# PTaaS providers: platforms compared

Source: https://pentestcompare.com/lists/ptaas-providers/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

PTaaS providers compared from their own pages: delivery, published price, retest terms and sample reports, plus what PTaaS means in a contract. Checked Nov 2026.

> **Short answer:** PTaaS providers sell penetration testing through an online platform, often as credits or a subscription. The table lists providers whose dataset type is a PTaaS or crowdsourced platform, sorted A to Z. Check the contract for retest window, portal access, who tests and the unit of price. Labels overlap, since consultancies also sell PTaaS plans.

PTaaS providers sell penetration testing through an online platform. You scope, track findings and request retests in a portal instead of waiting for a final PDF. Facts come from the [PentestCompare dataset](/directory/), checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |

## What does this list include, and how does a provider qualify?

A provider qualifies when its dataset type reads PTaaS platform, penetration testing as a service, or crowdsourced platform. We assign that type from the provider's own pages. The list is not a market census. Some consultancies sell PTaaS plans and sit under a consultancy type, so they are missing here. For a view of all three models, read [PTaaS vs traditional pentesting](/guides/ptaas-vs-traditional-pentesting/).

The dataset shows mostly hybrid delivery for this list, which means tools and human testers work together. Check each provider page for the split.

## Who does a PTaaS platform help?

It helps teams that release often, need results in a shared place, and want retests without a new project each time. Buyers who need one report for an audit may find a traditional project simpler. Platforms also suit teams that want several tests across a year under one contract.

If you are choosing between platforms, our comparison pages on [Cobalt alternatives](/compare/cobalt-alternatives/) show differences between named providers.

## What should you ask a PTaaS provider?

Ask these questions before you buy:

1. What is the unit of purchase: credits, a subscription or a fixed test?
2. Who tests: vetted individuals, employees or software? Can I see their details?
3. How long does retesting last, and does it cost extra?
4. What does the portal show, and can I export findings to my tracker?
5. Can I see a sample report?
6. What happens to unused credits at the end of the term?
7. What are the turnaround and kickoff times, and where are they written?

Our guide on [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) adds general questions.

## What drives PTaaS price?

The unit decides how you compare. Providers sell credits, annual subscriptions or per-test fees. As of 9 November 2026, Cobalt, Synack and Astra Security list prices on their pricing pages, while several others in the table publish none. Prices differ in unit, so do not compare list prices side by side. Ask each provider for a total for the same scope and term. See [penetration testing cost](/guides/penetration-testing-cost/) for named published prices.

## How should you read the table?

Each row is that provider's statement. "Not published" means we found no statement, not that the item is absent. Published price shows the first listed price, or the pricing model where none is listed. The Retest column shows the provider's own words, and windows vary in length and in what they cover. Sample report status shows whether you can read a report before you buy.

## What are the limits of this list?

Three limits apply. The dataset type is our classification, so a platform with a different label is not here. The platform name tells you little about who tests, so check delivery and the provider page. The list shows published statements and is not a test of quality, speed or coverage.

Another limit: a PTaaS label describes how you buy, and does not by itself say that testing is continuous. Check the test frequency in the contract. To compare other models, see the [provider directory](/directory/).

## Questions

### Does this list include every company that sells PTaaS?

No. It includes providers whose dataset type says PTaaS or crowdsourced platform. Some consultancies also sell PTaaS plans and sit under other types. Our PTaaS vs traditional pentesting guide names them.

### What should a PTaaS contract state?

The unit you buy (credits, subscription or per test), who tests, how long retests last, what the portal shows, and how reports are exported. Providers use the same words for different terms, so ask for them in writing.

### Is PTaaS cheaper than a consultancy project?

The published prices do not settle it. Units differ across providers, and several publish no price. Ask each provider for a total for the same scope and compare totals.

### Which PTaaS provider is best?

We do not rank providers. The table is sorted A to Z. Compare retest terms, sample reports, published price and who does the testing against your scope.

## Sources

- [PentestCompare methodology and provider dataset](https://pentestcompare.com/methodology/)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Synack pricing](https://www.synack.com/pricing/)
- [Astra Security pricing](https://www.getastra.com/pricing)