages on Cobalt alternatives show differences between named providers.

What should you ask a PTaaS provider?#

Ask these questions before you buy:

1. What is the unit of purchase: credits, a subscription or a fixed test?
2. Who tests: vetted individuals, employees or software? Can I see their details?
3. How long does retesting last, and does it cost extra?
4. What does the portal show, and can I export findings to my tracker?
5. Can I see a sample report?
6. What happens to unused credits at the end of the term?
7. What are the turnaround and kickoff times, and where are they written?

Our guide on questions to ask a pentest provider adds general questions.

What drives PTaaS price?#

The unit decides how you compare. Providers sell credits, annual subscriptions or per-test fees. As of 9 November 2026, Cobalt, Synack and Astra Security list prices on their pricing pages, while several others in the table publish none. Prices differ in unit, so do not compare list prices side by side. Ask each provider for a total for the same scope and term. See penetration testing cost for named published prices.

How should you read the table?#

Each row is that provider's statement. "Not published" means we found no statement, not that the item is absent. Published price shows the first listed price, or the pricing model where none is listed. The Retest column shows the provider's own words, and windows vary in length and in what they cover. Sample report status shows whether you can read a report before you buy.

What are the limits of this list?#

Three limits apply. The dataset type is our classification, so a platform with a different label is not here. The platform name tells you little about who tests, so check delivery and the provider page. The list shows published statements and is not a test of quality, speed or coverage.

Another limit: a PTaaS label describes how you buy, and does not by itself say that testing is continuous. Check the test frequency in the contract. To compare other models, see the provider directory.