# Cobalt alternatives for penetration testing

Source: https://pentestcompare.com/compare/cobalt-alternatives/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cobalt.io alternatives for pentesting, grouped by need: published per-test prices, human-led testing, fast automated tests. Sources checked 9 November 2026.

> **Short answer:** Cobalt sells its human-led tiers as annual credit packages with no published price, and its pricing page states the retest window two ways. This page groups six other providers from our dataset by need: published per-test prices, human-led testing, and fast automated tests. Excession Labs, the publisher, is a seventh, labeled row. Each fact carries a vendor source checked on 9 November 2026.

Cobalt is a pentest platform that connects buyers with vetted freelance testers and also sells an autonomous pentest. This page groups other providers from the [provider dataset](/providers/) by what a buyer needs. It gives no ratings and picks no winner. Excession Labs, the publisher of this site, appears once, marked as such.

## Why look for Cobalt alternatives?

Three facts on Cobalt's own pricing page, which we read on 9 November 2026, can send a buyer to other providers.

Standard, Premium and Enterprise are annual credit packages, and one credit equals 8 hours of testing. None of the three tiers shows a price. The credits debited for a test also vary with your contracted per-credit rate, so a buyer who wants a figure for the human-led tiers has to ask sales.

The one published price is $3,500 per test for the Autonomous Pentest, a limited-time offer. The test must start and finish before 31 December 2026. It is a web application test with findings in 24 hours, a different product from a credit package.

The retest wording differs inside the page. The comparison table gives free retesting for 6 months (Standard) or 12 months (Premium and Enterprise). The FAQ says unlimited on-demand retesting during the contract term. Ask Cobalt in writing which statement applies to your contract.

Cobalt also holds SOC 2 Type II, ISO 27001 and a CREST accreditation, per its [Trust Center](https://www.cobalt.io/trust-center), and lists a sample report as available on request.

## Which alternatives publish a price per test or set retest terms?

Synack and Secure Ideas publish dollar figures for single tests, and Aikido does too (see the automated group below). The units differ, so the figures do not cover equal scope.

Synack lists starting prices per test: $5,085 for a Sara Pentest (AI-led, external web or host, 4 to 5 business days), $10,283 for SynackST (one human tester, one framework) and $27,120 for Synack14 (a team, 14 days). Credits expire one year after purchase. Any test requires the Synack Platform, which is billed as a separate line with no published price, so the all-in cost is not visible. Each product includes patch verification. See the [Synack and Cobalt head-to-head](/compare/synack-vs-cobalt/).

Secure Ideas is a human-led consultancy. Its flat starting prices for the smallest scope are $13,600 for a web application test, $10,880 for an API test and $8,160 for an external network test. The homepage says most tests cost $10K to $45K. It also sells a prepaid credit plan (PETaaS) at $2,520 per credit with a 25-credit minimum. Credits are a pool of effort-days, so they cannot be compared directly with a per-test price. Testing usually starts two to four weeks after contracting. It has a public sample report and a CREST accreditation listed on its homepage.

BreachLock is a PTaaS platform with an in-house human team, and its homepage claims CREST accreditation. It publishes no prices; each tier links to a quote or discovery call. The pricing page lists free manual retests: one for Standard, two for Extended and a custom number for Extensive. The product text also promises unlimited retesting, so BreachLock states its retest terms two ways as well. It says tests can be scoped and started within 24 to 48 hours. That figure is the time to start. The page gives no report time. A sample report is available on request.

Pen Test Partners is a UK and US consultancy with NCSC CHECK, CREST member, ISO 27001 and PCI QSA badges on its homepage. We read those from badges and links, so confirm them with the firm. It publishes no prices, no retest terms and no sample report. Its PTaaS service sells blocks of time in half-day units. See its [profile](/providers/pen-test-partners/).

## Which alternatives run automated tests or offer a free pilot?

Two providers sell automated tests. Aikido publishes prices and Parameter does not.

Aikido lists a TYPICAL Pentest at $4,000 per assessment and a Rightsized Pentest from $50 to $30,000+ per assessment. Its AI agents map, attack and verify findings, and a human-led CREST pentest is available on request. Its turnaround statements conflict: results on the day of the run on the pricing page, and on the AI pentest page a few hours, minutes, and in one place a report in days. Ask which applies to your scope. Retesting is free for up to 6 months. A public sample exists, but the samples we found cover network, mobile and AI, not web or API.

Parameter runs autonomous AI agents that pause for customer approval before chaining or escalating. It publishes no price for its three tiers. It does publish a [sample pentest report](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf), claims first findings in 24 hours, and lists free re-testing from the Single App tier. Its security page shows a SOC 2 Type I report, with the Type II period still in progress.

Excession Labs (publisher of this site) is a security lab that tests web applications, APIs and multi-tenant SaaS with AI agents and checks each finding. Excession Labs checks the evidence for each finding and writes the report. It offers a free pilot with a small written scope. It publishes no prices, turnaround or credentials, and quotes follow a scoping call. The public sample report covers a made-up app and is not a customer report. Its pages do not describe network, cloud or mobile testing. See its [profile](/providers/excession-labs/); it is compared on the same fields as every other row.

## How do the options compare, and how do you shortlist?

| Provider | Delivery | Published price | Unit | Retest terms published | Sample report |
|---|---|---|---|---|---|
| Cobalt | Freelance testers plus AI | $3,500 (autonomous, to 31 Dec 2026) | per test; tiers are annual credit packages | Yes, two versions | On request |
| Synack | AI agent plus vetted researchers | $5,085 / $10,283 / $27,120 (starting) | per test; platform billed separately | Patch verification included | Not published |
| Secure Ideas | Human consultants | $13,600 / $10,880 / $8,160 (starting) | per test, smallest scope | Not included by default | Public |
| BreachLock | In-house team, AI-accelerated | Not published | Not published | 1 / 2 / custom free retests | On request |
| Aikido | AI agents, human option on request | $4,000; $50 to $30,000+ | per assessment | Free for up to 6 months | Public (not web or API) |
| Parameter | Autonomous AI agents | Not published | Not published | Free re-testing from Single App | Public |
| Excession Labs (publisher) | AI agents plus human evidence check | Not published | Not published | Offered; terms in each quote | Public (made-up app) |

Sources: the dataset rows linked above, each checked against the vendor pages listed under Sources on 9 November 2026.

Pick your unit first: one web app, one API, or an annual number of testing hours. Convert every quote to that unit. Ask each provider for the retest window in writing, the date the quote expires, and what its turnaround figure measures. The [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) list has more, and the [pentest cost guide](/guides/penetration-testing-cost/) explains pricing models.

Found an error or a missing fact? [Send a correction](/methodology/#corrections).

## Questions

### Can I compare Cobalt credits with a per-test price?

Only after you convert them. Cobalt says one credit equals 8 hours of testing, and the credits debited for a test depend on your contracted per-credit rate. A $3,500 test and a credit package use different units. Ask Cobalt for the per-credit rate first.

### Does Cobalt publish a price for its human-led pentests?

Not on the pricing page we read on 9 November 2026. Standard, Premium and Enterprise are quote-only annual credit packages. The only dollar figure is $3,500 per test for the Autonomous Pentest, a limited-time offer that must start and finish before 31 December 2026.

### Which alternative keeps a platform with human testers?

In our dataset, Synack and BreachLock both pair a platform with human testers. Synack publishes starting prices per test. BreachLock publishes none but lists the number of free manual retests per tier. Their scope and units differ. Read each profile before you shortlist.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Cobalt Trust Center](https://www.cobalt.io/trust-center)
- [Synack pricing](https://www.synack.com/pricing/)
- [Secure Ideas pricing](https://secureideas.com/pricing)
- [BreachLock penetration testing pricing](https://www.breachlock.com/pricing/penetration-testing-pricing/)
- [Aikido pricing](https://www.aikido.dev/pricing)
- [Aikido AI pentest](https://www.aikido.dev/attack/aipentest)
- [Parameter pentesting](https://www.parameter.ai/pentesting)
- [Excession Labs pricing and scope (publisher of this site)](https://penetrationtestservices.com/pricing/)


---

# Cobalt vs HackerOne for penetration testing

Source: https://pentestcompare.com/compare/cobalt-vs-hackerone/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cobalt vs HackerOne pentest, side by side: delivery, scope, pricing, turnaround, retest terms, sample reports and credentials. Vendor sources checked 9 November 2026.

> **Short answer:** Cobalt and HackerOne both sell pentests through a platform with human testers and an AI option. Cobalt sells annual credit packages and one published $3,500 autonomous test. HackerOne publishes no price. Each vendor's own sources state its retest terms in more than one way. The comparison uses vendor pages checked on 9 November 2026 and names no winner.

Cobalt and HackerOne are both platforms where buyers order pentests from vetted external testers and track findings online. Both are in the [provider dataset](/providers/). This comparison covers the pentest products only, using each vendor's public pages on 9 November 2026. Cobalt prices in credits and shows one dollar figure. HackerOne shows no pentest price.

## How do Cobalt and HackerOne compare?

| Field | Cobalt | HackerOne |
|---|---|---|
| Delivery | Vetted freelance testers (Cobalt Core) with AI agents, plus a separate Autonomous Pentest | H1 Pentest, fully human-led; H1 Agentic Pentest, AI agents with human review of every agent finding |
| Scope named | Web app, API, cloud, network, mobile, AI apps | H1 Pentest: web, API, cloud, AI and LLM, mobile, network, desktop, code audits, PCI segmentation. Agentic: web apps and APIs only |
| Pricing model | Annual credit packages (Standard, Premium, Enterprise); one credit is 8 hours of testing; no tier price published | Custom quote; no pentest price on the pricing page |
| Published price | $3,500 per Autonomous Pentest (limited time; start and finish before 31 Dec 2026) | None |
| Turnaround claim | Autonomous: findings in 24 hours. Annual tiers: start in 3 / 2 / 1 business days (Standard / Premium / Enterprise), varying by engagement type | Page: findings in "hours not weeks"; no start time or test length. Docs: final report 3 to 5 business days after testing ends |
| What turnaround measures | Time to first findings (autonomous) or time to start (tiers) | Report delivery after testing (docs); live findings during testing (page) |
| Retest terms | Table: free for 6 months (Standard), 12 months (Premium, Enterprise). FAQ: unlimited on demand during the contract | Docs: unlimited during the remediation period (typically 30 or 90 days), usually completed in about three days; fee (minimum $50) possible after. Older docs: 60 days, two retests |
| Sample report | On request | Not published (interactive demo linked) |
| Credentials with evidence | SOC 2 Type II, ISO 27001, CREST accreditation (Trust Center) | None found on the pages checked |
| Integrations | Jira, GitHub, Slack | GitHub, Jira, Slack, ServiceNow |

Sources: [Cobalt pricing](https://www.cobalt.io/pricing), [Cobalt Trust Center](https://www.cobalt.io/trust-center), [HackerOne pentest page](https://www.hackerone.com/product/pentest), [HackerOne pricing](https://www.hackerone.com/pricing) and HackerOne docs (found via search; not opened directly), all checked 9 November 2026. HackerOne's list of standards (SOC 2, ISO 27001, PCI DSS, DORA, NIST CSF 2.0, GDPR) describes what its reports support, not certifications it holds, so we do not list them as credentials.

The two are mostly the same kind of product. Both resemble PTaaS: you scope a test online, testers work on the platform, and findings appear as the work proceeds. The [PTaaS vs traditional pentesting guide](/guides/ptaas-vs-traditional-pentesting/) explains that model.

They differ in what else the vendor sells. HackerOne also runs bug bounty and disclosure programs, and its pentest page says results stream into the same platform. Cobalt's credit packages cover scoping, testing, retesting and platform access, and it adds an autonomous test at a fixed price. If you are choosing between a program and a test, read the [bug bounty vs pentest guide](/guides/bug-bounty-vs-pentest/).

## Which should you choose, and where do they differ?

Choose Cobalt if:

- You want a published entry price for one web app test. The $3,500 Autonomous Pentest has one, but the offer must start and finish before 31 December 2026.
- You want a stated start time. Cobalt lists 3, 2 or 1 business days by tier, with a footnote that start times vary by engagement type.
- You want certifications you can verify on a Trust Center: SOC 2 Type II, ISO 27001 and CREST.
- You can commit to an annual credit package and have a plan for how many hours you will use. The FAQ and the table disagree on rollover (up to 10% in the table, none in the FAQ), so ask.

Choose HackerOne if:

- You already use HackerOne for bug bounty or vulnerability disclosure and want pentests from the same vendor and platform.
- You want to choose between a fully human-led test and an agentic test where human testers review every agent finding.
- You need ServiceNow among your integrations, or desktop, code-audit or PCI segmentation testing in the scope list.
- You plan to negotiate retest terms from HackerOne's documented window (typically 30 or 90 days of unlimited retests) and have them written in.

Price visibility differs most. Cobalt shows one figure, for a one-off autonomous test, and none for human-led work. HackerOne shows none. For either vendor, only a quote prices a human-led test, and the quote unit (credits, effort days, a fixed fee) decides what you can compare. A credit package and a per-test price are not equal units.

The turnaround numbers measure different events. Cobalt's tier figures are start times. HackerOne's docs figure is report delivery after the testing phase. Neither gives the length of a test.

Get retest terms in writing from both. Cobalt's own page states two versions. HackerOne's product page, current docs and older posts disagree.

Cobalt's Trust Center lists its credentials. We found no credential list for HackerOne's pentest service on the pages checked. Ask HackerOne what applies to the testers and the service.

Neither vendor publishes a sample report. Cobalt provides one on request, and HackerOne links an interactive demo. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what to look for.

## What to ask both vendors

1. Which of the retest statements applies to my contract, and what is the end date?
2. What does your turnaround number measure?
3. Who tests my scope, and can I see tester profiles or certifications?
4. What is the quote unit, and what does a second scope cost?
5. Can I see a sample report before I sign?

More providers: [Cobalt alternatives](/compare/cobalt-alternatives/) and [HackerOne pentest alternatives](/compare/hackerone-pentest-alternatives/). Found an error? [Send a correction](/methodology/#corrections).

## Questions

### Do Cobalt and HackerOne use the same kind of testers?

Both use vetted external testers on a platform. Cobalt describes a network of vetted freelance pentesters, the Cobalt Core. HackerOne says testers are matched to your asset type and stack. Neither page checked gives the number of testers or the hiring bar, so ask for tester profiles in your scoping call.

### Which one has a price I can budget with?

Only Cobalt publishes a dollar figure: $3,500 per Autonomous Pentest, a limited-time offer that must start and finish before 31 December 2026. Its human-led tiers have no published price. HackerOne publishes no pentest price. Both need a quote to budget a human-led test.

### Can I compare their retest windows directly?

Not yet. Cobalt's table says 6 or 12 months by tier while its FAQ says unlimited during the contract term. HackerOne's docs say unlimited retests in a remediation window of typically 30 or 90 days. Get the window written into your order form for either vendor.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Cobalt Trust Center](https://www.cobalt.io/trust-center)
- [Cobalt homepage](https://www.cobalt.io/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [HackerOne pricing](https://www.hackerone.com/pricing)
- [HackerOne docs: retesting pentests (found via search; not opened directly)](https://docs.hackerone.com/en/articles/8541386-retesting-pentests)


---

# HackerOne pentest alternatives

Source: https://pentestcompare.com/compare/hackerone-pentest-alternatives/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

HackerOne pentest alternatives grouped by need: published prices, set retest terms, sample reports or a human-led consultancy. Vendor sources checked 9 November 2026.

> **Short answer:** HackerOne's pentest page lists no price, no sample report and no stated lead time, and its retest terms differ between its docs and older posts. This page groups five alternatives from our dataset by need: published prices, set retest terms, or an accredited human-led consultancy. Each fact carries a vendor source checked on 9 November 2026.

HackerOne is a crowdsourced security platform that sells pentests in two forms: a human-led H1 Pentest and an H1 Agentic Pentest. The alternatives below come from the [provider dataset](/providers/) and are grouped by need. This page gives no ratings and names no winner.

## What does HackerOne publish about its pentests?

This section uses HackerOne's own pages, read on 9 November 2026.

HackerOne publishes no price. Its pricing page has no dollar amounts for pentests, and every tier routes to sales. The only metered unit on that page is monthly automations for platform tiers, which is not a pentest price.

The pentest page gives no start time, test length or sample report. It links an interactive demo and a solution brief, and it says the sales team typically responds within one business day.

Retest terms depend on the source. HackerOne documentation says retests are unlimited during the remediation period (typically 30 or 90 days), usually completed within about 72 hours once claimed, and that a fee (minimum $50) can be set after the window. We found those docs through search and did not open them directly. Older docs and posts show 60 days and two retests. Ask for the current terms in your order form.

The agentic offering covers web applications and APIs only. H1 Pentest has the wider scope: web, API, cloud, AI and LLM, mobile, network, desktop, code audits and PCI segmentation.

HackerOne suits an organization that already runs a HackerOne program and wants pentests from the same vendor. The alternatives below cover buyers who want a published price, set retest terms or a different delivery model.

## Which alternatives publish prices?

Synack lists starting prices per test: $5,085 (Sara Pentest, AI-led, external web or host), $10,283 (SynackST, one human tester, one framework) and $27,120 (Synack14, a team, 14-day window). Credits expire one year after purchase. A platform subscription is required and billed separately with no published price, though a free Basic tier exists. Patch verification is included in each product. Synack announced a merger with NetSPI on 2 September 2026, and a Synack notice says it closed on 5 October 2026. No pricing change has been announced.

Secure Ideas publishes flat starting prices for the smallest scope: $13,600 for a web application test, $10,880 for an API test and $8,160 for an external network test. It also lists $340 per hour and $2,720 per day. Its homepage says most tests cost $10K to $45K. It has a public sample report. Testing usually starts two to four weeks after contracting and runs one to two weeks. See its [profile](/providers/secure-ideas/).

Cobalt lists a $3,500 per test Autonomous Pentest as a limited-time offer that must start and finish before 31 December 2026. Its human-led tiers are annual credit packages (one credit equals 8 hours of testing) with no published price. See the [Cobalt versus HackerOne comparison](/compare/cobalt-vs-hackerone/).

## Which alternatives state free retests or use accredited human testers?

BreachLock is a PTaaS platform with an in-house human team. Its pricing page lists free manual retests per tier: one for Standard, two for Extended and a custom number for Extensive. It publishes no prices; each tier links to a quote or discovery call. It says tests can be scoped and started within 24 to 48 hours, which is a start time and not a report time. Its homepage claims CREST accreditation. A sample report is available on request.

Cobalt's pricing table lists free retesting for 6 months (Standard) or 12 months (Premium, Enterprise), and its FAQ says unlimited on-demand retesting during the contract. Synack lists patch verification as included. Secure Ideas does not include retesting by default and lists it as a factor that can change a quote.

Pen Test Partners is a UK and US consultancy with NCSC CHECK testing for the UK public sector. Its homepage shows CHECK, CREST member, ISO 27001 and PCI QSA badges. We read those from badges and links, so confirm them directly. Its PTaaS service sells blocks of time in half-day units, for tests from half a day to two days. It publishes no price, standard-test turnaround, retest terms or sample report. See its [profile](/providers/pen-test-partners/).

Secure Ideas, covered above, is also a human-led consultancy with a CREST accreditation listing.

## How do the options compare, and what should you ask before you switch?

| Provider | Delivery | Published price | Unit | Retest terms | Sample report |
|---|---|---|---|---|---|
| HackerOne | Human-led or agentic with human review | Not published | Not published | Docs: unlimited in remediation window (30 or 90 days) | Not published |
| Synack | AI agent plus vetted researchers | $5,085 / $10,283 / $27,120 (starting) | per test; platform billed separately | Patch verification included | Not published |
| Cobalt | Freelance testers plus AI | $3,500 (autonomous, to 31 Dec 2026) | per test; tiers are credit packages | Two versions on one page | On request |
| BreachLock | In-house team, AI-accelerated | Not published | Not published | 1 / 2 / custom free retests | On request |
| Pen Test Partners | Human consultancy | Not published | Half-day blocks (PTaaS) | Not published | Not published |
| Secure Ideas | Human consultants | $13,600 / $10,880 / $8,160 (starting) | per test, smallest scope | Not included by default | Public |

Sources: dataset rows linked above and the vendor pages under Sources, checked on 9 November 2026.

Ask the new provider what its turnaround number measures: start time, test window or report delivery. HackerOne's docs figure (report 3 to 5 business days after testing) and Synack's test windows measure different things. Ask for retest terms in writing and for a sample report. If you are weighing a program against a one-off test, read the [bug bounty vs pentest guide](/guides/bug-bounty-vs-pentest/).

Found an error or a missing fact? [Send a correction](/methodology/#corrections).

## Questions

### Is HackerOne pentest the same as a bug bounty?

No. A bug bounty pays researchers for findings they choose to report. A pentest is a scoped engagement with set testers and a final report. HackerOne sells both on one platform. Our bug bounty vs pentest guide explains the difference in scope, cost and output.

### How long does HackerOne take to deliver a pentest report?

The product page gives no lead time or test length. HackerOne documentation, which we found through search and did not open directly, lists the final report 3 to 5 business days after testing ends. That figure measures report delivery after testing, not time to start.

### Which alternative lists the number of free retests?

BreachLock lists free manual retests per tier: one for Standard, two for Extended and a custom number for Extensive. Its product text also promises unlimited retesting, so confirm which applies. Cobalt, Synack and Secure Ideas state retest terms differently; see each profile.

## Sources

- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [HackerOne pricing](https://www.hackerone.com/pricing)
- [HackerOne docs: retesting pentests (found via search; not opened directly)](https://docs.hackerone.com/en/articles/8541386-retesting-pentests)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Synack pricing](https://www.synack.com/pricing/)
- [BreachLock penetration testing pricing](https://www.breachlock.com/pricing/penetration-testing-pricing/)
- [Pen Test Partners PTaaS](https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/)
- [Secure Ideas pricing](https://secureideas.com/pricing)


---

# Pentest provider comparisons

Source: https://pentestcompare.com/compare/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Pentest provider comparisons: head-to-head and alternatives pages for Cobalt, HackerOne, XBOW, Horizon3 and Synack, with prices and retest terms checked 9 Nov 2026.

Each comparison uses the same fields from the [provider dataset](/providers/): delivery, scope, pricing model with units, what the turnaround claim measures, retest terms, sample report and credentials with evidence. Where a vendor publishes nothing, the cell says "Not published". No page gives ratings or names a winner. Excession Labs, the publisher of this site, is one row in the dataset and is marked wherever it appears.

## Comparison pages

Alternatives:

- [Cobalt alternatives](/compare/cobalt-alternatives/): six options grouped by published price, human-led retest terms and automated tests.
- [XBOW alternatives](/compare/xbow-alternatives/): options for a published price, a sample report, a human reviewer or network coverage.
- [HackerOne pentest alternatives](/compare/hackerone-pentest-alternatives/): options with published prices, set retest counts or consultancy delivery.

Head-to-head:

- [Cobalt vs HackerOne](/compare/cobalt-vs-hackerone/): two platforms with human testers, one published price, different retest wording.
- [XBOW vs Horizon3 NodeZero](/compare/xbow-vs-horizon3/): different categories, web and API agents against a network-first platform.
- [Synack vs Cobalt](/compare/synack-vs-cobalt/): per-test starting prices against credit packages.

Field definitions are in the [methodology](/methodology/). To send a correction, use the [corrections form](/methodology/#corrections).


---

# Synack vs Cobalt for penetration testing

Source: https://pentestcompare.com/compare/synack-vs-cobalt/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Synack vs Cobalt pentest, side by side: delivery, scope, price units, turnaround, retest terms, sample reports and credentials. Vendor sources checked 9 November 2026.

> **Short answer:** Synack lists starting prices per test ($5,085 to $27,120) and bills a platform subscription separately. Cobalt sells annual credit packages with no tier price and one $3,500 autonomous test on a limited-time offer. Both pair human testers with AI. The comparison uses vendor pages checked on 9 November 2026 and names no winner.

Synack and Cobalt both pair vetted human testers with AI and deliver through a platform. Synack prints starting prices per test for three products. Cobalt prints credit tiers with no price, plus one autonomous test at $3,500. Both are in the [provider dataset](/providers/), and this page uses vendor pages checked on 9 November 2026.

## How do Synack and Cobalt compare at a glance?

| Field | Synack | Cobalt |
|---|---|---|
| Delivery | Sara (autonomous AI agent) plus the Synack Red Team of vetted researchers; SynackST uses one human tester; Synack14 uses a team | Vetted freelance testers (Cobalt Core) with AI agents, plus a separate Autonomous Pentest |
| Scope named | Web, host, API, mobile, cloud, network (varies by product; Sara: external web or host only) | Web app, API, cloud, network, mobile, AI apps |
| Pricing model | Starting price per test, bought with credits that expire one year after purchase; platform subscription billed separately | Annual credit packages (Standard, Premium, Enterprise); one credit is 8 hours of testing |
| Published prices | Sara Pentest $5,085; SynackST $10,283; Synack14 $27,120 (all starting, per test). Platform: no price; Basic tier free | Autonomous Pentest $3,500 per test (limited time, start and finish before 31 Dec 2026). Tiers: no price |
| Turnaround claim | Test windows: Sara 4 to 5 business days; SynackST 5 days; Synack14 14 days | Autonomous: findings in 24 hours. Tiers: start in 3 / 2 / 1 business days (Standard / Premium / Enterprise), varying by engagement type |
| What turnaround measures | Length of the testing window | Time to first findings (autonomous) or time to start (tiers) |
| Retest terms | Patch verification included in each product; platform lets you request retests | Table: free for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ: unlimited on demand during the contract |
| Sample report | Not published | On request |
| Credentials with evidence | FedRAMP authorization (Moderate, platform only, per merger notice) | SOC 2 Type II, ISO 27001, CREST accreditation (Trust Center) |
| Integrations | ServiceNow, Jira, Splunk, Qualys, Palo Alto Networks, Microsoft | Jira, GitHub, Slack |

Sources: [Synack pricing](https://www.synack.com/pricing/), [Synack and NetSPI notice](https://www.synack.com/netspi-and-synack/), [Cobalt pricing](https://www.cobalt.io/pricing), [Cobalt Trust Center](https://www.cobalt.io/trust-center), all checked 9 November 2026.

## What changed at Synack, and which should you choose?

NetSPI and Synack announced a merger on 2 September 2026. Synack's own notice says the merger completed on 5 October 2026. Customers keep their scope, cadence, platform access and contacts, and each company still runs its own platform, services and agreements. No unified SKU or pricing has been announced. Synack's offerings may change, so confirm the product list at quote time.

Choose Synack if:

- You want starting prices for three depth levels before you call sales: AI-led ($5,085), one human tester for one framework ($10,283) and a team test over 14 days ($27,120).
- You need a team-based test with a fixed 14-day window (Synack14), or a single-tester test aimed at a named framework such as SOC 2 or PCI DSS (SynackST).
- You are a public-sector buyer who needs the Synack platform's FedRAMP Moderate authorization. Confirm whether it covers your use.
- You can accept an unpriced platform line item, and credits that expire after one year.

Choose Cobalt if:

- You want a single published figure for a web app test now. The $3,500 Autonomous Pentest must start and finish before 31 December 2026.
- You prefer a stated start time by tier and a retest allowance that is part of the package.
- You want credentials listed on a Trust Center page: SOC 2 Type II, ISO 27001 and CREST.
- You expect to run many tests across a year, and a credit pool fits your plan. Credit use varies with your per-credit rate, which Cobalt quotes.

## Where do Synack and Cobalt differ?

Synack's figures are starting prices per test, and the scope sets the real price. SynackST at its listed price covers up to 25 unauthenticated web apps, one low-complexity authenticated web app or 100 host IPs. Synack14 covers up to 50 unauthenticated web apps, one authenticated web app or 250 host IPs. The Sara test covers external web or host. Cobalt's credits measure hours of effort, so a test costs whatever credits its scope uses at your rate. A $10,283 test and a credit package are different units.

Synack bills the platform separately. Any test needs the Synack Platform, and it has no published price. A free Basic platform tier exists with self-service launch, vulnerability management, patch verification and reports. Credits cannot pay for the subscription. Ask for the all-in first-year cost.

Synack gives the length of the test. Cobalt gives start time or time to first findings. Neither states time to the final report.

Synack includes patch verification in each product. Cobalt's table and FAQ give different retest terms. Ask both vendors for the contract clause.

Cobalt's list covers its own audits (SOC 2 Type II, ISO 27001) and a CREST accreditation. Synack's evidence is a FedRAMP authorization for the platform. These credentials come from different bodies and do not substitute for each other, so ask which your buyer or auditor requires.

Neither publishes a sample report, but Cobalt provides one on request. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) and the [pentest cost guide](/guides/penetration-testing-cost/) explain how to judge both. More providers are on the [Cobalt alternatives](/compare/cobalt-alternatives/) page.

## What should you ask both vendors?

1. What is the all-in first-year cost, including the platform line at Synack and the per-credit rate at Cobalt?
2. Which retest terms apply to my contract, and when do they end?
3. What does your turnaround number measure?
4. Which credential does my buyer or auditor accept, and where is the evidence?

Found an error? [Send a correction](/methodology/#corrections).

## Questions

### Did the Synack and NetSPI merger change Synack's pricing?

Synack's merger notice says the NetSPI deal closed on 5 October 2026 and that no unified platform, contract, pricing or partner program has been announced. Customers keep their current scope and agreements. The pricing page we read on 9 November 2026 still showed the standalone Synack prices.

### Is Synack's $5,085 test comparable to Cobalt's $3,500 test?

Only loosely. Synack's Sara Pentest covers external web or host with a 4 to 5 business day window, patch verification and a report. Cobalt's Autonomous Pentest covers a web application test with findings in 24 hours and runs only until 31 December 2026. Compare the scope documents before you compare the headline prices.

### What is the FedRAMP status on Synack's side?

Synack's merger notice says its FedRAMP Moderate authorization remains in place and applies to the Synack platform only, not to NetSPI products. Its pricing page says FedRAMP pricing is available on request. Cobalt's Trust Center lists SOC 2 Type II, ISO 27001 and CREST, and we found no FedRAMP claim there.

## Sources

- [Synack pricing](https://www.synack.com/pricing/)
- [NetSPI and Synack merger notice](https://www.synack.com/netspi-and-synack/)
- [Synack homepage](https://www.synack.com/)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Cobalt Trust Center](https://www.cobalt.io/trust-center)
- [Cobalt homepage](https://www.cobalt.io/)


---

# XBOW alternatives for autonomous and AI-assisted pentesting

Source: https://pentestcompare.com/compare/xbow-alternatives/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

XBOW alternatives grouped by need: a published price, a sample report, a human reviewer or network coverage. Facts from vendor pages checked 9 November 2026.

> **Short answer:** XBOW publishes no price or billing unit, shows no sample report, names no human reviewer and describes testing of web apps and APIs only. Its page says no human drives the attack. This page groups six alternatives from our dataset by those gaps: a published price, a sample report, a human reviewer, or network coverage. Sources were checked on 9 November 2026.

XBOW is an autonomous testing platform that runs many AI agents against web applications and APIs and validates findings with exploits. The alternatives below come from the [provider dataset](/providers/) and are grouped by the gaps a buyer may find in XBOW's pages. This page gives no ratings and names no winner. Excession Labs, the publisher of this site, appears once and is marked.

## What do XBOW's pages leave out?

This section uses XBOW's own homepage and pricing page, read on 9 November 2026.

The pricing page describes usage-based pricing that scales with coverage and gives no amount or unit, so a buyer cannot estimate a budget for one app without a quote. We noted a $50,000 AWS Marketplace package on 8 November. It was not on the page on 9 November, so we do not list it.

XBOW says no human drives the attack. It says findings are reviewed before you see them, and it does not say who reviews them. If your auditor asks for a named human reviewer or a report signed by a person, check what the auditor accepts.

The pages describe applications and APIs. They do not describe cloud, network, mobile or AI application testing. We found no sample report on the pages checked. The homepage describes retests as free and unlimited, but the pricing page does not mention retesting.

The homepage lists SOC 2, ISO 27001, ISO 42001, PCI DSS and NIS 2. It does not say whether XBOW holds these certifications or supports the frameworks, so we list no credentials for it.

XBOW does describe continuous testing of many web apps with controls for scope, rate limits and test windows. The sections below cover the gaps.

## Which alternatives publish a price or a sample report?

Hadrian lists Nova tests from EUR 1,250 per test, excluding VAT. Its AI agents run the tests and findings are described as human-reviewed, without saying who reviews them. It says most tests finish within 24 to 48 hours, and that a start on the day of order is possible. It publishes no retest terms and no sample report, and the unit "test" is not defined on the page. Its scope list names web applications only.

TurboPentest publishes prices per credit, where one credit is one pentest: $99 (Audit-Ready), $299 (Threat-Hunt) and $699 (Adversarial-Depth). The $299 tier covers up to 4 targets and the $699 tier up to 8; each extra target costs $99. A monthly plan costs $99 per month and a dedicated enterprise instance $49,990 per year. A retest is a new paid run, except for one free re-pentest per domain when a run finds no actionable findings. The report lists what automation could not test and flags business logic areas for manual follow-up. TurboPentest publishes a sample report.

Parameter runs autonomous agents that pause for customer approval before chaining or escalating. XBOW instead lets buyers set scope, impact level and test windows. Parameter publishes a [sample pentest report](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) and claims first findings in 24 hours. It publishes no price for its Single App, Rightsized and Continuous tiers, and it lists free re-testing from Single App. Its security page shows a SOC 2 Type I report, with the Type II observation period still running.

## Which alternatives use human review or cover network testing?

HackerOne sells H1 Agentic Pentest, where AI agents work under guardrails and human testers review every agent finding, and a fully human-led H1 Pentest. The agentic offer covers web apps and APIs only. HackerOne publishes no price and no sample report, but it links an interactive demo. See its [profile](/providers/hackerone/).

Terra Security describes AI agents with human pentesters supervising, and reports signed by certified pentesters (the certifications are not named). It publishes no price, retest terms or sample report. See its [profile](/providers/terra-security/).

Excession Labs (publisher of this site) is a security lab that tests web applications, APIs and multi-tenant SaaS with AI agents and checks each finding. Its AI testing agents run test tasks in parallel under tool rules Excession Labs sets for the scope, and an agent may only report a finding that links to evidence. Excession Labs agrees the scope, checks the evidence and writes the report. It offers a free pilot with a small written scope. It publishes no prices, turnaround or credentials. Its sample report covers a made-up app. See its [profile](/providers/excession-labs/).

Horizon3.ai sells NodeZero, which covers internal, external, cloud and Kubernetes pentests, plus a web application module. Its list prices are public: $15 per asset per test (Flex), $50, $65 and $85 per asset on annual subscriptions (Core, Pro, Elite) and $10,000 per app per test for WebApp Flex. An asset is a discovered server, device, cloud resource or service. The [XBOW and Horizon3 comparison](/compare/xbow-vs-horizon3/) explains how the two products differ by category. See the [profile](/providers/horizon3/).

## How do the options compare, and how do you test a shortlist?

| Provider | Delivery | Published price | Unit | Sample report | Scope named on pages |
|---|---|---|---|---|---|
| XBOW | Autonomous agents; findings reviewed | Not published | Not published | Not published | Web apps, APIs |
| Hadrian | AI agents, human-reviewed | From EUR 1,250 (excl. VAT) | per test | Not published | Web applications |
| TurboPentest | Self-service AI agents | $99 / $299 / $699 | per credit (one pentest) | Public | Web, API, network |
| Parameter | Autonomous agents with approval pauses | Not published | Not published | Public | Web apps, APIs |
| HackerOne | Human-led or agentic with human review | Not published | Not published | Not published | Agentic: web apps, APIs |
| Terra Security | AI agents, human supervision | Not published | Not published | Not published | Web, network, AI apps |
| Horizon3.ai | Autonomous software | $15 to $85; $10,000 | per asset; per app | Not published | Network, cloud, web |
| Excession Labs (publisher) | AI agents plus human evidence check | Not published | Not published | Public (made-up app) | Web, API, AI apps |

Sources: the dataset rows linked above, checked against the vendor pages under Sources on 9 November 2026. A cell marked "Not published" means the vendor's pages do not show the item. The item may still exist.

Give each provider the same small target and the same written scope. Compare what each report proves: request and response evidence, the steps to reproduce and what the test could not cover. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what to look for, and the [AI vs human pentesting guide](/guides/ai-vs-human-pentesting/) explains where each approach stops.

Found an error or a missing fact? [Send a correction](/methodology/#corrections).

## Questions

### Does XBOW publish a price?

No. On 9 November 2026 the pricing page said pricing is usage-based and scoped to your environment. It gave no amount and no billing unit, and it pointed to a quote request or a demo. It also says XBOW can be bought through AWS, Google, Oracle and Microsoft marketplaces.

### Do any alternatives have a human reviewing every finding?

HackerOne says its human testers review every agent finding in H1 Agentic Pentest, which covers web apps and APIs only. Terra Security describes human pentesters supervising its AI agents. XBOW says findings are reviewed before delivery but does not say who reviews them.

### Which alternatives are priced per test and which per asset?

Hadrian lists a starting price per test (from EUR 1,250 excluding VAT). TurboPentest lists prices per credit, where one credit is one pentest. Horizon3 prices per discovered asset, or per app for its web module. These units do not equal each other, so convert before you compare.

## Sources

- [XBOW homepage](https://xbow.com/)
- [XBOW pricing](https://xbow.com/pricing)
- [Hadrian Nova](https://hadrian.io/products/nova)
- [TurboPentest pricing](https://turbopentest.com/pricing)
- [Parameter pentesting](https://www.parameter.ai/pentesting)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [NodeZero pricing](https://horizon3.ai/use-case/pricing/)
- [NodeZero WebApp](https://horizon3.ai/nodezero/webapp/)
- [Terra Security](https://www.terra.security/)
- [Excession Labs pricing and scope (publisher of this site)](https://penetrationtestservices.com/pricing/)


---

# XBOW vs Horizon3 NodeZero

Source: https://pentestcompare.com/compare/xbow-vs-horizon3/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

XBOW vs Horizon3 NodeZero compared: an autonomous web and API agent against a network-first platform with a web module. Prices and units checked 9 Nov 2026.

> **Short answer:** XBOW and Horizon3's NodeZero are both autonomous, and they cover different ground. XBOW tests web applications and APIs with AI agents and publishes no price. NodeZero focuses on internal, external, cloud and Active Directory testing, adds a web application module, and prices per asset. The comparison uses vendor pages checked 9 November 2026.

XBOW and Horizon3's NodeZero are different categories of product. XBOW is an autonomous agent platform for web applications and APIs. NodeZero is an autonomous pentesting platform whose main focus is internal, external, cloud, Kubernetes and Active Directory testing, with a web application module added to it. Both are in the [provider dataset](/providers/), and this page uses vendor pages checked on 9 November 2026.

## How do XBOW and NodeZero compare at a glance?

| Field | XBOW | Horizon3.ai (NodeZero) |
|---|---|---|
| Delivery | Autonomous AI agents; the page says no human drives the attack and findings are reviewed before delivery (reviewer not stated) | Software that runs the attacks; no human pentesters described |
| Scope named | Web applications and APIs | Internal, external, cloud (AWS, Azure), Kubernetes, Active Directory; web applications via WebApp module; mobile not named |
| Pricing model | Usage-based, scoped to your environment | Published list prices |
| Published prices and units | None; no unit | Flex $15 per asset per test (12-month term). Core $50, Pro $65, Elite $85 per asset, annual subscription, unlimited testing. WebApp Flex $10,000 per app per test (12-month term). WebApp Continuous: custom, per app |
| Turnaround claim | First validated findings in hours; continuous or on demand | No time stated; WebApp page says tests can be set up quickly and run as often as needed |
| What turnaround measures | Time to first findings, not a full report | Not stated |
| Retest terms | Homepage: free and unlimited re-tests after a fix | Fix actions with one-click verify. Core, Pro, Elite: unlimited testing, so no extra charge. Flex: page does not say if a verify is billed as a new test |
| Sample report | Not published | Not published |
| Credentials with evidence | None found | None found |
| Integrations | CI/CD API | MCP Server |

Sources: [XBOW homepage](https://xbow.com/), [XBOW pricing](https://xbow.com/pricing), [NodeZero pricing](https://horizon3.ai/use-case/pricing/), [NodeZero WebApp](https://horizon3.ai/nodezero/webapp/), all checked 9 November 2026. XBOW's page lists SOC 2, ISO 27001, ISO 42001, PCI DSS and NIS 2 without saying whether XBOW holds them. Horizon3's page mentions PCI DSS and NIS 2 as use cases. We list neither as credentials.

## Why are these different categories, and which should you choose?

XBOW states its job as testing "your applications and APIs", with many agents working in parallel and exploits used to validate each finding. The buyer sets scope, impact level and testing window, and a command checker blocks destructive actions, per its homepage.

NodeZero started as a network and infrastructure tool. Its WebApp page describes a module of the broader platform, next to internal, external, cloud and Kubernetes testing. The workflow it describes is crawl with a headless browser, authenticate, attack, prove and repeat, and reports link web weaknesses to attack chains that reach identity and infrastructure. The page does not explain how the two parts integrate technically.

XBOW is built for application-layer coverage across a portfolio of apps. NodeZero is built for the attack path across an environment. If you own only web apps, both may apply. If you own servers, cloud accounts and Active Directory, only NodeZero's pages describe that work.

Choose XBOW if:

- Your assets are web applications and APIs, and you have many of them. The homepage says scope can range from a single application to thousands.
- You want to set scope, rate limits, protected URLs and testing windows yourself and pause at any time.
- You want free and unlimited re-tests as stated on the homepage. The pricing page does not mention retests, so ask for them in writing.
- You accept a price that comes only from a quote, with no billing unit named on the page.

Choose Horizon3 NodeZero if:

- You need internal, external, cloud, Kubernetes or Active Directory testing, or want application testing in the same platform.
- You prefer a published price list. You can estimate a budget once you count your assets.
- You want to run tests often. Core, Pro and Elite are priced as unlimited testing per asset for 12 months.
- You can accept that the unit is a discovered asset (a server, device, cloud resource or service), which you may not know in advance. The page says a machine found under several names counts as one asset.

## Where do XBOW and NodeZero differ?

A per-asset price ($15 to $85) and a per-app price ($10,000 for WebApp Flex) measure different things, and XBOW publishes neither. Public pages give no basis to compare costs.

Support tiers add cost at Horizon3: Enhanced is 10% of the subscription with a $7,500 yearly minimum, and Premier is 20% with a $25,000 yearly minimum, per the NodeZero pricing page.

Neither vendor describes much human involvement. XBOW says findings are reviewed before you see them and does not say by whom. Horizon3's WebApp page describes practitioners reviewing the evidence and says MFA login may pause for a person. Neither offers a signed report from a named tester on the pages checked. If an auditor needs one, read the [AI vs human pentesting guide](/guides/ai-vs-human-pentesting/).

Neither publishes a sample report, so you can judge the output only in a trial or demo. Horizon3's WebApp page reports fewer than 10% false positives across about 380 vulnerabilities in early testing. That is a vendor claim on one test set.

Get a trial scope in writing from both vendors, with the same target, and compare what each report proves. The [automated pentesting tools guide](/guides/automated-pentesting-tools/) explains where automated tools stop, and [XBOW alternatives](/compare/xbow-alternatives/) lists other providers.

Found an error? [Send a correction](/methodology/#corrections).

## Questions

### Can I replace one with the other?

Only partly. XBOW's pages describe web applications and APIs. NodeZero's pages describe internal, external, cloud and Kubernetes testing, plus a web application module sold per app. If you need both network and application coverage, check each vendor's current scope in writing.

### Which one lets me estimate a budget?

NodeZero, once you count assets. It lists $15 per asset per test, $50 to $85 per asset per year, and $10,000 per app per test for WebApp Flex. XBOW publishes no amount or unit. Neither figure gives a total without your asset or app count.

### Does either vendor publish a false positive rate?

Horizon3's WebApp page says fewer than 10% false positives across about 380 vulnerabilities in early testing, compared against a skilled manual pentester. That is a vendor claim on one test set. XBOW's pages checked give no false positive figure.

## Sources

- [XBOW homepage](https://xbow.com/)
- [XBOW pricing](https://xbow.com/pricing)
- [NodeZero pricing](https://horizon3.ai/use-case/pricing/)
- [NodeZero WebApp](https://horizon3.ai/nodezero/webapp/)
- [Horizon3.ai homepage](https://www.horizon3.ai/)


---

# Talk to Excession Labs, the publisher

Source: https://pentestcompare.com/contact/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Contact Excession Labs, the publisher of PentestCompare, about your own penetration test. This form does not reach the other providers in the table.

PentestCompare is published by Excession Labs, which also sells penetration testing. Use this form to talk to Excession Labs about your own test. It does not match you with providers, and it does not reach the other providers in the table. To contact them, use the website links on their [profiles](/providers/).

[Use the form on this page](https://pentestcompare.com/contact/)

To report an error in the data, use the [correction form](/methodology/#corrections) instead. Excession Labs' service sites: [penetrationtestservices.com](https://penetrationtestservices.com/) (web, API and SaaS pentesting), [aipentestservices.com](https://aipentestservices.com/) (AI-assisted pentesting) and [airedteamingservices.com](https://airedteamingservices.com/) (testing AI applications).


---

# Developers and AI agents

Source: https://pentestcompare.com/developers/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Machine-readable access to pentestcompare.com: OpenAPI description, API catalog, Markdown versions of every page, llms.txt and the rules for AI agents.

Everything on pentestcompare.com is public and readable by software. Reading needs no account and no key.

| What | Where |
|---|---|
| API description (OpenAPI 3.1) | [/openapi.json](/openapi.json) |
| API catalog (RFC 9727) | [/.well-known/api-catalog](/.well-known/api-catalog) |
| Rules for AI agents | [/auth.md](/auth.md) |
| Site index for language models | [/llms.txt](/llms.txt), full text in [/llms-full.txt](/llms-full.txt) |
| Markdown version of any page | add `index.md` to the page URL, or send `Accept: text/markdown` |
| Sitemap and feed | [/sitemap.xml](/sitemap.xml), [/feed.xml](/feed.xml) |
| Service status | [/api/health](/api/health) |

## Provider dataset

`GET /data/providers.json` returns every provider in the comparison with its scope, delivery model, published prices and their units, turnaround and retest claims, sample report status, credentials with evidence links, sources and the date each provider was checked. `GET /data/providers.csv` returns the main fields as CSV. Both are free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/): credit PentestCompare and link to the provider's profile. Unknown values are `Not published`, never zero or an estimate. [How we collect and check the data](/methodology/).

```bash
curl -s https://pentestcompare.com/data/providers.json | jq '.providers[] | {name, delivery, pricing_model}'
```

## Sending an enquiry

`POST /api/enquiry` stores an enquiry and notifies Excession Labs. It needs a Cloudflare Turnstile token, which only a person completing the form on the site can produce. An agent helping someone get in touch should give them [the form](/contact/) or the address [support@excessionlabs.ai](mailto:support@excessionlabs.ai). The field list for each form is in the OpenAPI description.

## Fair use

Read and cite freely. Keep request rates reasonable; the enquiry endpoint is rate limited. Do not try to bypass the human verification. Questions: [support@excessionlabs.ai](mailto:support@excessionlabs.ai).


---

# Pentest glossary: 60+ terms buyers meet

Source: https://pentestcompare.com/glossary/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

A pentest glossary with 60+ terms from scope and severity to BOLA, PTaaS and prompt injection, each in one to three plain sentences with links to deeper guides.

These terms come up when you buy a penetration test, in alphabetical order. Where a standard or vendor defines a term, the entry says so. The [buyer guides](/guides/) cover the buying process, and the [provider table](/providers/) compares providers.

### API penetration testing
A pentest of an application programming interface: its endpoints, authentication, authorization and rate limits. Testers often work from an OpenAPI file or a Postman collection. OWASP keeps a separate API Security Top 10 (2023 edition).

### Approved Scanning Vendor (ASV)
A company approved by PCI SSC to run the external vulnerability scans PCI DSS asks for every three months. An ASV scan is a vulnerability scan and does not count as a pentest. See [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/).

### Attack surface
The set of points where an attacker can send input or reach a system: domains, IP addresses, APIs, login pages, file uploads and exposed cloud storage. A larger surface needs a larger scope.

### Attestation letter
A short letter from a provider that says a test took place and states its date and scope. No standard defines the letter, and acceptance by auditors or customers varies. The service-site guide on [pentest attestation letters](https://penetrationtestservices.com/guides/pentest-attestation-letter/) covers what one should contain.

### Authenticated testing
Testing while signed in as one or more users. It reaches features behind a login and lets testers compare what each role can see. Authorization flaws usually appear only in authenticated tests.

### Authorization (written permission)
The system owner's written consent to a test, with scope and dates. Without it, a test can break the law. Providers should ask for it before any testing. Not to be confused with the access-control sense below.

### Authorization testing
Checking that each user can reach only what their role allows. It covers horizontal access (another user's data) and vertical access (admin functions). OWASP groups these flaws under broken access control and, for APIs, BOLA and BFLA.

### Black-box testing
Testing with no inside information, as an outside attacker would start. The tester gets a URL and perhaps nothing else. See the [black box, grey box and white box guide](https://penetrationtestservices.com/guides/black-box-grey-box-white-box-testing/).

### Bug bounty
A program that pays researchers for valid vulnerability reports, with no fixed end date unless the program sets one. It differs from a pentest in payment, tester count and report. See [bug bounty vs pentest](/guides/bug-bounty-vs-pentest/).

### Broken access control
A class of flaw where users can act outside their permissions. It covers IDOR, missing function-level checks and privilege escalation. Penetration tests prove it by repeating a request with another account.

### Broken Object Level Authorization (BOLA)
OWASP API1:2023. An API flaw where changing an object ID in a request returns or changes another user's object. The web term for the same pattern is IDOR. See [IDOR testing](https://penetrationtestservices.com/guides/idor-testing/).

### Business logic flaw
A flaw in how an application's rules work, such as skipping a payment step or reusing a coupon. Scanners rarely find these because they do not know your rules. OWASP's testing guide has a business logic section (WSTG-BUSL). See [business logic vulnerabilities](https://penetrationtestservices.com/guides/business-logic-vulnerabilities/).

### Control (test control)
A request that should fail, run next to an exploit attempt: a nonexistent ID, another account's token or an anonymous call. When the control fails as expected, the finding is more credible. Reports can list controls that held.

### CREST
A professional body that accredits penetration testing companies and certifies individuals. Check what a provider's badge covers (a company or a person) and look it up on the body's public register.

### CSRF (cross-site request forgery)
An attack that, in the words of OWASP's testing guide, "forces an end user to execute unintended actions on a web application in which they are currently authenticated". See [CSRF testing](https://penetrationtestservices.com/guides/csrf-testing/).

### CVSS (Common Vulnerability Scoring System)
A scoring system maintained by FIRST. CVSS v4.0, released 1 November 2023, rates scores as Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). Use of these ratings is optional.

### DAST (dynamic application security testing)
Automated testing of a running application from outside, by sending requests and reading responses. It is scanner technology. Some newer tools add AI to follow user flows. See [automated pentesting tools](/guides/automated-pentesting-tools/).

### Differential testing
Comparing what two callers receive for the same request, such as an anonymous user and a signed-in user, or two accounts of different roles. It is a main method for finding access-control flaws.

### Evidence
What proves a finding: the request, the response and the observed effect. A write is proven when another session reads the changed record back. A bare "success" message is not proof.

### Exploit
Code, a request or a technique that takes advantage of a vulnerability. In a pentest, testers use the least harmful exploit that proves impact.

### External penetration test
A test from outside the network, against what the internet can reach. PCI DSS v4.0.x asks for internal and external pentests at least every 12 months and after significant change.

### False positive
A reported issue that is not a real vulnerability. Scanners produce many. Manual review or exploit validation removes them.

### Finding
One reported issue, with a title, severity, description, evidence, reproduction steps and a fix. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what a good finding includes.

### Grey-box testing
Testing with partial inside knowledge, such as test accounts and API docs. It suits web apps because it reaches signed-in features.

### IDOR (insecure direct object reference)
A flaw where an application gives access to an object based on a user-supplied value such as an ID, without checking ownership. OWASP's testing guide ID is WSTG-ATHZ-04. See [IDOR testing](https://penetrationtestservices.com/guides/idor-testing/).

### Impact
What an attacker gains from a flaw: data exposed, actions taken, money lost. A good report states impact from the evidence, not from the vulnerability class alone.

### Internal penetration test
A test from inside the network, as a malicious insider or an attacker who already has a foothold would. It is a separate test from an external one.

### Jailbreak
An attack that tries to get an AI model to ignore its safety rules. OWASP's LLM01:2025 treats it as a form of prompt injection, while MITRE ATLAS lists the two as separate techniques. See [jailbreak vs prompt injection](https://airedteamingservices.com/guides/jailbreak-vs-prompt-injection/).

### Mass assignment
A flaw where an API lets a user set fields they should not, for example by adding an `is_admin` field to a request. OWASP API3:2023 covers it under broken object property level authorization.

### Model Context Protocol (MCP)
An open protocol that lets AI applications call external tools and data sources. Its servers and clients are a new surface to test. See [MCP security risks](https://airedteamingservices.com/guides/mcp-security-risks/).

### Multi-tenant
A system where one deployment serves many customers (tenants). The core test is that tenant A can never read or change tenant B's data. See [multi-tenant isolation testing](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/).

### NIST SP 800-115
A NIST guide to security testing and assessment, published September 2008 and still listed as final. It is old. Do not describe it as a current NIST requirement.

### OWASP ASVS
The OWASP Application Security Verification Standard, a list of security requirements for web apps. Version 5.0.0 was published on 30 May 2025.

### OWASP API Security Top 10
OWASP's list of the most critical API risks. The 2023 edition has API1 Broken Object Level Authorization through API10. See the [API Security Top 10 guide](https://penetrationtestservices.com/guides/owasp-api-security-top-10/).

### OWASP Top 10
OWASP's awareness list of the most critical web application risks. See the [OWASP Top 10 guide](https://penetrationtestservices.com/guides/owasp-top-10-2025/).

### OWASP Web Security Testing Guide (WSTG)
OWASP's guide to testing web apps, with test IDs such as WSTG-ATHZ-04. The stable release is v4.2, and v5.0 is in development.

### Out of scope
Assets or actions the provider must not test, written into the scope. Examples are third-party services, production data and denial-of-service tests.

### Penetration test (pentest)
A test where evaluators, in NIST's wording, "attempt to circumvent or defeat the security features of a system", usually within defined limits. It ends in a report of proven findings. See [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/).

### Prompt injection
An attack on an LLM application where untrusted text changes what the model does. It is direct when the user types it and indirect when it arrives in content the model reads. See [prompt injection](https://airedteamingservices.com/guides/prompt-injection/).

### Proof of concept (PoC)
A minimal example that shows a flaw can be exploited. Reports often include a PoC request or script that is safe to run only with authorization.

### PTaaS (penetration testing as a service)
A delivery model that uses an online platform for scoping, live findings and retests, often on a subscription or credit model. See [PTaaS vs traditional pentesting](/guides/ptaas-vs-traditional-pentesting/).

### PTES
The Penetration Testing Execution Standard, a community methodology. Its pages were last edited in 2014, so describe it as dated.

### QSA (Qualified Security Assessor)
A person certified by PCI SSC to assess PCI DSS compliance. Your QSA decides which requirements apply to you and what evidence they accept.

### RAG (retrieval-augmented generation)
A design where an LLM answers using documents fetched from a data store. The main test is that retrieval respects each user's access rights. See [RAG security](https://airedteamingservices.com/guides/rag-security/).

### Red team
A group that simulates a real adversary against people, process and technology over a longer period than a pentest, with a goal such as reaching a crown-jewel system. See [red team vs penetration testing](https://penetrationtestservices.com/guides/red-team-vs-penetration-testing/). For AI systems, see [what AI red teaming is](https://airedteamingservices.com/guides/what-is-ai-red-teaming/).

### Remediation
Fixing a finding. A report's remediation advice should name the layer, the check and a way to confirm the fix. See [after the pentest](https://penetrationtestservices.com/guides/after-the-pentest-remediation-and-retest/).

### Retest
A repeat test of a fixed finding to confirm that the fix works. PCI DSS v4.0.x requires exploitable findings to be corrected and the testing repeated. Retest terms differ by provider. See [retesting](https://penetrationtestservices.com/retesting/).

### Rules of engagement
The written agreement on how a test runs: authorization, scope, test windows, contacts, off-limits actions and stop conditions. See [rules of engagement](https://penetrationtestservices.com/guides/penetration-testing-rules-of-engagement/).

### SAST (static application security testing)
Automated analysis of source code without running it. It finds code patterns, not whether the running app can be exploited.

### Scope
The list of assets, environments, roles and test types in a contract. It decides price and what stays untested. Use the [scoping checklist](/tools/scoping-checklist/).

### Segmentation testing
A PCI DSS test that checks segmentation controls isolate the cardholder data environment. PCI DSS asks for it at least every 12 months where segmentation is used, and every six months for service providers.

### Severity
A rating of how serious a finding is, such as Critical, High, Medium or Low. Reports should define each level or state a CVSS version.

### SOC 2
An AICPA reporting framework on service-organization controls. Its Trust Services Criteria do not explicitly require a penetration test, though auditors and customers often ask for one. See [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/).

### Social engineering
Tricking people into giving access or information, for example by phishing. A standard web app pentest does not include it unless the scope says so.

### SSRF (server-side request forgery)
A flaw where an attacker can make a server fetch a URL of the attacker's choice, which can reach internal resources. It is API7:2023 in the OWASP API list.

### Stored XSS
Cross-site scripting where the injected script is stored on the server, such as in a comment field, and runs for each visitor. OWASP files XSS under Injection in the Top 10:2025.

### Tenant isolation
The property that one customer cannot reach another customer's data in a shared system. Testers check it with accounts in two tenants. See [multi-tenant isolation testing](https://penetrationtestservices.com/guides/multi-tenant-isolation-testing/).

### Threat model
A structured list of what you protect, who might attack it and how. AI red teams use one to choose tests. A pentest scope often starts from a light version.

### Vulnerability assessment
In NIST's glossary, a "systematic examination of an information system or product to determine the adequacy of security measures". Vendors often use the term for scanner-led work.

### Vulnerability scan
An automated check of systems against known weaknesses. PCI DSS v4.0.x covers scans in requirement 11.3 and pentests in 11.4. See the [PCI penetration testing requirements](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/).

### White-box testing
Testing with full inside knowledge: source code, architecture and credentials. Testers see more than in black-box testing, but you must share code.


---

# AI penetration testing services compared: 16 providers, sourced

Source: https://pentestcompare.com/guides/ai-penetration-testing-services/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

AI penetration testing services compared: delivery model, scope, published prices with units, turnaround claims, retest terms and sample reports for 16 providers.

> **Short answer:** We compared 16 AI-assisted and autonomous pentest services from vendor pages checked on 9 November 2026. Nine publish a price with a unit, and the units differ: per test, per asset, per credit or per month. Four publish a sample report. Turnaround claims measure different things, such as start time, test window or time to first findings. The list is alphabetical, not ranked.

AI penetration testing services are pentests where AI agents do some or all of the testing. This page compares 16 of them, plus the publisher of this site, using each vendor's own pages checked on 9 November 2026. The list is alphabetical and nothing is ranked.

> **Ownership:** PentestCompare is published by Excession Labs, which sells security testing and appears below as "(publisher of this site)". We write its entry from the same fields as the others and do not place it first.
The phrase "AI penetration testing" also covers services that test AI applications. That is a separate topic, covered in [AI red teaming companies](/guides/ai-red-teaming-providers/). Here, AI is the tester.

## Delivery models and what they mean for you

Providers in this comparison fall into three delivery models, taken from each vendor's own description.

| Model | Who does the testing | Providers on this page |
|---|---|---|
| Automated | AI agents or software run the test; a human may approve steps | Aikido, Escape, Horizon3.ai, Intruder, Novee, Parameter, Penligent, TurboPentest, XBOW |
| Hybrid | AI agents and human testers share the work | BreachLock, Cobalt, HackerOne, Hadrian, Penti, Synack, Terra Security, Excession Labs |

Three providers sit between the labels. Hadrian says findings are human-reviewed but not who reviews them. Penligent is desktop software you operate yourself, with a manual mode. Penti sells AI credits and a separate pool of expert hours.

## At a glance

Prices are the vendor's published figures. A dash means the pages checked list no price. Units differ, so do not rank by amount.

| Provider | Delivery | Published price and unit | Sample report |
|---|---|---|---|
| Aikido | Automated | $4,000 per assessment; $50 to $30,000+ per assessment, scoped | Page links to samples; web/API not among them |
| BreachLock | Hybrid | None | On request |
| Cobalt | Hybrid | $3,500 per autonomous test (offer ends 31 Dec 2026) | On request |
| Escape | Automated | None | Not published |
| Excession Labs (publisher of this site) | Hybrid | None | Public example report |
| HackerOne | Hybrid | None | Not published |
| Hadrian | Hybrid | From EUR 1,250 per test, excluding VAT | Not published |
| Horizon3.ai (NodeZero) | Automated | From $15 per asset per test; $10,000 per app per test | Not published |
| Intruder | Automated | $3,500 per test; $4,000 on the product page | Not published |
| Novee | Automated | None | Not published |
| Parameter | Automated | None | Public PDF |
| Penligent | Automated | $99.9 per month (Pro) | Synthetic sample, free account needed |
| Penti | Hybrid | $20 to $2,000 per month; expert hours from $4,000 per 15 hours | Not published |
| Synack | Hybrid | From $5,085 per test | Not published |
| Terra Security | Hybrid | None | Not published |
| TurboPentest | Automated | $99 to $699 per credit (one pentest) | Public |
| XBOW | Automated | None | Not published |

## Provider by provider

Each entry gives the delivery model, scope, price, the turnaround claim and what it measures, the retest terms and a limit. "Good fit when" is our reading of the vendor's pages, not a recommendation.

### Aikido

AI agents map, attack and verify. A human-led CREST pentest is available on request. Scope covers web apps, APIs, network, mobile and AI apps. The typical pentest costs $4,000 per assessment for one application plus primary APIs, whitebox, and the pricing page says black-box and grey-box cost extra. The turnaround claim is results on the day of the run, which measures an automated run; the AI pentest page also says a few hours and, in one place, days. Retesting is free for up to 6 months. Limit: the Rightsized range is very wide, so the real price is known only after scoping. Good fit when you want a low-cost, fast automated test for audit evidence.

### BreachLock

Human-led PTaaS from an in-house team described as expert-led and AI-accelerated, plus a separate autonomous product (Breach360). The pricing page lists Standard, Extended and Extensive tiers with no dollar figures. Tests can be scoped and started within 24 to 48 hours, which is time to start, not report time. Free manual retests are 1, 2 and custom by tier, while the product text promises unlimited retesting. Limit: no sample report is published, and the two retest statements differ. Good fit when you want a human team and a stated retest count per tier.

### Cobalt

Vetted freelance pentesters from the Cobalt Core, AI agents and a separate autonomous pentest option. The autonomous web application test costs $3,500 per test as a limited-time offer that must start and finish before 31 December 2026, with findings in 24 hours. That clock measures time to first findings. Annual tiers start within 1 to 3 business days and have no published price. Retests are free for 6 or 12 months by tier, though the FAQ says unlimited during the contract term. Limit: human-led pricing needs a quote. Good fit when you want human pentesters on a platform with in-platform retesting.

### Escape

An application security platform where AI runs the pentest, with the vendor describing no human in the loop. Scope covers web apps, APIs, network and AI apps. Results arrive in minutes after a merge, deploy or schedule, which is run time for an automated test. Open issues are re-checked. Limit: no price, no units, no sample report, and the vendor says it does not test internal network lateral movement. Good fit when you want pentest-style testing on every release next to DAST.

### Excession Labs (publisher of this site)

The lab's AI testing agents run testing tasks under tool rules. Excession Labs agrees the scope in writing, checks the evidence for each finding and writes the report. It covers web applications, APIs, multi-tenant SaaS and AI applications. It publishes no prices and no turnaround. It offers retests of fixed findings and a free pentest pilot with a small written scope. A [public sample report](https://penetrationtestservices.com/sample-report/) is an example built for a made-up app, not a customer report. Good fit when you want to judge the lab through a scoped pilot first.

### Hadrian

A fleet of AI agents runs the Nova tests. Findings are described as human-reviewed, but the page does not say who reviews them. Scope lists web applications. Nova starts at EUR 1,250 per test, excluding VAT, and the page does not define what one test covers. Most tests finish within 24 to 48 hours, which measures test duration after start. Retest terms are not published. Limit: no sample report, and no API, cloud or mobile scope listed. Good fit when you want a published starting price for a quick test before a launch.

### HackerOne

H1 Pentest is fully human-led. H1 Agentic Pentest pairs AI agents with human pentesters who review every agent finding. The agentic tier covers web apps and APIs. All pricing routes to sales. The product page gives no start time. HackerOne docs list the final report 3 to 5 business days after testing ends. Docs say retests are unlimited during the remediation period, typically 30 or 90 days, though older posts describe other terms. Limit: no price or sample report. Good fit when you already use HackerOne for bug bounty or disclosure.

### Horizon3.ai (NodeZero)

NodeZero is software that runs the attacks itself, and the pages checked describe no human pentesters. Flex is $15 per asset per test on a 12-month term. Core, Pro and Elite are annual subscriptions at $50, $65 and $85 per asset. WebApp Flex is $10,000 per app per test, and the page does not define the scope of one test. No turnaround is published. Limit: costs scale with asset count, which makes comparison with per-test prices hard. Good fit when you can count your assets and want internal, external and cloud tests often.

### Intruder

AI Pentesting uses autonomous agents that work from your source code and check each finding against the live app. Scope is web apps. The pricing page shows $3,500 per test with unlimited retesting, and a 4-pack at $12,000 to use within one year. The product page says $4,000 standalone, so two Intruder pages disagree. Setup takes minutes and results arrive within hours, which measures launch to report for one test. Limit: no sample report, and no human review is described. Good fit when you can share source code and want a per-test price.

### Novee

AI built on Novee's own offensive security model plus frontier models, with test plans you can review before execution. Scope covers web apps, APIs, mobile backends and AI apps. Retests run automatically after fixes and on new deployments. No prices, turnaround or sample report are listed, and the pricing page returned 404 on 9 November 2026. Good fit when you want continuous AI testing with SaaS, bastion node or on-premises deployment.

### Parameter

Autonomous AI agents run the pentest and pause for the customer's approval before chaining or escalating. Scope is web apps and APIs. It publishes three tiers with no amounts. First findings arrive in 24 hours and most runs finish on the day they start, which measures start to first findings. Free retesting is listed for Single App and inherited by higher tiers. A [sample pentest report](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) is public. Limit: no prices, and its SOC 2 report is Type I only. Good fit when you want to read a sample before you talk to sales.

### Penligent

Desktop software for Windows, macOS and Linux that you operate, with an agent mode and a manual mode. The page describes no managed human testers. Free costs $0 per month with one trial task, and Pro costs $99.9 per month for 13,000 credits. The homepage tagline says an hour replaces a week, a marketing claim with no timeline. Pro includes re-runs and re-scans. The 19-page sample report uses synthetic data and needs a free account. Limit: you own the judgment on findings. Good fit when you are a consultant who wants to run AI-assisted tests yourself.

### Penti

Autonomous AI agents run the exploits. A certified pentester can verify findings: 3 per year on Plus, 6 on Advanced, and a paid add-on on Launch. Monthly plans run $20, $300, $1,000 and $2,000 in credits, and expert hours cost $4,000 per 15 hours. Every plan includes unlimited retests. No per-plan turnaround is stated. Limit: credit cost per test is approximate, so a full web app test is hard to price, and no downloadable sample exists. Good fit when you want monthly pricing and an option to buy human hours.

### Synack

Sara, an autonomous AI agent, works with the Synack Red Team of vetted researchers. Sara Pentest starts at $5,085 per test, external web or host only. SynackST starts at $10,283 and Synack14 at $27,120. The turnaround figures are test windows: 4 to 5 business days, 5 days and 14 days. Patch verification is included in each product. Limit: the required platform subscription has no published price, and Synack and NetSPI announced a merger on 2 September 2026, so offerings may change. Good fit when you want several depth levels with starting prices.

### Terra Security

AI agents run the tests with human pentesters supervising, and certified pentesters sign the reports. Scope covers web apps, network and AI apps. The vendor says tests drop from 4 to 6 weeks to 2 to 4 hours. That is a marketing comparison, not a service level. No pricing page, retest terms or sample report are published. Good fit when you want continuous testing with a human on the loop.

### TurboPentest

Self-service AI agents run the pentest. The page does not say humans validate findings. Audit-Ready is $99 per credit for one target, Threat-Hunt $299 for up to four, and Adversarial-Depth $699 for up to eight. Tests typically complete in a few hours. A retest is a new paid run, with a free re-pentest only if the first run has zero actionable findings. A [sample report](https://turbopentest.com/sample-report) is public. Limit: business logic areas are flagged for manual follow-up. Good fit when you need a low-cost external web and API test and accept automation only.

### XBOW

The vendor says no human drives the attack. Autonomous agents test and findings are reviewed before delivery, though who reviews is not stated. Scope is web apps and APIs. Pricing is usage-based with no unit or amount published. First validated findings arrive in hours, which is time to first findings, not a full report. Retests are described as free and unlimited. Limit: no price or sample report. Good fit when you run many web apps and want continuous testing with scope controls.

## How we compared these services

We read each vendor's pricing page and AI pentest page on 9 November 2026 and recorded the figures in our [open dataset](/providers/). We record a price only when a page shows an amount and a unit. A turnaround claim is kept together with what it measures. We did not run any of these services, so we make no claim about test quality. Outpost24 was checked, but its pages returned HTTP 403, so we left it out of this comparison. Services that use human testers only are not included. Vendor facts can change; use the [correction form](/contact/) if you see an error.

## What should you check before you buy?

Start with what you are buying: a one-off test, a credit pool or a subscription. Then ask four things.

1. What does one test cover? Hadrian and Horizon3.ai both publish a price but do not define the scope of one test.
2. What does the turnaround clock measure? Use the [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).
3. Is a retest free, and for how long? TurboPentest charges for a new run, Intruder offers unlimited retests, and Aikido offers 6 months.
4. Can you read a sample report? Judge it with the [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/).

For tools you run yourself, see the [automated pentesting tools guide](/guides/automated-pentesting-tools/). For the human side of the question, see [AI vs human pentesting](/guides/ai-vs-human-pentesting/).

## Provider cards

We show the four providers with a public sample report, so you can read before you contact anyone.

## Questions

### Which AI penetration testing service is cheapest?

The published prices use different units, so a ranking by price would mislead. TurboPentest lists $99 per credit for one pentest, Horizon3.ai lists $15 per asset per test, and Intruder lists $3,500 per test. These cover different scopes. Compare the covers column and the limits on each vendor's page before you compare amounts.

### What does a turnaround claim of 24 hours mean?

It depends on the vendor. Cobalt's 24 hours is time to findings for its autonomous test. Hadrian's 24 to 48 hours is test duration after start. BreachLock's 24 to 48 hours is time to scope and start. None of these is a report delivery date. Ask which event the clock starts and stops on.

### Does an AI pentest report satisfy an auditor?

Ask your auditor. We found no vendor page that proves acceptance by an auditor. TurboPentest says its signed letter is for questionnaires and common audits, and Penligent says its reports are supporting evidence, not a SOC 2 examination report or ISO 27001 certificate.

### Do AI pentest services include a human?

Some do and some do not. HackerOne says humans review every agent finding. Intruder says a human in the loop is not needed for web app pentesting. Hadrian says findings are human-reviewed but not by whom. Read the delivery note under each provider below.

## Sources

- [Aikido pricing](https://www.aikido.dev/pricing)
- [BreachLock pentest pricing](https://www.breachlock.com/pricing/penetration-testing-pricing/)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Escape AI pentesting](https://escape.tech/product/ai-pentesting)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Hadrian pricing](https://hadrian.io/pricing)
- [Horizon3.ai NodeZero pricing](https://horizon3.ai/use-case/pricing/)
- [Intruder pentest pricing](https://www.intruder.io/pentest-pricing)
- [Intruder AI Pentesting](https://www.intruder.io/platform/ai-pentesting)
- [Novee homepage](https://novee.security/)
- [Parameter pentesting](https://www.parameter.ai/pentesting)
- [Parameter sample pentest report (PDF)](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf)
- [Penligent pricing](https://www.penligent.ai/pricing)
- [Penti pricing](https://penti.ai/pricing)
- [Synack pricing](https://www.synack.com/pricing/)
- [Terra Security homepage](https://www.terra.security/)
- [TurboPentest pricing](https://turbopentest.com/pricing)
- [TurboPentest sample report](https://turbopentest.com/sample-report)
- [XBOW pricing](https://xbow.com/pricing)
- [Excession Labs sample report (example)](https://penetrationtestservices.com/sample-report/)


---

# AI red teaming companies: who tests LLM apps and agents

Source: https://pentestcompare.com/guides/ai-red-teaming-providers/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

AI red teaming companies that test LLM apps and agents: twelve dataset providers, the publisher and two AI-security specialists, with scope, method and sources, Nov 2026.

> **Short answer:** Providers that test LLM apps and agents include pentest platforms and consultancies, AI-security specialists and the publisher of this site. Twelve of the 20 providers in our dataset state AI application testing, and each entry below cites its own page. Scope, human involvement and report format differ. No provider here is ranked.

AI red teaming companies test LLM apps, agents and the systems around them for flaws such as prompt injection, data leakage and misuse of tools. We checked twelve providers from our [dataset](/providers/) that state AI application testing, the publisher of this site and two AI-security specialists on 9 November 2026. Each entry cites the provider's own page. We do not rank them.

> **Ownership:** PentestCompare is published by Excession Labs, a security lab that sells security testing. It appears in the table as the publisher, with the same fields as the others and no ranking.
It tests the whole AI feature, the model and everything around it. NIST AI 600-1 defines AI red teaming as "a structured testing exercise used to probe an AI system to find flaws and vulnerabilities such as inaccurate, harmful, or discriminatory outputs, often in a controlled environment and in collaboration with system developers."

OWASP's GenAI Red Teaming Guide (January 2025) names four areas: model evaluation, implementation testing, infrastructure assessment and runtime behavior analysis. Pentest vendors on this page focus on the implementation and runtime areas, such as retrieval permissions, tool use and output handling. Read each page for the scope it states.

## What does an AI red team engagement test, and which providers test AI applications?

The dataset field `scope.ai_apps` is "yes" for twelve of the 20 providers. We checked each provider's own AI page. The table is alphabetical, with the publisher last.

| Provider | What its page says about AI testing | Human role stated | Engagement shape |
|---|---|---|---|
| [Aikido](/providers/aikido/) | An Agent/MCP pentest type for "MCPs, chats, RAG, tools, memory, or other LLM features"; prompt injection appears in the tested vectors | AI agents run the test; human-led CREST pentest on request | Fixed or scoped price per assessment |
| [Cobalt](/providers/cobalt/) | An AI and LLM pentest in three tiers: prompt injection, isolated LLM, RAG-enabled LLM. Covers attack-surface mapping, behavioral probing, exploitation and retrieval testing | Humans lead; automation handles groundwork | Part of the Cobalt platform; findings are live |
| [Escape](/providers/escape/) | AI red teaming inside its AI pentesting product, live from 21 October 2026. Tests chatbots and MCP servers, with multi-turn jailbreaking and impact checks | Described as AI-run | Runs in the same pentest as the web app |
| [HackerOne](/providers/hackerone/) | H1 AI Red Teaming (AIRT): objective-based, scoped adversarial testing of AI models and systems | Researchers from a community the docs size at over a thousand AI-focused researchers, plus a Solutions Architect | A 15- or 30-day project, about a week of scoping and a week of reporting |
| [JUMPSEC](/providers/jumpsec/) | An AI penetration testing page for AI applications, chatbots and LLM integrations. It does not say whether tools or AI automate any of the testing | Human-led consultancy; the page names experts | Quote-based; no price, turnaround, retest terms or sample report published |
| [Novee](/providers/novee/) | AI testing of web, mobile backends, APIs and AI agents, built on its own offensive security model plus frontier models | AI-run; test plans can be reviewed before execution; human review not stated | Continuous; no prices or sample report published |
| [Outpost24](/providers/outpost24/) | An AI and LLM penetration testing service described as human-led by certified experts. It excludes the model provider's infrastructure, training data review and model weights | Certified human testers | No prices or sample report found. Its pages returned HTTP 403 to us, so these facts come from search results |
| [Pen Test Partners](/providers/pen-test-partners/) | Tests "the AI implementation, the surrounding application, the data it can access, the actions it can perform": prompt injection, RAG permissions, agent tool misuse, output handling | Manual techniques, structured test cases, tooling where appropriate | Standalone or an extension to an existing pentest |
| [Penti](/providers/penti/) | AI agents test external, application, internal and identity layers, including AI apps. Every plan includes free unlimited retests | AI agents run the exploits; human-verified findings on higher plans; expert hours sold separately | Monthly credit plans from $20 to $2,000 per month; expert hours from $4,000 per 15 hours; no downloadable sample report |
| [Synack](/providers/synack/) | AI and LLM pentesting with results that follow the OWASP AI/LLM Top 10: prompt injection, model theft, training data poisoning, insecure plugin design | Vetted Synack Red Team researchers | PTaaS, with findings in real time |
| [Terra Security](/providers/terra-security/) | An AI Red Teaming product to "test AI applications, Copilots, LLMs, MCPs, and agent behavior" | AI agents with human oversight, per our dataset | The homepage gives no method detail |
| [TurboPentest](/providers/turbopentest/) | OWASP LLM Top 10 coverage "for AI agents, prompt injection, and model-specific attack surface"; the page does not use the term AI red teaming | Self-service AI agents; humans not stated | Credit-based tests |
| [Excession Labs](/providers/excession-labs/), the publisher | Assesses LLM applications and AI agents; see [airedteamingservices.com](https://airedteamingservices.com/) | Excession Labs scopes the work, checks the evidence for each finding and writes the report | Scoped assessments; no prices published |

Excession Labs publishes PentestCompare. It appears here as one entry with the same fields as the others. We do not claim past AI red team engagements for it, because we have no verified delivery history to cite.

The other eight providers do not state AI application testing on the pages we checked: BreachLock, Hadrian, Horizon3.ai, Intruder, Parameter, Penligent, Secure Ideas and XBOW, with `ai_apps` set to "unknown". "Unknown" means the pages do not say.

## Which specialist firms focus on AI security?

Two AI-security firms publish AI red teaming offers. We checked their own pages and cite only what they state.

HiddenLayer's services page describes AI red teaming that aims to "emulate real-world adversarial attacks against your agentic, generative, and predictive AI applications", using techniques such as model manipulation, prompt injection and inference attacks. It lists remediation playbooks and findings mapped to frameworks including the NIST AI RMF and the EU AI Act. The page gives no pricing, engagement length or sample report format. It also carries marketing results figures that we did not verify and do not repeat.

Mindgard calls itself "an AI security platform" with AI red teaming as its central feature and describes a platform that acts as "an autonomous red teamer" with four stages: Recon, Attack, Remediate and Assure. The home page links to AI red teaming services without describing them. It lists deployment through CI/CD or Burp Suite. The page does not name MITRE ATLAS or OWASP.

Other AI-security vendors exist. This page lists only firms whose own pages we read.

## How do you choose an AI red teaming provider?

Decide what you need tested, then who does the work. Four checks apply to the providers above.

1. Scope. Does the provider test your app, your agent's tools and your retrieval layer, or the model alone? Cobalt, Pen Test Partners and Escape describe retrieval, tool and MCP testing in their pages. Ask for the same detail from any provider.
2. Method and evidence. Ask for the OWASP LLM Top 10 category of each finding and the conversation or request that proves it. Escape says it keeps the full conversation as evidence. Cobalt's sample finding carries an OWASP LLM category, a CWE ID and a CVSS score.
3. Human role. HackerOne and Synack describe human researchers. Terra and Escape describe agent-led testing. Aikido offers a human-led option on request.
4. Report. Ask for a sample, and judge it with the [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) and the [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

Test conditions matter for LLM apps because model output varies. Synack's page says its researchers "test and then test again, taking into account non-deterministic interactions". Ask any provider how it handles repeat runs, and what it records.

Our publisher's AI red teaming site explains [what AI red teaming is](https://airedteamingservices.com/guides/what-is-ai-red-teaming/). For tools you run yourself, see the [automated pentesting tools guide](/guides/automated-pentesting-tools/).

## Questions

### Is AI red teaming the same as an AI pentest?

The terms overlap and vendors use them differently. NIST AI 600-1 defines AI red teaming as a structured testing exercise to probe an AI system for flaws such as inaccurate, harmful or discriminatory outputs. Pentest vendors usually frame the work around security flaws such as prompt injection and data leakage. Ask each provider what it tests.

### Do any laws or standards require AI red teaming?

The EU AI Act uses the term adversarial testing, in Article 55(1)(a), and it binds providers of general-purpose AI models with systemic risk. We found no standard that names a pentest of your own LLM app as a requirement. Check with counsel for your case.

### How long does an AI red team engagement take?

It varies by provider and scope. HackerOne's docs describe a 15- or 30-day testing project with about a week of scoping before and a week of reporting after. Most other providers in this list do not publish a duration.

## Sources

- [JUMPSEC AI penetration testing](https://www.jumpsec.com/ai-penetration-testing/)
- [Novee homepage](https://novee.security/)
- [Outpost24 PTaaS (search snippet; direct fetch returned 403)](https://outpost24.com/products/pentesting-as-a-service/)
- [Penti pricing](https://penti.ai/pricing)
- [Cobalt: AI and LLM pentest](https://www.cobalt.io/services/application-security/llm-pentest)
- [HackerOne docs: H1 AI Red Teaming (AIRT)](https://docs.hackerone.com/en/articles/14089281-hackerone-ai-red-teaming-airt)
- [Synack: AI and LLM pentesting](https://www.synack.com/products/ai-and-llm-pentesting/)
- [Pen Test Partners: artificial intelligence testing](https://www.pentestpartners.com/service/artificial-intelligence-testing/)
- [Escape: launching AI red teaming (21 Oct 2026)](https://escape.tech/blog/launching-escapes-ai-red-teaming/)
- [Terra Security home page](https://www.terra.security/)
- [Aikido AI pentest](https://www.aikido.dev/attack/aipentest)
- [TurboPentest home page](https://turbopentest.com/)
- [HiddenLayer services](https://www.hiddenlayer.com/services)
- [Mindgard home page](https://mindgard.ai/)
- [Excession Labs: AI red teaming services](https://airedteamingservices.com/)
- [NIST AI 600-1 (definition of AI red teaming)](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)
- [OWASP GenAI red teaming guide](https://genai.owasp.org/resource/genai-red-teaming-guide/)


---

# AI vs human pentesting: what 15 providers say they do

Source: https://pentestcompare.com/guides/ai-vs-human-pentesting/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

AI vs human pentesting across 15 providers: which are human-led, hybrid or automated by their own words, plus the tradeoffs, benchmark evidence and where people matter.

> **Short answer:** Providers deliver pentests in three ways: human-led, hybrid and automated. In the PentestCompare dataset, 2 of 15 providers are human-led, 7 are hybrid and 6 are automated, by their own descriptions. Automated providers claim the fastest results and publish the lowest prices. Human judgment matters most for business logic, authorization design and report accountability.

The 15 providers in the [PentestCompare dataset](/), checked on 9 November 2026, split into 2 human-led, 7 hybrid and 6 automated. The label comes from each provider's own description of who runs the tests. We did not test any of them.

## How do providers deliver pentests, and what does each type look like?

The dataset uses three delivery types.

| Delivery | What it means | Providers |
|---|---|---|
| Human-led | People run the tests and write the reports. | [Pen Test Partners](/providers/pen-test-partners/), [Secure Ideas](/providers/secure-ideas/) |
| Hybrid | People and AI agents, or a crowd of researchers, work together. Some providers sell both a human-led and an automated product. | [BreachLock](/providers/breachlock/), [Cobalt](/providers/cobalt/), [Excession Labs](/providers/excession-labs/), [HackerOne](/providers/hackerone/), [Hadrian](/providers/hadrian/), [Synack](/providers/synack/), [Terra Security](/providers/terra-security/) |
| Automated | Software or AI agents run the tests. Human review is limited or not described. | [Aikido](/providers/aikido/), [Escape](/providers/escape/), [Horizon3.ai](/providers/horizon3/), [Parameter](/providers/parameter/), [TurboPentest](/providers/turbopentest/), [XBOW](/providers/xbow/) |

Excession Labs is the publisher of this site and appears here as one row.

Providers within one label differ. The examples below come from their own pages.

Among the human-led providers, Secure Ideas says in-house consultants run the tests and write the reports, and that it does not rely on automated scans. Pen Test Partners describes staff who perform the tests, including CHECK testing for UK public-sector buyers.

Among the hybrid providers, Cobalt uses a network of vetted freelance testers and also sells an autonomous pentest. HackerOne sells a fully human-led product and an agentic product in which human pentesters review every agent finding. Synack combines Sara, an autonomous agent, with a vetted crowd of human researchers. Terra Security describes AI agents with human pentesters supervising and reports signed by certified pentesters. Hadrian says its findings are human-reviewed but does not say who reviews them. BreachLock describes an in-house human team, with a separate autonomous product.

Among the automated providers, XBOW says no human drives the attack, and that findings are reviewed before delivery without saying who reviews them. Horizon3.ai sells software that runs the attacks, and its pages describe no human pentesters. Escape describes AI pentesting with no human in the loop. Parameter says its agents pause for the customer's approval before they chain or escalate. TurboPentest's page does not say humans validate findings, and it provides a threat model for human follow-up. Aikido uses AI agents to map, attack and verify, and offers a human-led CREST pentest on request.

## What are the tradeoffs, and what does the evidence say about AI testing?

| Factor | Automated | Hybrid | Human-led |
|---|---|---|---|
| Published prices | Half publish some (TurboPentest, Aikido, Horizon3.ai). XBOW, Escape and Parameter do not. | Mixed: Cobalt, Synack and Hadrian publish some; HackerOne, BreachLock and Terra do not | Secure Ideas publishes; Pen Test Partners does not |
| Stated speed | First findings in minutes, hours or a day, per vendor claims | Varies: Cobalt's autonomous test claims findings in 24 hours; annual tiers start in 1 to 3 business days | Secure Ideas: start usually 2 to 4 weeks after contract, 1 to 2 weeks of testing |
| Human check of findings | Unclear or limited | Stated by most; Hadrian does not say who reviews | The core of the service |
| Typical gap | Business logic flagged for follow-up (TurboPentest) | Retest and price terms differ by tier | Higher entry price |

Turnaround claims are the vendors' own. They measure different things: time to start, to first findings or to a final report. The [cost guide](/guides/penetration-testing-cost/) lists the prices.

The public evidence is mixed, and most of it does not test the thing a buyer needs.

XBOW reported that an autonomous pentester reached the top of the US leaderboard on HackerOne's bug bounty platform. Its June 2025 post says it submitted nearly 1,060 vulnerabilities, that "All findings were fully automated", and that its security team reviewed them before submission to comply with HackerOne's policy on automated tools. The claim is about the US leaderboard only.

DARPA's AI Cyber Challenge final (August 2025) reports that competing systems found 54 unique synthetic vulnerabilities in 63 challenges and patched 43. The systems also found 18 real vulnerabilities. DARPA gives an average cost per competition task of about $152.

The CyberGym benchmark (arXiv 2506.02548) asks whether an agent can reproduce a known vulnerability from a description and the code. Its abstract says "top-performing combinations only achieve a ~20% success rate". That figure is for the 2025 models in the paper. Cybench (arXiv 2408.08926) uses 40 professional-level capture-the-flag tasks.

These benchmarks test memory-safety bugs and puzzles. In our reading, none of them tests business-logic or authorization flaws in a customer's own application. They are evidence about the technology and say nothing about any provider's service.

## Where do people still matter, and how do you choose?

People matter where context decides whether something is a flaw. Two places stand out in provider descriptions and in standards bodies' words:

- Business logic. TurboPentest's page flags business logic areas for manual follow-up and says its report lists what automation could not test.
- Validation and accountability. CREST named its first accredited AI-enabled pentest group on 3 September 2026 (ten providers). CREST's chief executive said the framework focuses on "the combination of responsible practice with professional judgement, quality and human accountability."

Scope decisions also need a person: what the test may touch, when to stop and what a finding means for your business. HackerOne, a hybrid provider, says humans review every agent finding, and you can ask HackerOne for evidence of that review.

Match the delivery type to the job, then check the evidence. For a quick check of a web app before launch, an automated test can fit. For a complex multi-role application, a regulated environment or a customer who asks for named human testers, ask for human-led or hybrid. In every case, ask:

1. Who validates each finding, and can you see their name or role?
2. What did the test not cover? Does the report say so?
3. What does a retest cost, and when does it expire?
4. Can you see a sample report?

The [questions guide](/guides/questions-to-ask-a-pentest-provider/) expands this list. The [PTaaS guide](/guides/ptaas-vs-traditional-pentesting/) covers how contracts differ.

## Questions

### Can an AI pentest replace a human pentest?

The evidence here does not settle it. Providers differ in how they describe human review, and no neutral study compares them. Ask a provider who validates findings and what the test did not cover, then compare sample reports.

### Does a hybrid test mean humans test everything?

No. Hybrid covers several models: AI agents with human review of findings, a crowd of researchers alongside an agent, or a provider that sells both a human-led and an automated product. The provider's own description tells you more than the label.

## Sources

- [XBOW: The Road to Top 1: How XBOW Did It (24 June 2025)](https://xbow.com/blog/top-1-how-xbow-did-it)
- [CyberGym, arXiv:2506.02548](https://arxiv.org/abs/2506.02548)
- [Cybench, arXiv:2408.08926](https://arxiv.org/abs/2408.08926)
- [DARPA: AI Cyber Challenge final results](https://www.darpa.mil/news/2025/aixcc-results)
- [CREST: first AI-enabled penetration testing accredited members (3 September 2026)](https://www.crest-approved.org/crest-first-ai-pt-accredited-members/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Aikido AI pentest page](https://www.aikido.dev/attack/aipentest)
- [Secure Ideas homepage](https://secureideas.com/)


---

# Automated penetration testing tools: four categories, named

Source: https://pentestcompare.com/guides/automated-pentesting-tools/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Automated penetration testing tools in four types: autonomous platforms, AI pentest services, AI-assisted DAST and open-source agents, with sourced prices.

> **Short answer:** Automated pentesting tools fall into four groups: autonomous pentest platforms, AI pentest agents sold as services, DAST with AI, and open-source agents you run yourself. Each group lists named tools with facts from vendor pages and official repositories, as of November 2026. No tool is ranked.

Automated penetration testing tools run attacks with software, and in newer products with AI agents, instead of with a person at a keyboard. Four categories cover them, with named tools from vendor pages and official repositories checked on 9 November 2026. None is ranked. The [provider table](/providers/) has delivery, price and retesting facts for the 20 providers in our dataset. For a service-by-service view with turnaround and retest terms, see [AI penetration testing services compared](/guides/ai-penetration-testing-services/).

> **Ownership:** PentestCompare is published by Excession Labs, a security lab that sells security testing. It is not listed in the tables below. Every fact here comes from the vendor pages and repositories cited in the sources.
## What are the four categories of automated pentesting tools?

The categories differ by who runs the tool and what it targets. A vendor can sit in more than one.

| Category | What it is | Named examples |
|---|---|---|
| Autonomous pentest platforms | Software that runs attacks itself against a defined environment | [XBOW](/providers/xbow/), [Horizon3.ai (NodeZero)](/providers/horizon3/), [Hadrian](/providers/hadrian/) |
| AI pentest agents sold as a service | AI agents run the test and a vendor delivers a report, sometimes with human review | [Aikido](/providers/aikido/), [Intruder](/providers/intruder/), [Novee](/providers/novee/), [Parameter](/providers/parameter/), [Penligent](/providers/penligent/), [Penti](/providers/penti/), [TurboPentest](/providers/turbopentest/), [Terra Security](/providers/terra-security/), plus agent options from Cobalt, HackerOne and Synack |
| DAST with AI | A dynamic scanner extended with AI agents or logic-aware tests | [Escape](/providers/escape/) |
| Open-source agents | Code you run yourself with your own model key | Shannon, Strix, PentestGPT, PentAGI |

Three tools in our dataset run attacks on their own against a scope you set. They differ in target and in how they charge.

XBOW describes autonomous AI agents that test web applications and APIs and validate findings with exploits. The buyer sets scope, impact level and testing windows. The pricing page shows no price. XBOW's June 2025 blog says an XBOW agent submitted nearly 1,060 vulnerabilities on HackerOne, all fully automated, with its security team reviewing them before submission. The claim covers the US leaderboard only.

Horizon3.ai's NodeZero covers internal, external, cloud, Kubernetes and Active Directory tests, with a newer web application module. Its price list is per asset: Flex is $15 per asset per test on a 12-month term, and Core, Pro and Elite are annual subscriptions at $50, $65 and $85 per asset. The vendor page checked does not mention mobile testing or human review of findings.

Hadrian's Nova runs AI agent pentests and lists a starting price of EUR 1,250 per test, excluding VAT. The page says findings are human-reviewed but does not say who reviews them.

## Which AI pentest agents and AI DAST products are sold as a service?

These products ship a report from an AI-run test. Prices and evidence differ, so check each sample and each retest term.

| Tool | Facts from the vendor's pages (9 Nov 2026) |
|---|---|
| Aikido AI Pentest | Fixed price of $4,000 per assessment for one application plus primary APIs, and a scoped range of $50 to $30,000+. AI agents map, attack and verify. A human-led CREST pentest is available on request. The page gives conflicting turnaround statements. |
| Parameter | AI agents pentest web apps, APIs and infrastructure from a URL and credentials. They pause for customer approval before chaining or escalating. No prices published. A [sample pentest report](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) is public. |
| TurboPentest | Self-service credits: $99 for one target, $299 for up to four, $699 for up to eight. Each test includes a report and a signed attestation letter. The report lists what automation could not test, and a [sample report](https://turbopentest.com/sample-report) is public. A retest is a new paid run. |
| Terra Security | AI agents with human oversight in a workspace called TORCH. Covers web apps, AI red teaming and networks. No prices published. |
| Intruder AI Pentesting | Web apps only, working from your source code, with each finding checked against the live app. $3,500 per test on the pricing page and $4,000 on the product page, with unlimited retesting. Results within hours. No sample report is published and no human review is described. |
| Novee | AI built on Novee's own offensive security model plus frontier models, covering web apps, APIs, mobile backends and AI apps. You can review test plans before execution. No prices or sample report are published, and the pricing page returned 404 on 9 November 2026. |
| Penligent | Desktop software you operate yourself, with an agent mode and a manual mode. Free at $0 per month with one trial task; Pro at $99.9 per month. The sample report is synthetic, 19 pages, and needs a free account. Reports are supporting evidence, not an audit report, per the vendor. |
| Penti | Credit-based AI agents from $20 to $2,000 per month, with free unlimited retests on every plan. Human-verified findings are included on higher plans, and expert-led hours cost $4,000 per 15 hours. No downloadable sample report. |
| Cobalt autonomous pentest | $3,500 per test on a limited offer: the test must start and finish before 31 December 2026. Findings arrive in 24 hours. Human-led tiers are sold separately. |
| Synack Sara | Starting at $5,085 per test, external web or host only. Sara pairs with a vetted human researcher crowd. |
| HackerOne agentic pentest | AI agents with human pentesters who review each agent finding. Covers web apps and APIs. No price published. |

"AI-run" does not always mean unsupervised. Parameter pauses for customer approval, Terra uses human oversight, and HackerOne has humans review each agent finding. These are three different controls, so ask what a person does and when.

Dynamic application security testing (DAST) scans a running app from outside. Newer products add AI to follow user flows and test logic. Escape sells business-logic-aware DAST and AI-driven continuous pentesting, which can run on merge, deploy or a schedule. Its pricing page lists no amounts or units, and the vendor states it does not test internal network lateral movement.

DAST remains a scanner category, so compare it to a pentest on what it proves. The [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/) guide shows the difference, and [aipentestservices.com](https://aipentestservices.com/guides/ai-pentest-agents-vs-dast-scanners/) has a separate comparison of AI pentest agents and DAST scanners.

## Which open-source agents exist, and what do benchmarks say?

Open-source agents are code you run yourself. You supply the model key and the authorization to test the target.

| Tool | License | What its repository says |
|---|---|---|
| Shannon (Keygraph) | AGPL-3.0 | An open-source autonomous AI pentester for web apps and APIs. The OSS edition needs source code. It launches real exploits and discards findings with no proof of concept. A full run takes about 1 to 1.5 hours plus model costs. "Findings still require human review." |
| Strix | Apache-2.0 | AI agents that run your code dynamically and validate findings with proofs of concept. Targets include repos, live sites and API definitions. Needs Docker and a model key. |
| PentestGPT | MIT | An agentic framework published at USENIX Security 2024. It reports 86.5% (90 of 104) on an XBOW validation suite run in December 2025, and calls that "a historical research result". |
| PentAGI | MIT | Described as a fully autonomous multi-agent system for penetration testing tasks. Self-hosted. We read the repository page but not its README text. |

An open-source tool has no vendor to sign a report. Shannon's README warns against running it on production, because it can create users and change application state.

Published benchmarks test narrow tasks. CyberGym (UC Berkeley) gives an agent a vulnerability description and a codebase and asks for a proof-of-concept, across 1,507 real vulnerabilities in 188 projects. Its abstract reports that top combinations achieved about a 20% success rate, for the 2025 models it tested. Cybench uses 40 professional-level capture-the-flag tasks.

Neither benchmark tests business-logic flaws, authorization flaws or your own application, so their scores show model skill, not a product's coverage of your app.

## How do you pick one?

Start from the question you need answered, then request a sample report and the retest term. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) shows how to check evidence quality. The [AI vs human pentesting](/guides/ai-vs-human-pentesting/) guide compares delivery types.

## Questions

### Can an automated tool replace a human pentest?

The vendors disagree and the evidence is mixed. Some products describe no human in the loop, and others add human review of each finding. Independent benchmarks test narrow tasks such as memory-safety bugs and capture-the-flag puzzles, and none of them test your app. Ask for a sample report and check what the tool says it could not test.

### Are open-source pentest agents safe to run on my systems?

Only on systems you own or have written permission to test, and not on production. Shannon's README says it can create users and change application state. Strix and PentestGPT carry similar authorized-use warnings. Review the license too: Shannon uses AGPL-3.0.

### Do automated tools find business logic flaws?

Some claim to. TurboPentest's page flags business-logic areas for manual follow-up and lists what automation could not test. Escape describes business-logic-aware DAST. Test the claim: ask for a finding where the tool proved a logic flaw with two accounts.

## Sources

- [XBOW pricing and product pages](https://xbow.com/pricing)
- [XBOW: The road to top 1](https://xbow.com/blog/top-1-how-xbow-did-it)
- [Horizon3.ai NodeZero pricing](https://horizon3.ai/use-case/pricing/)
- [Hadrian Nova](https://hadrian.io/products/nova)
- [Hadrian pricing](https://hadrian.io/pricing)
- [Intruder AI Pentesting](https://www.intruder.io/platform/ai-pentesting)
- [Intruder pentest pricing](https://www.intruder.io/pentest-pricing)
- [Novee homepage](https://novee.security/)
- [Penligent pricing](https://www.penligent.ai/pricing)
- [Penti pricing](https://penti.ai/pricing)
- [Parameter sample pentest report (PDF)](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf)
- [TurboPentest sample report](https://turbopentest.com/sample-report)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Aikido AI pentest](https://www.aikido.dev/attack/aipentest)
- [Aikido pricing](https://www.aikido.dev/pricing)
- [Parameter pentesting](https://www.parameter.ai/pentesting)
- [TurboPentest pricing](https://turbopentest.com/pricing)
- [Terra Security](https://www.terra.security/)
- [Escape pricing](https://escape.tech/pricing)
- [Escape AI pentesting](https://escape.tech/product/ai-pentesting)
- [Synack pricing](https://www.synack.com/pricing/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Shannon (Keygraph) repository](https://github.com/KeygraphHQ/shannon)
- [Strix repository](https://github.com/usestrix/strix)
- [PentestGPT repository](https://github.com/GreyDGL/PentestGPT)
- [PentAGI repository](https://github.com/vxcontrol/pentagi)
- [CyberGym (arXiv 2506.02548)](https://arxiv.org/abs/2506.02548)
- [Cybench (arXiv 2408.08926)](https://arxiv.org/abs/2408.08926)


---

# Bug bounty vs pentest: how to choose

Source: https://pentestcompare.com/guides/bug-bounty-vs-pentest/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Bug bounty vs pentest compared on payment, tester count, coverage, audit use and retests, with quotes from Bugcrowd and HackerOne docs, checked Nov 2026.

> **Short answer:** A pentest is a scoped, time-boxed test by a defined team that ends in a report. A bug bounty is an open or invited program that pays researchers for each valid finding. Pentests fit audit evidence and pre-release checks. Bounties fit ongoing coverage after you have a triage process. Platforms sell both, and the lines blur.

Bug bounty vs pentest is a choice between two ways to pay people to find your weaknesses. A pentest buys a defined team's time against a defined scope and ends in a report. A bug bounty pays researchers for each valid finding, with no fixed end. Most platforms in our [provider dataset](/providers/) sell both, so the choice is often about contract terms.

## What is the difference between a bug bounty and a pentest?

A pentest is scoped, time-boxed and run by a defined group. A bug bounty is a program where researchers report vulnerabilities and get rewards for valid ones.

Bugcrowd, which sells both, puts it this way in a May 2024 post. Pen testing is "pay for effort", "typically time bound", "methodology-driven" and "run by 1-3 people". Bug bounty is "pay for impact" ("the more critical the vulnerability, the higher the reward"), "can be continuous or point in time", and can "include hundreds of bug hunters" with a "freestyle approach". Bugcrowd's own PTaaS page adds that a bounty can run in a time-boxed window and that its pentests can use either a pay-for-time or pay-for-impact model. Bugcrowd is a vendor, so read these as its description of the two products.

HackerOne draws a similar line. Its pentests follow set phases with a post-testing retest phase and a final PDF report. Its bounty page describes researchers who "find your most critical vulnerabilities, including novel attack chains and business logic flaws", and a Bounty Challenge as "incentivized, time-boxed testing that rallies researchers around a specific scope or objective." Neither page lists a price.

| Factor | Pentest | Bug bounty |
|---|---|---|
| Payment | Pay for time or for a fixed scope | Pay per valid finding, by severity |
| Duration | Fixed window | Continuous or time-boxed |
| Testers | A defined team | Invited or open researcher pool |
| Method | Documented methodology, checklist coverage | Researcher's own approach, no promised coverage |
| Output | One report with scope, method and findings | A stream of individual reports |
| Audit use | Matches PCI DSS 11.4 style evidence (methodology, annual test, retest) | Ask your auditor; no fixed coverage list |
| Cost control | Quote known before the test | Spend depends on how many valid findings arrive |
| Staff load | Review the report, fix | Triage reports, answer researchers, fix on a rolling basis |
| Retest | Often part of the contract (terms differ) | Researchers can confirm fixes; terms set per program |

A pentest quote is fixed, and a bounty budget moves with the findings. Ask the platform how a program limits spend.

## When should you choose a pentest or a bug bounty, and what do you prepare?

Choose a pentest when you need a document with a known scope. Three triggers are common: an audit or customer review that asks for a report, a release you want checked before launch, and a first look at an app that has never been tested. Bugcrowd's post names audit reports ("ISO 27001, SOC2 Type 2, PCI, HITRUST, FISMA") and catching what it calls "low hanging fruit".

PCI DSS v4.0.x requirement 11.4 asks for a documented methodology (11.4.1), testing at least every 12 months and after significant change, and fixing and retesting exploitable findings (11.4.4). A pentest report can answer that. Check the exact text in the standard or with your QSA, since the PDF is gated and PCI SSC does not set one report format.

Choose a bounty when you already triage and fix vulnerabilities fast and want ongoing coverage from many testers. Bugcrowd says bounties give continuous coverage of assets and many researchers looking for "novel vulnerabilities" that pentests might miss. That is a vendor view, but the structure supports it: more testers with more freedom reach more paths over time.

Before you launch a bounty, write a clear scope and rules, a safe-harbor policy, a named owner for reports, and a service-level target for fixes. A bounty on an app with unfixed basics pays for easy findings and floods the queue. Run a pentest first, fix the findings, then open a private program.

For a pentest, prepare test accounts for each role, API documentation, a staging copy or agreed production limits, a contact who can answer during the test window, and a written authorization. The [scoping checklist](/tools/scoping-checklist/) lists these items.

For a bounty, prepare a written scope and a list of out-of-scope assets, rules on what researchers may and may not do, a safe-harbor statement, a triage owner, a target time to acknowledge and fix reports, and a reward table. Ask the platform who triages first-line reports and what you pay for that service. The [pentest cost guide](/guides/penetration-testing-cost/) covers how pentest pricing units differ.

## Can you use both?

Yes. Bugcrowd advises periodic pen tests with a continuous bounty "over the top". It also says customers who combine them find "3-5x more high-impact vulnerabilities versus standard pen testing alone". That number is Bugcrowd's own and we could not check it independently.

Crowdsourced platforms also blur the line. [HackerOne](/providers/hackerone/) sells a human-led pentest and an agentic pentest next to its bounty product. [Synack](/providers/synack/) sells pentests that mix an AI agent with a vetted crowd. [Cobalt](/providers/cobalt/) sells pentests through a network of vetted freelance testers. Read each product's contract for the window, the tester count and the report. If the document is a stream of reports, it is a bounty by structure, whatever the name.

For AI testing agents, XBOW says it reached the top of HackerOne's US leaderboard in June 2025 and that its security team reviewed submissions before they went out. That is one example of automation entering bounty programs. The [automated pentesting tools guide](/guides/automated-pentesting-tools/) lists the tool categories, and the [pentest vs vulnerability scan](/guides/pentest-vs-vulnerability-scan/) guide covers scanners.

## Questions

### Can a bug bounty replace an annual pentest?

Not for audit evidence. A bounty has no fixed methodology or coverage list, and its output is a stream of reports, not one document. PCI DSS requirement 11.4 asks for a documented methodology and annual testing. Ask your auditor or QSA whether a bounty satisfies a given control before you rely on it.

### Do small companies run bug bounties?

Some do, usually in private programs with invited researchers. The cost includes more than rewards. Someone must triage reports, answer researchers and fix issues quickly. Without that staff time, a bounty produces a backlog.

### Do AI testing agents join bug bounties?

Yes. XBOW's June 2025 blog says it submitted nearly 1,060 vulnerabilities to HackerOne programs, all fully automated, and that its security team reviewed them before submission to comply with HackerOne's policy on automated tools. The claim was for the US leaderboard, not the global one.

## Sources

- [Bugcrowd: Pen testing vs. bug bounty (22 May 2024)](https://www.bugcrowd.com/blog/pen-testing-and-bug-bounty-which-when-why/)
- [HackerOne docs: retesting pentests](https://docs.hackerone.com/en/articles/8541386-retesting-pentests)
- [HackerOne pricing page](https://www.hackerone.com/pricing)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Bugcrowd: pentest as a service (FAQ)](https://www.bugcrowd.com/products/pen-test-as-a-service/)
- [XBOW: The road to top 1 (24 June 2025)](https://xbow.com/blog/top-1-how-xbow-did-it)
- [PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0 (11.4.1, 11.4.4)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)
- [Synack pricing page](https://www.synack.com/pricing/)
- [Cobalt pricing page](https://www.cobalt.io/pricing)


---

# Pentest buyer guides

Source: https://pentestcompare.com/guides/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Buyer guides for penetration testing: cost and pricing models, providers for startups and SOC 2, AI vs human testing, PTaaS, and how to judge sample reports.

Guides for people choosing a penetration testing provider. They use the [provider dataset](/) and primary sources, and they say where the evidence stops.

- [Cobalt alternatives for penetration testing](https://pentestcompare.com/compare/cobalt-alternatives/): Cobalt.io alternatives for pentesting, grouped by need: published per-test prices, human-led testing, fast automated tests. Sources checked 9 November 2026.
- [Cobalt vs HackerOne for penetration testing](https://pentestcompare.com/compare/cobalt-vs-hackerone/): Cobalt vs HackerOne pentest, side by side: delivery, scope, pricing, turnaround, retest terms, sample reports and credentials. Vendor sources checked 9 November 2026.
- [HackerOne pentest alternatives](https://pentestcompare.com/compare/hackerone-pentest-alternatives/): HackerOne pentest alternatives grouped by need: published prices, set retest terms, sample reports or a human-led consultancy. Vendor sources checked 9 November 2026.
- [Synack vs Cobalt for penetration testing](https://pentestcompare.com/compare/synack-vs-cobalt/): Synack vs Cobalt pentest, side by side: delivery, scope, price units, turnaround, retest terms, sample reports and credentials. Vendor sources checked 9 November 2026.
- [XBOW alternatives for autonomous and AI-assisted pentesting](https://pentestcompare.com/compare/xbow-alternatives/): XBOW alternatives grouped by need: a published price, a sample report, a human reviewer or network coverage. Facts from vendor pages checked 9 November 2026.
- [XBOW vs Horizon3 NodeZero](https://pentestcompare.com/compare/xbow-vs-horizon3/): XBOW vs Horizon3 NodeZero compared: an autonomous web and API agent against a network-first platform with a web module. Prices and units checked 9 Nov 2026.
- [AI penetration testing services compared: 16 providers, sourced](https://pentestcompare.com/guides/ai-penetration-testing-services/): AI penetration testing services compared: delivery model, scope, published prices with units, turnaround claims, retest terms and sample reports for 16 providers.
- [AI red teaming companies: who tests LLM apps and agents](https://pentestcompare.com/guides/ai-red-teaming-providers/): AI red teaming companies that test LLM apps and agents: twelve dataset providers, the publisher and two AI-security specialists, with scope, method and sources, Nov 2026.
- [AI vs human pentesting: what 15 providers say they do](https://pentestcompare.com/guides/ai-vs-human-pentesting/): AI vs human pentesting across 15 providers: which are human-led, hybrid or automated by their own words, plus the tradeoffs, benchmark evidence and where people matter.
- [Automated penetration testing tools: four categories, named](https://pentestcompare.com/guides/automated-pentesting-tools/): Automated penetration testing tools in four types: autonomous platforms, AI pentest services, AI-assisted DAST and open-source agents, with sourced prices.
- [Bug bounty vs pentest: how to choose](https://pentestcompare.com/guides/bug-bounty-vs-pentest/): Bug bounty vs pentest compared on payment, tester count, coverage, audit use and retests, with quotes from Bugcrowd and HackerOne docs, checked Nov 2026.
- [How to judge a pentest provider by its sample report](https://pentestcompare.com/guides/judge-a-pentest-provider-by-its-sample-report/): Nine signals to check in a pentest sample report before you buy, plus which of 14 providers publish one, with links and the date we checked them.
- [Penetration testing cost: list prices from 7 of 15 providers](https://pentestcompare.com/guides/penetration-testing-cost/): Penetration testing cost from the list prices of 7 providers ($99 to $27,120 per test), why units differ, what raises a quote and what a quote should include.
- [Penetration testing for startups: how to choose a provider](https://pentestcompare.com/guides/pentest-providers-for-startups/): Penetration testing for startups: which of 15 providers fits a customer review, an audit or a launch, with tradeoffs and the evidence to ask for before you buy.
- [Pentest vs vulnerability scan: which one do you need?](https://pentestcompare.com/guides/pentest-vs-vulnerability-scan/): Pen test vs vulnerability scan: what each does, how NIST defines them, how PCI DSS 11.3 (scans) differs from 11.4 (pentests), and a table to pick one.
- [Penetration testing as a service (PTaaS) vs traditional pentesting](https://pentestcompare.com/guides/ptaas-vs-traditional-pentesting/): Penetration testing as a service explained: how PTaaS platforms, consultancies and automated tools differ in contract, price and retesting, with named providers.
- [Questions to ask a pentest provider before you sign](https://pentestcompare.com/guides/questions-to-ask-a-pentest-provider/): 24 questions to ask a pentest provider, grouped by scope, people, method, report, retest and contract. Each has the reason to ask and a good answer signal.
- [SOC 2 penetration testing providers: what to compare](https://pentestcompare.com/guides/soc-2-penetration-testing-providers/): SOC 2 penetration testing providers compared on sample reports, credentials and retest terms, with the AICPA wording and the evidence to request.

See also the [head-to-head comparisons](/compare/), the [glossary](/glossary/) and the [scoping checklist](/tools/scoping-checklist/).


---

# How to judge a pentest provider by its sample report

Source: https://pentestcompare.com/guides/judge-a-pentest-provider-by-its-sample-report/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Nine signals to check in a pentest sample report before you buy, plus which of 14 providers publish one, with links and the date we checked them.

> **Short answer:** A sample report shows how a provider works before you sign. Check nine things: scope statement, method, evidence for each finding, reproduction steps, controls, severity definitions, remediation advice, retest results and stated limits. As of November 2026, 4 of the 14 providers in our dataset publish a sample, 2 give one on request and 8 publish none. Excession Labs, the publisher, adds a fifth public sample.

A pentest sample report shows a provider's work before you pay for it. You can read what the tester proved, how they proved it and what they admit they did not test. Four of the 14 providers publish one (see the next section). Nine signals then show how to judge a sample.

## Which pentest providers publish a sample report?

As of November 2026, four of the 14 providers in our dataset publish a sample report, two give one on request, and eight publish none. Excession Labs, the publisher of PentestCompare, also publishes one. We took each link from the provider's own pages on 9 November 2026. We did not grade the samples, and some links come from page text without a full read of the file.

| Provider | Sample report | Where |
|---|---|---|
| [Aikido](/providers/aikido/) | Public | Downloads on the [AI pentest page](https://www.aikido.dev/attack/aipentest) |
| [Excession Labs](/providers/excession-labs/) | Public, labeled demonstration (see note below) | [Sample report](https://penetrationtestservices.com/sample-report/) |
| [Parameter](/providers/parameter/) | Public | [PDF](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf) |
| [Secure Ideas](/providers/secure-ideas/) | Public | [Sample report](https://secureideas.com/sample-report) |
| [TurboPentest](/providers/turbopentest/) | Public | [Sample report](https://turbopentest.com/sample-report) |
| [BreachLock](/providers/breachlock/) | On request | Ask the provider |
| [Cobalt](/providers/cobalt/) | On request | Ask the provider |
| [Escape](/providers/escape/), [Hadrian](/providers/hadrian/), [HackerOne](/providers/hackerone/), [Horizon3.ai](/providers/horizon3/), [Pen Test Partners](/providers/pen-test-partners/), [Synack](/providers/synack/), [Terra Security](/providers/terra-security/), [XBOW](/providers/xbow/) | Not published | None found on the pages we checked |

The Excession Labs sample report is a labeled demonstration built on a made-up app, not a customer engagement.

## What are the nine signals of a good pentest report?

A good report lets a stranger repeat each finding and decide what to fix first. You can check all nine signals by reading, with no tools. Each maps to a section most reports have, though no standard fixes the layout. The PCI SSC guidance says its report outlines "are only suggested outlines and do not define specific reporting requirements" for PCI DSS pentests.

### 1. Does the scope statement name exact assets?

The scope statement should list hosts, URLs, API base paths, roles and accounts, plus the test window and what was excluded. "The web application" is not a scope. If the report cannot say what was in scope, you cannot say what was left untested.

### 2. Does it describe the method?

Look for the approach (black box, grey box or white box), the guides used (for example OWASP's Web Security Testing Guide) and a split between manual work and tooling. A method section that only names a scanner tells you the report is scanner output.

### 3. Does each finding carry evidence?

Evidence means the request, the response and what changed. A write is proven when another session reads the changed record back. A bare "200 OK" is not proof. Screenshots without URLs, timestamps or account names are weak.

### 4. Can you reproduce each finding?

Reproduction steps should list the preconditions, the accounts, the exact requests and the expected result. Ask your engineer to follow one finding with no help from the provider. If they stall, the steps are incomplete.

### 5. Does it show controls?

A control is a test that should fail: a nonexistent ID, another account's token, an anonymous call. A report that lists "controls that held" shows what the tester checked and found sound. It also tells your team which protections a fix must not break.

### 6. Are severity levels defined?

The report should say what Critical, High, Medium and Low mean in plain words, or give a CVSS vector and say which version. FIRST states that CVSS v4.0 qualitative ratings are None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0, and that use of them is optional. A severity with no definition cannot be argued with or ranked.

### 7. Is the remediation advice specific?

"Validate input" is generic. "Check that the invoice's account ID equals the session's account ID on the server before returning it" is a fix. Good advice names the layer, the check and a way to confirm the fix.

### 8. Does it show retest results?

Look for a retest section or a retest sample. PCI DSS v4.0.x requirement 11.4.4 says exploitable findings are corrected and the testing is repeated to verify the corrections. A retest section lists the original finding, the retest date and the result. Terms differ between providers: HackerOne's docs describe unlimited retests inside a remediation period of typically 30 or 90 days, and TurboPentest's pricing page describes a retest as a new pentest at the same per-target price. See each [profile](/providers/) for the exact claim and source.

### 9. Does it state its limits?

A section on limitations and open questions lists what the tester could not reach, what was inferred and what stays unconfirmed. Reports with no limits section imply complete coverage, which no test has.

## How do you score a sample report, and what can it not tell you?

Score each signal from 0 to 2: 0 when it is missing, 1 when it is partial, 2 when you could act on it. Add the scores for a total out of 18. The score is a reading aid and no standard defines it. Compare providers on the same sample type: a report for a web app, a report for an API and a report from an automated run are not the same product.

> **Scoring sheet:** | Signal | 0 | 1 | 2 |
> |---|---|---|---|
> | Scope statement | Generic | Assets only | Assets, roles, window, exclusions |
> | Method | Tool name only | Approach named | Approach, guides, manual versus tooling |
> | Evidence per finding | Screenshots only | Request or response | Request, response and effect shown |
> | Reproduction | Absent | Prose steps | Exact requests and expected result |
> | Controls | Absent | Mentioned | Listed with outcomes |
> | Severity definitions | Labels only | Labels and CVSS | Written scale or stated CVSS version |
> | Remediation | Generic | Specific to the class | Specific to the app, with a check |
> | Retest | Absent | Offered | Shown in the report |
> | Limitations | Absent | A disclaimer | Specific untested areas |
A sample cannot show who will test your system, how long it will take or what the report will say about your app. It shows the provider's best format. A demonstration report built on a made-up app, such as Excession Labs', shows the layout and the evidence style and nothing about a real engagement.

Match the sample to your case. A report for a network test says little about an API test. An automated run's report can look complete and still skip business-logic checks. Ask for a redacted report of similar scope, and use the [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) to follow up on gaps. To compare prices next to these signals, read the [pentest cost guide](/guides/penetration-testing-cost/).

PCI SSC's guidance also says that qualifications "cannot be met by certifications alone", so read the sample for evidence of engagement experience as well as for badges on the provider's website. The [PCI penetration testing guide](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/) on our publisher's service site covers the standard's text.

## Questions

### Can a sample report be faked or polished?

Yes. A sample is chosen by the provider, and it may be rewritten for public view. Treat it as the best case. Ask for a redacted report from a real engagement of similar scope and compare the two. If the real report is thinner than the sample, you have learned something.

### Does the length of a report show quality?

No. A long report can be mostly scanner output. Count the findings that have a request, a response and a result you could repeat. A short report with strong evidence for each finding is easier to act on than a long one with none.

### What if the provider will not share any sample?

Eight of the 14 providers we checked publish no sample, so this is common. Ask for a redacted report under NDA. If that is refused too, ask for a call where the provider walks through one finding from request to fix.

### Which severity scale should a report use?

No standard forces one scale. FIRST's CVSS v4.0 bands are None, Low, Medium, High and Critical, and use of the ratings is optional. A written scale with a definition for each level also works. Pick the scale your customers and auditors ask for during scoping.

## Sources

- [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [FIRST CVSS v4.0 specification](https://www.first.org/cvss/v4.0/specification-document)
- [PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0 (11.4.1 and 11.4.4)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)
- [HackerOne docs: retesting pentests](https://docs.hackerone.com/en/articles/8541386-retesting-pentests)
- [Parameter sample pentest report (PDF)](https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf)
- [Aikido AI pentest page (sample downloads)](https://www.aikido.dev/attack/aipentest)
- [TurboPentest sample report](https://turbopentest.com/sample-report)
- [Secure Ideas sample report](https://secureideas.com/sample-report)
- [Excession Labs sample report (labeled demonstration)](https://penetrationtestservices.com/sample-report/)


---

# Penetration testing cost: list prices from 7 of 15 providers

Source: https://pentestcompare.com/guides/penetration-testing-cost/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing cost from the list prices of 7 providers ($99 to $27,120 per test), why units differ, what raises a quote and what a quote should include.

> **Short answer:** Penetration testing cost depends on the unit a provider sells: a test, an asset, a credit, a day or a subscription. Of 15 providers, 7 publish some dollar or euro price. Published per-test prices span $99 for one automated test to $27,120 for a 14-day team test, and the units differ. Most human-led work is quoted after scoping.

Penetration testing cost depends first on what the provider sells: a test, a number of assets, prepaid credits, hours or a subscription. As of 9 November 2026, 7 of the 15 providers in the [PentestCompare dataset](/) publish at least one price. The other 8 quote after scoping. Published prices are starting prices or list prices. They are not the total you will pay.

We copied every price below from the provider's own page. We did not average, convert or estimate anything.

## What pricing models do pentest providers use?

Providers use five models, and some use several at once.

| Model | What you buy | Providers in the dataset that publish a price this way |
|---|---|---|
| Per test | One test of a defined scope | Cobalt, Synack, Secure Ideas, Aikido, Hadrian, Horizon3.ai (WebApp) |
| Per day or hour | Tester time | Secure Ideas |
| Credits | A prepaid pool, spent on tests | Secure Ideas, TurboPentest; Cobalt sells credits but publishes no price for them |
| Subscription | Access for a month or year | TurboPentest, Horizon3.ai; Synack requires a platform subscription it does not price |
| Autonomous run | A test run by AI agents, billed per run or per asset | Cobalt, Aikido, TurboPentest, Hadrian, Horizon3.ai |

Providers that publish no price are BreachLock, Escape, HackerOne, Pen Test Partners, Parameter, Terra Security, XBOW and Excession Labs.

## Which prices do providers publish?

The table lists every published price in the dataset. "Starting" means the provider calls it a starting price or the smallest scope.

| Provider | Item | Amount | Unit | What it covers | Source | Checked |
|---|---|---|---|---|---|---|
| Aikido | TYPICAL Pentest | $4,000 | per assessment | One application plus its primary APIs, whitebox. Black-box and grey-box cost extra. Free retests for up to 6 months. | [Aikido pricing](https://www.aikido.dev/pricing) | 9 Nov 2026 |
| Aikido | Rightsized Pentest | $50 to $30,000+ | per assessment | Scoped from repos, endpoints and roles. Priced by number of AI agents and credits. | [Aikido pricing](https://www.aikido.dev/pricing) | 9 Nov 2026 |
| Cobalt | Autonomous Pentest (limited-time offer) | $3,500 | per test | Web application test. The offer says the test must start and finish before 31 Dec 2026. | [Cobalt pricing](https://www.cobalt.io/pricing) | 9 Nov 2026 |
| Hadrian | Nova test | From EUR 1,250 | per test, excluding VAT | One agentic pentest with reporting. The page does not define what one test covers. | [Hadrian pricing](https://hadrian.io/pricing) | 9 Nov 2026 |
| Horizon3.ai | Flex | $15 | per asset, per test (12-month term) | Internal, external, cloud and Kubernetes tests, reports and fix verification. | [Horizon3.ai pricing](https://horizon3.ai/use-case/pricing/) | 9 Nov 2026 |
| Horizon3.ai | Core | $50 | per asset, annual subscription | Unlimited testing. Each asset is billed once per 12 months. | [Horizon3.ai pricing](https://horizon3.ai/use-case/pricing/) | 9 Nov 2026 |
| Horizon3.ai | Pro | $65 | per asset, annual subscription | Core plus tripwires and rapid response. | [Horizon3.ai pricing](https://horizon3.ai/use-case/pricing/) | 9 Nov 2026 |
| Horizon3.ai | Elite | $85 | per asset, annual subscription | Pro plus insights, high-value targeting, advanced data pilfering, threat actor intelligence and vulnerability prioritization. | [Horizon3.ai pricing](https://horizon3.ai/use-case/pricing/) | 9 Nov 2026 |
| Horizon3.ai | WebApp Flex | $10,000 | per app, per test (12-month term) | Web application test. The page does not define the scope of one test. | [Horizon3.ai pricing](https://horizon3.ai/use-case/pricing/) | 9 Nov 2026 |
| Secure Ideas | External Penetration Test, smallest scope | $8,160 | per test, flat fee, starting | Smallest of four scope tiers. | [Secure Ideas pricing](https://secureideas.com/pricing) | 9 Nov 2026 |
| Secure Ideas | API Penetration Test, smallest scope | $10,880 | per test, flat fee, starting | Smallest of four scope tiers. | [Secure Ideas pricing](https://secureideas.com/pricing) | 9 Nov 2026 |
| Secure Ideas | Web Application Test, smallest scope | $13,600 | per test, flat fee, starting | Smallest of four scope tiers. | [Secure Ideas pricing](https://secureideas.com/pricing) | 9 Nov 2026 |
| Secure Ideas | Hourly rate | $340 | per hour ($2,720 per day) | Standard consulting rate. | [Secure Ideas pricing](https://secureideas.com/pricing) | 9 Nov 2026 |
| Secure Ideas | PETaaS credit | $2,520 | per credit | Up to one day of expert work. Minimum purchase is 25 credits. | [Secure Ideas pricing](https://secureideas.com/pricing) | 9 Nov 2026 |
| Synack | Sara Pentest | $5,085 | per test, starting | One Standard test, external web or host only. 4 to 5 business day window. Patch verification and report included. | [Synack pricing](https://www.synack.com/pricing/) | 9 Nov 2026 |
| Synack | SynackST | $10,283 | per test, starting | One Standard test by one tester for one framework. Up to 25 unauthenticated web apps, or 1 low-complexity authenticated web app, or 100 host IPs. | [Synack pricing](https://www.synack.com/pricing/) | 9 Nov 2026 |
| Synack | Synack14 | $27,120 | per test, starting | Team test over 14 days. Up to 50 unauthenticated web apps, or 1 authenticated web app, or 250 host IPs. | [Synack pricing](https://www.synack.com/pricing/) | 9 Nov 2026 |
| TurboPentest | Audit-Ready | $99 | per credit (one pentest) | 1 target, 4 agents, up to 4 agent-hours. Report and signed attestation letter. | [TurboPentest pricing](https://turbopentest.com/pricing) | 9 Nov 2026 |
| TurboPentest | Threat-Hunt | $299 | per credit (one pentest) | Up to 4 targets, 10 agents, up to 20 agent-hours. | [TurboPentest pricing](https://turbopentest.com/pricing) | 9 Nov 2026 |
| TurboPentest | Adversarial-Depth | $699 | per credit (one pentest) | Up to 8 targets, 20 agents, up to 80 agent-hours. | [TurboPentest pricing](https://turbopentest.com/pricing) | 9 Nov 2026 |
| TurboPentest | Monthly pentest | $99 | per month | One verified target re-tested each month. | [TurboPentest pricing](https://turbopentest.com/pricing) | 9 Nov 2026 |
| TurboPentest | Enterprise dedicated instance | $49,990 | per year ($4,999 per month) | Unlimited targets in the customer's own cloud. Cloud and model costs are paid separately. | [TurboPentest pricing](https://turbopentest.com/pricing) | 9 Nov 2026 |

Cobalt's human-led tiers (Standard, Premium, Enterprise) are annual credit packages without a published price. One Cobalt credit equals 8 hours of testing. Synack requires a platform subscription that it bills separately and does not price. Horizon3.ai sells support tiers at extra cost (Enhanced is 10% of the subscription, minimum $7,500 a year; Premier is 20%, minimum $25,000 a year).

## Why can't you compare pentest prices directly, and what drives them?

The units differ, so the amounts do not line up. A TurboPentest credit is one automated pentest of one to eight targets. A Secure Ideas credit is up to a day of expert work. A Cobalt credit is 8 hours. A Horizon3.ai price is per discovered asset, such as a server, device or cloud resource, not per test.

Take Horizon3.ai Flex. A hypothetical 100 assets would cost $1,500 for one test ($15 x 100), and a hypothetical 5 assets would cost $75. The same $15 buys no fixed amount of testing. Secure Ideas sits at the other end: 25 credits at $2,520 is $63,000, and that is its minimum for the credit plan.

Scope definitions also differ. Synack counts web apps and host IPs. Aikido counts an application plus its primary APIs. Hadrian and Horizon3.ai WebApp do not define one test. Depth differs too: Synack's cheapest item covers external web or hosts only, while its top item is a 14-day team test.

Only compare two prices after you check that scope, depth, who tests, retest terms and the report match.

Provider pages show these price drivers:

- Number of applications, targets or assets (Synack, TurboPentest, Horizon3.ai).
- Test type and size tier (Secure Ideas has four scope tiers per test type).
- Depth and test window, such as the length of the test or the number of agent-hours (Synack, TurboPentest).
- Box type. Aikido's $4,000 price is for whitebox; black-box and grey-box cost extra.
- Authenticated roles and API size. Synack distinguishes unauthenticated apps from authenticated ones.
- Attestation letters and retesting. Secure Ideas lists both as factors that can change the quote.
- Platform fees, such as Synack's required platform subscription.
- Contract term. Cobalt's tiers are annual, and Horizon3.ai prices run on 12-month terms.

Providers also state their own ranges. Secure Ideas says on its homepage that most of its tests cost $10K to $45K. That is the vendor's statement about its own work, not a market figure.

We found no neutral market average, and we do not publish one. The closest figure is a survey average of annual spend, not the price of a test. Pentera surveyed 500 CISOs and senior security executives at organizations with 3,000 or more employees (200 in the United States) in January 2025. The report says US enterprises spend an average of $187,000 a year on pentesting. Pentera sells automated pentesting software, and the sample is large enterprises. Do not use it to estimate the cost of one test for a startup.

## What should a pentest quote include?

A quote is comparable only when it states what it covers. Ask every provider to put these items in writing:

1. The unit and the total, in one currency, with taxes stated (Hadrian lists prices excluding VAT).
2. Scope: named hosts, apps, APIs, environments and the roles tested.
3. Test type: black box, grey box or white box.
4. Who tests, and whether humans review every finding.
5. The test window and the start date, and whether the turnaround is time to start, to first findings or to final report.
6. The report: whether a sample report exists, which formats you get, and whether an attestation letter is included.
7. Retesting: how many, for how long, and the price after the window.
8. Extra costs: platform subscription, support tier, extra targets or credits that expire (Synack credits expire one year after purchase).
9. What happens if the scope grows during the test.

The [scoping checklist](/tools/scoping-checklist/) collects the scope answers, and the [questions guide](/guides/questions-to-ask-a-pentest-provider/) lists what to ask about the team and the report.

## Where do the published prices sit?

Published per-test starting prices in this dataset run from $99 (a TurboPentest credit) to $27,120 (Synack14). Aikido's Rightsized range starts lower, at $50, and reaches $30,000+. Automated and AI-agent products publish most of the low prices. Human-led work is mostly quoted after scoping. Secure Ideas is the human-led exception, with published starting prices and rates.

Delivery type affects price, and the [AI vs human guide](/guides/ai-vs-human-pentesting/) covers it. The [PTaaS guide](/guides/ptaas-vs-traditional-pentesting/) covers how platform and consultancy contracts differ.

## Questions

### Why do two pentest quotes for the same app differ so much?

Providers assume different scope, depth and delivery. One may test two roles and the other six. One may include the API and a retest. Send every provider the same scope summary, then compare the differences that remain.

### Is a cheaper automated test equal to a human-led test?

The dataset cannot say. Automated products and consultancies differ in who tests, what they cover and what the report shows. Compare scope, sample reports and retest terms, and the price too.

### Does the price include a retest?

It depends on the provider. Synack lists patch verification in each product. Aikido lists free retests for up to 6 months. TurboPentest treats a retest as a new paid run. Secure Ideas lists retesting as a factor that can change the quote.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Synack pricing](https://www.synack.com/pricing/)
- [Horizon3.ai NodeZero pricing](https://horizon3.ai/use-case/pricing/)
- [Aikido pricing](https://www.aikido.dev/pricing)
- [TurboPentest pricing](https://turbopentest.com/pricing)
- [Secure Ideas pricing](https://secureideas.com/pricing)
- [Hadrian pricing](https://hadrian.io/pricing)
- [Pentera, The State of Pentesting 2025 (survey of 500 CISOs)](https://pentera.io/wp-content/uploads/2026/03/Pentera-Report-The-State-of-Pentesting-2025.pdf)


---

# Penetration testing for startups: how to choose a provider

Source: https://pentestcompare.com/guides/pentest-providers-for-startups/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing for startups: which of 15 providers fits a customer review, an audit or a launch, with tradeoffs and the evidence to ask for before you buy.

> **Short answer:** A startup should pick a pentest provider by the job the test must do: pass a customer review, give audit evidence or find real flaws before launch. Automated providers publish lower prices and faster results. Human-led providers publish fewer prices and start later. Ask each for a sample report, a scope statement and retest terms.

Penetration testing for startups starts with one question: what must the test do for you? A startup usually needs a pentest for one of three jobs: to answer a customer's security review, to give an auditor evidence, or to find real flaws before a launch. The right provider differs for each. Every fact below comes from the [PentestCompare dataset](/), checked on 9 November 2026. No provider is ranked.

## What should a startup look for, and which providers fit which need?

Look at six things in order: scope, delivery type, price visibility, turnaround, retesting and evidence you can show. Scope comes first because a test that skips your API or your mobile app does not answer the question you bought it for. Delivery type comes next because it decides who finds the flaws and who checks them.

The dataset records each of these fields for all 15 providers. It marks gaps as "Not published" or "unknown". Where a field is a gap, the pages we read did not say, so the provider may still have the thing.

The table groups providers by what their own pages emphasize. Fit comes from the dataset fields and is not a recommendation. Each provider's profile has the sources.

| Need | Providers whose pages fit it | What the pages show | Tradeoff |
|---|---|---|---|
| Low price and fast results for a web app or API | [TurboPentest](/providers/turbopentest/), [Aikido](/providers/aikido/), [Parameter](/providers/parameter/) | TurboPentest publishes $99, $299 and $699 tests and a signed attestation letter. Aikido publishes $4,000 for an application and its primary APIs. Parameter publishes no price but has a public sample report. | Automated. TurboPentest flags business logic for manual follow-up. Aikido's Rightsized range runs $50 to $30,000+. Parameter's SOC 2 report is Type I. |
| Human testers on a platform | [Cobalt](/providers/cobalt/), [HackerOne](/providers/hackerone/), [BreachLock](/providers/breachlock/), [Synack](/providers/synack/) | Cobalt, HackerOne and Synack describe vetted human testers or researchers. BreachLock describes an in-house human team. | Mostly quote-only. Cobalt's human-led tiers are annual credit packages. Synack needs a platform subscription it does not price. |
| A boutique consultancy with published rates | [Secure Ideas](/providers/secure-ideas/) | Starting prices from $8,160 per test, $340 an hour, and a public sample report. | Higher entry price. The pages say testing starts 2 to 4 weeks after contract. |
| Frequent testing of many apps | [XBOW](/providers/xbow/), [Escape](/providers/escape/), [Horizon3.ai](/providers/horizon3/) | Continuous or on-demand automated testing. Horizon3.ai publishes per-asset prices. | No price for XBOW or Escape. Scope is narrower: XBOW covers web apps and APIs on the pages checked. |
| AI features in the product | [Cobalt](/providers/cobalt/), [Escape](/providers/escape/), [Terra Security](/providers/terra-security/), [Pen Test Partners](/providers/pen-test-partners/) | Their pages list AI application testing in scope. | Check the depth: a scope line is not evidence of experience. |

The last row lists four of the eight providers marked "yes" in the dataset's "ai_apps" scope field (Excession Labs is a ninth). Providers marked "unknown" may still test AI applications.

## How do automated and human-led testing differ, and what does a startup pay?

Automated providers publish more prices and report faster. Human-led providers publish fewer prices and, in Secure Ideas' case, start weeks after contract. Cobalt's annual tiers list starts within 1 to 3 business days. The delivery types also differ in who checks findings: HackerOne says human pentesters review every agent finding in its agentic product, while TurboPentest's page does not say humans validate findings.

The tradeoff is speed and cost on one side and human judgment on the other. Business logic and authorization flaws depend on context about your product. See the [AI vs human guide](/guides/ai-vs-human-pentesting/) for how providers describe this.

Published prices in the dataset start at $99 for an automated test and reach $27,120 for a 14-day team test. Human-led annual platform tiers have no published price. The [cost guide](/guides/penetration-testing-cost/) has the full table with units. Do not compare amounts before you compare units and scope.

A small budget limits the choice. Price says nothing about quality in this data, because no price comes with evidence about findings.

## What evidence should a startup ask for, and how should it run the comparison?

Ask every shortlisted provider for the same items, in writing:

1. A sample report. Public in the dataset for Aikido, Parameter, Secure Ideas, TurboPentest and Excession Labs. On request at Cobalt and BreachLock. Not published for the other eight providers. Aikido's public samples cover network, mobile and AI tests, not web or API. The sample for Excession Labs is built on an invented app, not a customer report.
2. A scope statement naming apps, APIs, roles, environments and what is excluded.
3. Retest terms: how many, how long, and the price after. Cobalt's pricing page states its retest window two different ways, so ask which applies.
4. Tester information: who tests, who reviews findings, and which credentials apply. Credentials listed in the dataset are claims from the vendor's pages.
5. A letter or summary you can send a customer, if a customer asks for one.

If a customer or auditor sets the requirement, ask them what they accept first. The [SOC 2 providers guide](/guides/soc-2-penetration-testing-providers/) covers audit evidence. The [questions guide](/guides/questions-to-ask-a-pentest-provider/) goes deeper on the team and the report.

Write one scope summary with the [scoping checklist](/tools/scoping-checklist/). Send it to three providers of different delivery types. Compare the replies on scope covered, retest terms, sample report and total price in one currency. Then pick the one whose evidence answers your job.

## Questions

### When does a startup need a pentest?

Usually when a customer's security review asks for a recent report, when an auditor asks for evidence, or before a launch that handles sensitive data. No law makes a pentest mandatory for every startup. The trigger is normally a buyer or a standard that applies to you.

### Can a startup use an automated pentest for a customer review?

Some automated providers sell a report and a signed letter. Whether the customer accepts it is the customer's decision. Ask the customer which evidence it accepts before you buy, and send the sample report to them.

## Sources

- [TurboPentest pricing and homepage](https://turbopentest.com/pricing)
- [Aikido pricing](https://www.aikido.dev/pricing)
- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Secure Ideas pricing and homepage](https://secureideas.com/pricing)
- [Parameter pentesting page](https://www.parameter.ai/pentesting)
- [Synack pricing](https://www.synack.com/pricing/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)


---

# Pentest vs vulnerability scan: which one do you need?

Source: https://pentestcompare.com/guides/pentest-vs-vulnerability-scan/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Pen test vs vulnerability scan: what each does, how NIST defines them, how PCI DSS 11.3 (scans) differs from 11.4 (pentests), and a table to pick one.

> **Short answer:** A vulnerability scan lists known weaknesses with software and runs often. A penetration test has a person or an agent try to exploit weaknesses and prove their effect. PCI DSS v4.0.x keeps them apart: requirement 11.3 covers scans and 11.4 covers pentests, so one does not replace the other.

In a pen test vs vulnerability scan comparison, a scan finds candidates and a pentest proves which ones an attacker can use. A scan is software run against many assets on a schedule. A pentest has a person or an agent try to exploit weaknesses and record the effect. Many teams need both, at different intervals.

## What is the difference between a pentest and a vulnerability scan?

A vulnerability scan checks systems against a list of known weaknesses and reports matches. A penetration test chains weaknesses and tries to reach data or functions the tester should not reach.

NIST's glossary gives two definitions that fit. It describes penetration testing as evaluators, usually operating within defined limits, who "attempt to circumvent or defeat the security features of a system" (from NIST SP 800-53 and SP 800-12). It describes a vulnerability assessment as a "systematic examination of an information system or product to determine the adequacy of security measures" (CNSSI 4009-2022).

In practice a scan returns a long list with severity scores. A pentest returns a short list where each item has evidence of an effect, such as another user's record read back. The scan list needs triage, and the pentest list needs fixes.

Pick by the question you need answered.

| Your situation | Vulnerability scan | Pentest |
|---|---|---|
| You need a regular check of many hosts or domains for known issues | Fits | Too slow and too costly |
| You need proof that a flaw can be exploited | Not enough on its own | Fits |
| You run a web app with roles, tenants and payments | Finds missing patches and headers | Tests authorization and business logic |
| An auditor asks for a recurring scan report | Fits (PCI DSS 11.3) | Does not replace it |
| An auditor asks for a pentest report | Does not replace it | Fits (PCI DSS 11.4) |
| You shipped a major change | Run a scan | Run a scoped pentest of the change |
| You have a small budget and no prior testing | Start here to clear known issues | Add after the first scan is clean |
| A customer asks for a pentest report in a security review | Ask the customer; a scan report is a different document | Fits |

No standard sets what a customer accepts in a security review, so ask them in writing. Read each product's report before you buy, because the [provider table](/providers/) lists automated products next to manual services. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what to check.

## What does PCI DSS 11.3 versus 11.4 say?

PCI DSS v4.0.x splits scanning and pentesting into separate requirements, so a scan never counts as a pentest. Requirement 11.3 covers vulnerability scans. Requirement 11.4 covers penetration testing. In v3.2.1 the numbers were different (scans in 11.2 and pentests in 11.3), which is why older articles cite 11.3 for pentests.

PCI SSC published v4.0.1 on 11 June 2024 as a limited revision with no added or deleted requirements, and it is the only active version since 31 December 2024.

| | 11.3 vulnerability scans | 11.4 penetration testing |
|---|---|---|
| Frequency | At least once every three months, internal and external, plus after significant changes | At least once every 12 months and after significant infrastructure or application changes |
| Who | Internal scans by qualified personnel. External scans (11.3.2) by a PCI SSC Approved Scanning Vendor | A qualified internal resource or external third party with organizational independence |
| Fix and repeat | High-risk and critical findings are fixed and rescanned | Exploitable findings are corrected and the testing is repeated (11.4.4) |
| Method | Scanner against known issues | Documented methodology, internal and external testing (11.4.1) |

PCI SSC's own summary of changes confirms 11.4.1 (methodology defined, documented and implemented), 11.4.4 (findings corrected in accordance with the entity's risk assessment) and 11.4.7 (multi-tenant service providers support customers' external pentests). The 11.3 wording in the table comes from secondary pages such as the Stingrai article in our sources, because the v4.0.1 PDF is behind a click-through gate. Check the exact text in the PDF or with your QSA before you quote a number to an auditor.

PCI guidance says its report outlines "are only suggested outlines and do not define specific reporting requirements". Your QSA decides what applies to you.

## How do scanners and pentests overlap, and how should you combine them?

Both start with discovery, and AI-assisted tools blur the line. Some products named "automated pentest" run for hours, try exploits and validate findings. Others rerun a scanner and relabel the output. To tell them apart, read a sample and look for the request, the response and the effect for each finding. Our [automated pentesting tools guide](/guides/automated-pentesting-tools/) sorts the tools by category.

Scanners also miss flaws that depend on how your app works. OWASP's Web Security Testing Guide has a business logic section (WSTG-BUSL) covering data validation, forged requests, process timing, workflow circumvention and payment functionality. A scanner has no model of your pricing rules or your tenant boundaries, so those tests need a person or an agent with account access.

Run scans on a schedule and pentests after meaningful change. One pattern for a SaaS team is a monthly or quarterly scan of all internet-facing assets, an annual pentest, and a scoped pentest after a major release. PCI DSS sets the minimum intervals (quarterly scans, annual pentests) for in-scope systems. For other goals, such as [SOC 2 evidence](/guides/soc-2-penetration-testing-providers/), ask your auditor what they accept.

Fix findings from a scan before you buy a pentest. A pentest that spends days on missing patches wastes the budget on issues a scan would have listed for free.

## Questions

### Is a vulnerability assessment the same as a vulnerability scan?

Not exactly. NIST's glossary defines a vulnerability assessment as a systematic examination of a system to determine the adequacy of security measures and identify weaknesses. A scan is one tool inside that work. Vendors use the two terms loosely, so ask what the deliverable is.

### Can an AI pentest tool replace a vulnerability scan?

They do different jobs. A scan checks many assets against known issues on a schedule. An AI pentest agent tries to exploit and prove a finding. Some platforms bundle both. Check what each product reports and whether it proves effect with evidence.

### Which one do auditors want?

It depends on the standard and the auditor. PCI DSS names both in separate requirements. SOC 2 does not name a test type. Ask your auditor in writing what evidence they accept, and show them a sample of the report.

## Sources

- [NIST CSRC glossary: penetration testing](https://csrc.nist.gov/glossary/term/penetration_testing)
- [NIST CSRC glossary: vulnerability assessment](https://csrc.nist.gov/glossary/term/vulnerability_assessment)
- [PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0 (11.4.1, 11.4.4, 11.4.7)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)
- [PCI SSC blog: Just published, PCI DSS v4.0.1](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1)
- [Stingrai: PCI DSS penetration testing requirement 11.4 (secondary, quotes 11.3.1 and 11.3.2)](https://www.stingrai.io/blog/pci-dss-penetration-testing-2026)
- [PCI DSS v4.0.1 PDF (gated by a click-through)](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf)
- [PCI SSC Penetration Testing Guidance v1.1](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [OWASP Web Security Testing Guide: business logic testing](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/10-Business_Logic_Testing/01-Test_Business_Logic_Data_Validation/)


---

# Penetration testing as a service (PTaaS) vs traditional pentesting

Source: https://pentestcompare.com/guides/ptaas-vs-traditional-pentesting/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing as a service explained: how PTaaS platforms, consultancies and automated tools differ in contract, price and retesting, with named providers.

> **Short answer:** Penetration testing as a service (PTaaS) delivers pentests through an online platform, usually sold as credits or a subscription. Traditional consultancies sell scoped projects with a final report. Automated tools sell software runs. The dataset shows all three, and the labels overlap: several consultancies now sell PTaaS plans.

Penetration testing as a service (PTaaS) is a way of buying pentests through an online platform, where you scope a test, follow findings as testers report them, and request retests. Providers use the term loosely. In the [PentestCompare dataset](/), checked on 9 November 2026, we found three kinds of provider: platforms, consultancies and automated tools. The kinds overlap.

## What is PTaaS, and how do platforms, consultancies and automated tools differ?

There is no standard definition of PTaaS, so we describe how providers use the term on their own pages. Cobalt and BreachLock are typed as PTaaS platforms in the dataset. Both give buyers a portal where findings appear during the test. Cobalt says results appear in the platform as testing proceeds. Pen Test Partners, a consultancy, sells a PTaaS plan too: you buy blocks of time, billed in half-day blocks, for tests from half a day to two days, and it describes results in real time with a short report at the end of the test window.

So PTaaS describes how you buy and receive a test. It says nothing about who tests or how well.

| | PTaaS platform or crowd platform | Traditional consultancy | Automated tool |
|---|---|---|---|
| Examples in the dataset | [Cobalt](/providers/cobalt/), [BreachLock](/providers/breachlock/), [HackerOne](/providers/hackerone/), [Synack](/providers/synack/) | [Pen Test Partners](/providers/pen-test-partners/), [Secure Ideas](/providers/secure-ideas/) | [Horizon3.ai](/providers/horizon3/), [XBOW](/providers/xbow/), [Escape](/providers/escape/) |
| Who tests | Vetted freelancers or researchers, an in-house team, or both with AI agents | Staff of the firm | Software or AI agents |
| How you buy | Credits, annual packages, platform subscriptions | Flat-fee projects, day rates, prepaid credits | Per asset, per test or subscription |
| How you see results | In the platform during the test | Final report; some firms add a portal | In the platform or console |
| Retesting | Often in the platform, with stated windows | Quoted separately in many cases | Often included or re-run on demand |
| Published price | Some (Cobalt, Synack) | Secure Ideas yes; Pen Test Partners no | Horizon3.ai yes; XBOW and Escape no |

The edges blur. Cobalt sells human-led annual tiers and an autonomous pentest. Secure Ideas, a consultancy, sells prepaid credits for what it calls PETaaS. HackerOne sells a human-led product and an agentic product. The [AI vs human guide](/guides/ai-vs-human-pentesting/) covers who does the testing.

## How do contracts, pricing, speed and retesting differ?

PTaaS contracts are mostly recurring. Cobalt's Standard, Premium and Enterprise tiers are annual credit packages, and one credit equals 8 hours of testing. Synack bills tests through credits that expire one year after purchase, and it requires a platform subscription, billed separately, with no published price. BreachLock describes Standard, Extended and Extensive tiers with no dollar figures.

Consultancies lean toward scoped projects. Secure Ideas publishes flat-fee starting prices ($8,160, $10,880 and $13,600 for the smallest scope of three test types) and a $340 hourly rate. Pen Test Partners publishes no prices.

Automated tools often sell by asset. Horizon3.ai's unit is a discovered asset such as a server, device or cloud resource, not a test. The [cost guide](/guides/penetration-testing-cost/) has the full table and explains why these units cannot be compared directly.

Platforms advertise fast starts. Cobalt's annual tiers start within 3, 2 or 1 business days (Standard, Premium, Enterprise), with a footnote that start times vary by engagement type. Pen Test Partners says its PTaaS plan can start immediately, and gives no time for standard tests. Secure Ideas says testing usually starts two to four weeks after contracting, followed by one to two weeks of testing.

Retest terms differ more than speed. Cobalt's pricing table gives 6 or 12 months of free retesting by tier, while its FAQ says unlimited on-demand retesting during the contract. HackerOne docs list unlimited retests during the remediation period, typically 30 or 90 days, and older posts say 60 days and two retests. Secure Ideas does not include retesting by default. These statements are the providers' own, and some conflict. Ask for the retest terms in the contract.

## When does each model fit, and what does a PTaaS platform not tell you?

Pick the model by how often you test and how you want to work:

- A platform fits teams that test several times a year and want findings in a tracker as they appear. The annual package suits a stable testing calendar.
- A consultancy fits a single, deep, one-off project, or a buyer with a regulatory requirement for a named accredited firm. Pen Test Partners lists NCSC CHECK, which applies to UK public-sector work.
- An automated tool fits frequent testing of many assets or releases, where you accept limited human review.

A consultancy can also be a platform vendor, so ask what the contract delivers before you choose by label.

A platform's portal says how you receive findings. Who found them, and how deep the test went, depend on the provider. Cobalt describes vetted freelance testers, and its pricing page also lists AI agents and a separate autonomous pentest. BreachLock describes its team as in-house, expert-led and AI-accelerated. HackerOne and Synack draw on crowds of researchers. These are different labor models behind similar portals, and the dataset has no measure of tester quality for any of them.

Check credentials the same way for every model. Cobalt lists CREST accreditation, SOC 2 Type II and ISO 27001 on its Trust Center. BreachLock and Pen Test Partners list CREST on their homepages. Those are vendor claims and describe the company, not the individual tester on your job. Ask who will test your application.

## What should you ask a PTaaS vendor?

1. Is the price a package, a subscription or a per-test fee? What does it cost for the same scope as a one-off?
2. Who tests, and who reviews findings?
3. What happens to unused credits at the end of the term?
4. How long do retests last, and what happens after the window?
5. Can you export a report, and is a sample report available?

The [questions guide](/guides/questions-to-ask-a-pentest-provider/) has the full list. For bug bounty programs, which are a different model, see [bug bounty vs pentest](/guides/bug-bounty-vs-pentest/).

## Questions

### Is PTaaS the same as continuous pentesting?

Not by definition. PTaaS describes a platform and a buying model. Some providers pair it with continuous or on-demand tests, and others sell point-in-time tests through a platform. Read the contract for the test frequency.

### Do PTaaS tests cost less than consultancy projects?

The published prices do not settle it. Units differ: credits, subscriptions and flat fees. Ask each provider for a total for the same scope and compare.

## Sources

- [Cobalt pricing](https://www.cobalt.io/pricing)
- [Pen Test Partners: PTaaS service page](https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/)
- [Secure Ideas pricing](https://secureideas.com/pricing)
- [BreachLock homepage](https://www.breachlock.com/)
- [HackerOne pentest product page](https://www.hackerone.com/product/pentest)
- [Synack pricing](https://www.synack.com/pricing/)
- [Horizon3.ai NodeZero pricing](https://horizon3.ai/use-case/pricing/)


---

# Questions to ask a pentest provider before you sign

Source: https://pentestcompare.com/guides/questions-to-ask-a-pentest-provider/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

24 questions to ask a pentest provider, grouped by scope, people, method, report, retest and contract. Each has the reason to ask and a good answer signal.

> **Short answer:** Ask a pentest provider 24 questions in six groups: scope, who tests, method and safety, report, retest and contract. Each question below has a reason and a good answer signal. A vague or sales-only answer to scope, evidence or retest questions is the strongest warning sign before you sign.

Send these 24 questions to each pentest provider in writing, with your scope, so you compare providers on the same terms. Each row gives the reason to ask and the signal of a good answer. A provider that answers 20 of them clearly and admits gaps on the rest is easier to trust than one that answers all 24 with sales copy.

## Scope questions

Scope decides what you pay for and what stays untested. Start here, because every later answer depends on it.

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 1 | Which of my assets do you test: web app, API, cloud, network, mobile, AI features? | Providers differ. In our [dataset](/providers/), 8 of 14 do not state cloud testing on their pages, and a "?" means the provider does not say. | A yes or no for each asset type, with the assets named in the proposal. |
| 2 | What do you need from me to start: accounts, roles, API docs, test data? | Missing roles cause shallow tests, because authorization flaws need two or more accounts. | A written list with the number of accounts and roles per tenant. |
| 3 | Do you test in production or in staging, and what do you avoid? | Testing writes data. Destructive proofs on production can break users. | Test-owned accounts and records marked as test data, and a stated list of avoided actions. |
| 4 | How do you handle third-party and cloud providers in scope? | Hosting providers set their own rules. AWS says customers may test listed services without prior approval, and that testing with command and control needs prior approval. | The provider knows the host's policy and tells you what it needs from you. |
| 5 | What is explicitly out of scope, and what happens if you find something out of scope? | An unplanned finding on a neighbor system is a legal and safety problem. | A stop rule: the tester halts, reports to your contact and waits for written approval. |

## Questions about who tests and how

The report names a company. The work is done by people or by software, and you should know which.

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 6 | Who or what does the testing: staff, freelancers, a crowd, an AI agent, or a mix? | Delivery types differ. Cobalt and Synack use vetted external testers. XBOW and Horizon3.ai run autonomous platforms. See [PTaaS versus traditional testing](/guides/ptaas-vs-traditional-pentesting/). | A plain description of each role, with the human steps named. |
| 7 | Does a human review each finding before I see it? | Automated tools produce false positives. Review cuts noise. | Yes or no, and who reviews. "AI verifies" is a different claim from "a person reviews". |
| 8 | What credentials do you hold, and what do they cover? | PCI SSC guidance says certifications are not required and that qualifications "cannot be met by certifications alone". Badges alone do not show who tests your app. | The scheme name, what it covers (a company or an individual) and a link to the public register. |
| 9 | Are the testers independent of the systems they test? | PCI DSS expects organizational independence for the tester. PCI SSC guidance says a firm that installed or supports the target systems cannot also test them for PCI. | A direct statement about independence and any prior work on your systems. |
| 10 | Will the same people test and write the report? | Handoffs lose detail. | Named roles, or a statement that the tester writes the findings. |

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 11 | What methodology and guides do you follow? | A named guide such as OWASP's Web Security Testing Guide or API Security Top 10 gives you a coverage baseline. | Names the guides and says where the test goes beyond them. |
| 12 | How do you test business logic and authorization, beyond known vulnerability classes? | Scanners miss flaws that depend on how your app works. | Examples: two-account tests, workflow-skip tests and limit tests. |
| 13 | What is the evidence standard for a finding? | A "success" response is not proof of an effect. | A finding needs an effect shown by request, response and read-back. |
| 14 | What controls do you run next to each exploit attempt? | Controls tell you what held. | Nonexistent IDs, wrong tokens and anonymous comparisons are listed in the plan. |
| 15 | What are your safety limits for uploads, password guessing, email and paid APIs? | These tests cost money or touch real people. | Bounded tests, stated cost, and a rule to stop. |

## Report and retest questions

Ask to see the output before you buy. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) lists nine signals to check.

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 16 | Can I see a sample or a redacted real report? | Four of 14 providers in our dataset publish a sample and two give one on request. | A link or a file within the sales process, with no gate that hides the content. |
| 17 | What does each finding include? | You need steps your engineer can repeat. | Description, impact, evidence, reproduction, remediation. |
| 18 | How do you define severity? | An undefined severity cannot be ranked or challenged. | A written four- or five-level scale, or a stated CVSS version. |
| 19 | What formats and summaries do you deliver, and can I share a version with customers? | Your buyers may ask for a summary or letter. No standard defines a letter, and PCI SSC calls its report outlines "only suggested outlines". | Full report plus a customer-safe summary, with a clear statement on what it claims. |

A retest checks that your fix works.

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 20 | Is a retest included, for how long, and how many? | Terms vary widely. HackerOne's docs describe unlimited retests during a remediation period of typically 30 or 90 days. Cobalt's pricing table shows 6 or 12 months of free retesting while its FAQ says unlimited during the contract. TurboPentest describes a retest as a new pentest at the same per-target price. Secure Ideas lists retesting only as a factor that can change a quote. | The terms in writing, with the window, the limit and any fee after the window. |
| 21 | How long after I report a fix do you retest? | HackerOne's docs say results usually arrive in around 72 hours once a tester claims the request. | A stated time and the conditions it depends on. |

## Contract and price questions, and how to use the answers

Price is only comparable when the unit and the inclusions are known.

| # | Question | Why it matters | Good answer signal |
|---|---|---|---|
| 22 | What is the price unit: per test, per target, per year, credits? | Units differ. Aikido, TurboPentest and Secure Ideas publish prices in different units. See the [cost guide](/guides/penetration-testing-cost/). | One total for your scope, plus what moves it. |
| 23 | What happens if scope grows or the test needs more time? | Overrun terms drive the final cost. | A rate, a cap or a change process in the contract. |
| 24 | How do you handle my data, reports and test accounts after the test? | Reports hold your weaknesses. | Retention period, access control, and deletion on request. |

Put answers side by side in a sheet. Mark each as clear, partial or missing. A missing answer on scope (1 to 5), evidence (13), or retest (20) should slow the purchase. Missing answers on credentials or price can be fixed with a follow-up.

Use the [provider table](/providers/) to see what each provider already states, and ask only about the gaps. If a provider tells you something that disagrees with its public pages, ask for it in the proposal, because the proposal is the binding record.

## Questions

### How many providers should I ask?

Two or three is enough for most buyers. Send all of them the same scope and the same questions, so the answers are comparable. Compare the written answers.

### Should I ask for references?

You can, but a provider picks its own references. A redacted report from a real engagement of similar scope tells you more. Ask both, and treat a refusal to share any redacted work as a gap to note.

### What if the provider answers 'it depends'?

Ask what it depends on. A good answer names the factors, such as number of roles, API endpoints or environments, and says how each moves the quote. An answer that stays vague after that is a signal about how the project will run.

## Sources

- [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [AWS Penetration Testing policy](https://aws.amazon.com/security/penetration-testing/)
- [HackerOne docs: retesting pentests](https://docs.hackerone.com/en/articles/8541386-retesting-pentests)
- [Cobalt pricing page (retesting table and FAQ)](https://www.cobalt.io/pricing)
- [TurboPentest pricing page](https://turbopentest.com/pricing)
- [Secure Ideas pricing page](https://secureideas.com/pricing)
- [PCI SSC summary of changes, PCI DSS v3.2.1 to v4.0](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf)
- [Aikido pricing page](https://www.aikido.dev/pricing)


---

# SOC 2 penetration testing providers: what to compare

Source: https://pentestcompare.com/guides/soc-2-penetration-testing-providers/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

SOC 2 penetration testing providers compared on sample reports, credentials and retest terms, with the AICPA wording and the evidence to request.

> **Short answer:** SOC 2 does not require a penetration test, but the AICPA criteria name penetration testing as one example of an evaluation, and many auditors ask for a recent third-party report. No provider can promise auditor acceptance. Compare sample reports, scope statements, retest letters and tester details, and ask your auditor first.

SOC 2 penetration testing providers differ in what they publish. Some name SOC 2 on their pages, some show a sample report, and some list credentials. Most leave auditor acceptance to you, and no provider can promise that your auditor will accept its report. Facts come from the [PentestCompare dataset](/), checked on 9 November 2026.

## Does SOC 2 require a penetration test, and what do auditors ask for?

No. SOC 2 is an attestation against the AICPA Trust Services Criteria (TSC). The criteria set objectives, and a company picks controls to meet them. The 2017 criteria (March 2020 update) say that "Use of the trust services criteria does not require an assessment of whether each point of focus is addressed."

Penetration testing appears once, as an example. Under CC4.1, the point of focus "Considers Different Types of Ongoing and Separate Evaluations" reads: "Management uses a variety of different types of ongoing and separate evaluations, including penetration testing, independent certification made against established specifications (for example, ISO certifications), and internal audit assessments."

CC7.1 asks the entity to use "detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities." Its point of focus covers vulnerability scans and does not name pentests.

We quote the 2017 text as hosted in a third-party copy. AICPA also publishes a 2022 revision of the points of focus behind a free login, and we have not read it. Its wording may differ. Linford & Co, a CPA firm, writes that a vulnerability scan or penetration test "is not required" to meet the Trust Services Criteria for a SOC 2 report and that "The specific controls that must be met are not provided by the AICPA Trust Services Criteria." In practice, auditors and customers commonly ask for a recent third-party pentest report.

Compliance platforms show what evidence they collect. Drata's control DCF-19 asks you to "Upload evidence of the most recent penetration testing activities". Vanta describes findings with "severity, steps to reproduce, and recommendations for remediation" and says "a retest can confirm vulnerabilities have been resolved". These are platform help pages, not audit rules.

Your auditor decides what is enough. Ask the auditor three things before you buy: whether a pentest is expected, what tester independence they want, and what the report must contain.

## Which provider fields matter for SOC 2 evidence?

The table shows five dataset fields that bear on audit evidence, for providers whose pages mention SOC 2. Excession Labs (publisher of this site) is one row.

| Provider | Delivery | Sample report | Retesting (provider's statement) | Credentials listed |
|---|---|---|---|---|
| [Aikido](/providers/aikido/) | Automated | Public | Free for up to 6 months | SOC 2, ISO 27001, ISO 42001, CREST (as listed on the AI pentest page; CREST may relate to the human-led option) |
| [BreachLock](/providers/breachlock/) | Hybrid | On request | Free manual retests: 1, 2 or custom by tier | CREST accreditation |
| [Cobalt](/providers/cobalt/) | Hybrid | On request | Pricing table says 6 or 12 months; FAQ says unlimited during the contract | SOC 2 Type II, ISO 27001, CREST |
| [Escape](/providers/escape/) | Automated | Not published | No limits stated | None listed |
| [Excession Labs](/providers/excession-labs/) | Hybrid | Public (sample for an invented app) | Offered; terms set in each quote | None listed |
| [HackerOne](/providers/hackerone/) | Hybrid | Not published | Unlimited retests in the remediation period (30 or 90 days), per docs | None listed |
| [Hadrian](/providers/hadrian/) | Hybrid | Not published | Not published | SOC 2 Type 2 (badge) |
| [Parameter](/providers/parameter/) | Automated | Public | Free, listed for Single App | SOC 2 Type I |
| [Secure Ideas](/providers/secure-ideas/) | Human-led | Public | Not included by default; may change the quote | CREST |
| [Synack](/providers/synack/) | Hybrid | Not published | Patch verification included in each product | FedRAMP authorized (level not stated) |
| [TurboPentest](/providers/turbopentest/) | Automated | Public | Paid new run; free re-test if no actionable findings (once per domain) | Its own PCI DSS and CMMC compliance, a vendor claim |
| [XBOW](/providers/xbow/) | Automated | Not published | Free and unlimited | None listed |

A provider's own credentials describe the provider and not your audit: its SOC 2 report covers its own controls. The dataset also records each SOC 2 mention as marketing text. XBOW's page lists SOC 2 and other frameworks without making clear whether XBOW holds the certification or supports the framework.

Pen Test Partners, Horizon3.ai and Terra Security do not name SOC 2 in the dataset. Terra lists a SOC 2 Type II badge among its credentials but names no frameworks on its page.

## What evidence should you request from a provider?

Ask for these documents. Each answers a question your auditor may ask.

| Document | What it shows | What to check |
|---|---|---|
| Sample report | What you would receive | Severity scale, reproduction steps, evidence, remediation advice, a limitations section |
| Scope statement | What was and was not tested | Named apps, APIs, environments, roles, dates, exclusions |
| Retest letter or retest section | That fixes were verified | Date of original test, date of retest, which findings were retested and the result of each |
| Tester information | Who did the work | Who tests, who reviews, the tester's independence from the systems tested |
| Method statement | How the test ran | Black, grey or white box, tools, and whether humans validate findings |
| Attestation letter, if offered | A short summary for customers | What it states and what it does not. No standard defines this letter. |

The PCI SSC Penetration Testing Guidance (v1.1, September 2017) says its report outlines "are only suggested outlines and do not define specific reporting requirements for PCI DSS penetration tests." SOC 2 sets no format either, so agree the contents with your auditor.

An attestation letter is a vendor document. Vendors that sell letters say acceptance varies, so never treat a letter as auditor-approved. TurboPentest and Parameter mention letters or auditor-mapped reports on their pages. Ask your auditor if it accepts them.

## How should timing work for a Type II audit, and how do you compare providers?

A Type II audit covers a period. Top Floor Security, a testing vendor, advises running the test early in the period so the fix and retest also fall inside it. That is a vendor view. Choose a provider that publishes a retest window you can use inside your period. For example, Cobalt, Aikido and HackerOne publish windows of months or weeks. Confirm dates with your auditor.

Send the same scope summary to each provider. Then compare the documents listed above. A short list might hold one automated provider, one platform and one consultancy, so you see the range of evidence each delivery type gives. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) shows how to read the samples. The [cost guide](/guides/penetration-testing-cost/) shows what each model costs.

## Questions

### Does my SOC 2 auditor have to accept a given provider's report?

No rule makes an auditor accept a given provider. The auditor sets its own evidence standard. Send the sample report and scope statement to your auditor before you buy, and keep their reply.

### Should the pentest fall inside the Type II audit period?

Top Floor Security, a testing vendor, advises running the test early in the audit period so the fix and the retest also fall inside it. This is a vendor view. Confirm the dates with your auditor.

### Is a provider's own SOC 2 report the same as a SOC 2 pentest?

No. A provider's SOC 2 report covers the provider's own controls. Your SOC 2 report covers yours. A pentest is one kind of evidence you can give your auditor.

## Sources

- [AICPA TSP 100, 2017 Trust Services Criteria (March 2020 update), copy hosted by Arpio](https://arpio.io/wp-content/uploads/2020/08/trust-services-criteria.pdf)
- [AICPA: 2017 Trust Services Criteria with revised points of focus, 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)
- [Linford & Co: pentesting for SOC 2](https://linfordco.com/blog/what-is-penetration-testing-soc-2/)
- [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [Drata Help: example evidence for not-monitored controls](https://help.drata.com/en/articles/9421165-example-evidence-for-not-monitored-controls-soc-2)
- [Top Floor Security: Does SOC 2 require a penetration test?](https://topfloorsecurity.com/insights/does-soc-2-require-a-penetration-test/)
- [Vanta Help: penetration testing](https://help.vanta.com/en/articles/12511759-penetration-testing)
- [Aikido AI pentest page](https://www.aikido.dev/attack/aipentest)
- [Cobalt Trust Center](https://www.cobalt.io/trust-center)


---

# Compare penetration testing providers

Source: https://pentestcompare.com/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Compare pentest providers on testing scope, human or automated delivery, published prices and units, turnaround, retesting and sample reports. Sourced and dated.

Compare penetration testing providers on the facts that change the result
What each provider tests, who does the testing, published prices with their units, turnaround, retesting and sample reports, each linked to the provider's own page with the date we checked it.
Compare providersScoping checklist
Sorted A to Z, not rankedUnknown means "not published"No paid placementHow we compare

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |

What to check before price

DeliveryWho does the testing?. Human-led means named testers do the work, with tools. Automated means software runs the test. Hybrid mixes both: for example an AI agent with human review, or a platform with a pentester. The difference shows up most in business logic and access control.
ScopeDoes it test what you have?. Check each surface you need: web app, API, cloud, network, mobile or AI features. A provider that tests networks well may not test multi-tenant SaaS authorization at all.
Price unitsWhat does the price buy?. One test, a year of scans, a number of credits or a monthly subscription. Check what is included: retest, report letter, readout call. Cost guide

Send every provider the same scopeQuotes only compare when the scope matches. The scoping checklist collects what providers ask for: hosts, roles, API size, environments, deadlines and report needs. It produces a summary you can paste into each request. Nothing leaves your browser.Open the scoping checklist
Buyer guides

How much does a penetration test cost?
Pentest providers for startups
Providers for SOC 2 evidence
AI vs human pentesting
PTaaS vs traditional pentesting
Judge a provider by its sample report

See all guides and the head-to-head comparisons.

Who publishes this, and how to use the dataExcession Labs publishes PentestCompare and also sells penetration testing. We are listed as one provider, under the same rules as everyone else: not placed first, and our unknowns say "not published" like any other. If you want to talk to us about your own test, use the clearly labeled Excession Labs contact form. It does not go to the other providers.
The full table is available as JSON and CSV under CC BY 4.0, with sources and check dates for every field. Found something wrong or out of date? Send a correction.Read how we compare, the head-to-head comparisons and the glossary.

## Questions

### Who publishes PentestCompare?

Excession Labs, which also sells penetration testing and appears in the table as one provider. We disclose this on every page. The table is sorted alphabetically, not ranked, and every profile uses the same fields and rules. [Methodology](/methodology/)

### Why do some cells show a question mark?

A question mark means the provider does not say on its public pages. It does not mean no. We do not guess or estimate missing values. If you know a published source, [send a correction](/methodology/#corrections).

### Can I compare the prices directly?

Only with care. Providers price per test, per year, per month or with credits, and an automated scan is a different product from a manual engagement. Read the unit and what the price covers in each profile. The [cost guide](/guides/penetration-testing-cost/) explains the pricing models.

### How often is the data checked?

Each profile shows the date we last checked the provider's own pages, and every fact links to its source. We recheck when a provider asks for a correction and when we update the guides.

### Do providers pay to be listed?

No. Providers do not pay for listings, placement or clicks, and we do not use affiliate links.


---

# How PentestCompare works: publisher, method and corrections

Source: https://pentestcompare.com/methodology/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Who publishes PentestCompare, how the 15 providers were chosen, what each field means, how facts are checked, what we do not do, and how to send a correction.

PentestCompare is published by Excession Labs. Excession Labs also sells penetration tests, and it appears in the provider table as one row. We do not rank providers, and the table is sorted A to Z. The data was last checked on 9 November 2026.

## Who publishes this site, and how did we choose the 15 providers?

Excession Labs publishes PentestCompare and pays for it. Excession Labs sells web application, API and AI application testing, so it competes with the other providers listed. We handle that conflict in four ways:

- Excession Labs is one row in the table, with the same fields as the others.
- The table has no ranking, score or "best" label. It is sorted A to Z by provider name.
- No provider pays for a listing or a position.
- Every fact comes from a public page, and each profile shows the source and the date we checked it.

If a page here reads like advice to buy from Excession Labs, report it with the correction form below.

We aimed to cover every delivery type a buyer meets: consultancies with human testers, crowdsourced and PTaaS platforms, and automated or AI-agent products. The list draws on two sources. The first is a review of 24 competing firms dated 8 November 2026. The second is a set of well-known providers that the review did not cover. BreachLock and Horizon3.ai are in the second group. Pentera was considered and dropped because we found too little public information about it.

The list is incomplete and unranked, and a provider's absence says nothing about its quality. To suggest a provider, send it through the correction form.

## Provider table, field definitions and open data

| Provider | Delivery (by its own description) | Type |
|---|---|---|
| [Aikido](/providers/aikido/) | Automated | Application security platform |
| [BreachLock](/providers/breachlock/) | Hybrid | PTaaS platform |
| [Cobalt](/providers/cobalt/) | Hybrid | PTaaS platform |
| [Escape](/providers/escape/) | Automated | Application security platform |
| [Excession Labs](/providers/excession-labs/) (publisher) | Hybrid | AI-assisted testing service |
| [HackerOne](/providers/hackerone/) | Hybrid | Crowdsourced platform |
| [Hadrian](/providers/hadrian/) | Hybrid | Autonomous testing platform |
| [Horizon3.ai (NodeZero)](/providers/horizon3/) | Automated | Autonomous testing platform |
| [Parameter](/providers/parameter/) | Automated | AI-assisted testing service |
| [Pen Test Partners](/providers/pen-test-partners/) | Human-led | Consultancy |
| [Secure Ideas](/providers/secure-ideas/) | Human-led | Consultancy |
| [Synack](/providers/synack/) | Hybrid | Crowdsourced platform |
| [Terra Security](/providers/terra-security/) | Hybrid | AI-assisted testing service |
| [TurboPentest](/providers/turbopentest/) | Automated | AI-assisted testing service |
| [XBOW](/providers/xbow/) | Automated | Autonomous testing platform |

| Field | Meaning |
|---|---|
| Delivery | Who does the testing, as the provider describes it. Human-led: people run the tests. Hybrid: people and AI agents or a crowd work together, or the provider sells both. Automated: software or AI agents run the tests, and any human step is limited or not described. We assign the label from the provider's own text, since we did no hands-on testing. |
| Scope | Web app, API, cloud, network, mobile and AI apps. Each is yes, no or unknown. Yes means the provider's pages name it. Unknown means the pages we read do not say; it is not a no. |
| Pricing model | Published (list prices with units), mixed (some prices published, some by quote) or custom quote (no prices). |
| Price units | We copy the unit the provider uses: per test, per asset, per credit, per hour, per month or per year. Units are not comparable with each other. The [cost guide](/guides/penetration-testing-cost/) explains why. |
| Turnaround | The provider's own claim, plus what the claim measures (time to start, time to first findings or time to final report). |
| Retesting | The provider's stated terms. When its pages disagree, we show both statements. |
| Sample report | Public (a link), on request or not published. |
| Credentials | Certifications and accreditations the provider lists, with the page that lists them. We report them as claims. |

The dataset is free to reuse under CC BY 4.0. Credit PentestCompare and link to this page.

- [providers.json](/data/providers.json)
- [providers.csv](/data/providers.csv)

## How we check facts, and what we do not do

- We read the provider's own pages: pricing, product, security or trust center, and documentation. A search snippet is not a source.
- Each fact carries a source URL and a check date. The profile shows the date, and the dataset has a `last_checked` field.
- A value the provider does not publish appears as "Not published" or "unknown". We do not estimate prices, turnaround or scope.
- We give no ratings or scores. We do not copy review-site scores.
- A vendor claim stays a claim. If a page says "no human drives the attack", we write "the vendor says".
- When a provider's pages contradict each other, we show both statements and say so.
- We use no affiliate links. Links to providers go to their official sites.

We have not tested any provider's service. We did not buy a test, read a customer report or measure a vendor's accuracy. Findings quality, tester skill and report quality are outside what public pages can show, and the data here cannot tell you which provider is better. To judge quality, ask for a sample report and a scope statement. The [sample report guide](/guides/judge-a-pentest-provider-by-its-sample-report/) and the [questions guide](/guides/questions-to-ask-a-pentest-provider/) say what to look for.

We do not rely on provider reviews, and we publish no testimonials.

## Corrections

Prices, plans and credentials change often. If a fact here is wrong or out of date, send the provider name, the page, what you think is correct, and a public link that shows it. We re-read the source, fix the data when the source supports your report, and note the change. Any listed provider can use the same form, Excession Labs included. A correction needs a public source. We do not remove a fact because a provider asks us to, but we do update it when its page changes.

[Use the form on this page](https://pentestcompare.com/methodology/)


---

# Privacy notice

Source: https://pentestcompare.com/privacy/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

What PentestCompare collects when you visit or send a request, why, where it is stored, how long we keep it and how to contact Excession Labs about your data.

Effective 9 November 2026. PentestCompare (pentestcompare.com) is operated by **Excession Labs**. Contact: [privacy@excessionlabs.ai](mailto:privacy@excessionlabs.ai).

## When you send a form

We collect what you type in the form, for example your name, work email, company, application address and your answers about the test you need. We also record:

- the page you sent it from, the first page you visited in that browser session, the referring website and any campaign tags in the link (such as `utm_source`);
- your country, your browser's user-agent string and a one-way hash of your IP address, used to stop abuse.

We use these details only to reply to you, to scope and deliver the work you asked about, and to understand which pages bring requests. We store submissions in a Cloudflare D1 database and send a copy to the Excession Labs team mailbox by email.

Do not send passwords, API keys, system prompts or real customer data through a form or by email. We agree access to test systems separately and in writing.

## Spam protection

Forms use [Cloudflare Turnstile](https://www.cloudflare.com/turnstile-privacy-policy/) to check that a person sent them. Turnstile processes signals from your browser to do this.

## Analytics

We use [PostHog](https://posthog.com/privacy) (EU cloud) in cookieless mode to count page views and clicks on calls to action. It does not set cookies and does not record sessions. PostHog may use your IP address to estimate your location. We also keep our own log of some clicks (for example on calls to action or links to other sites) with the page, time and country, without cookies.

The site keeps the landing page, referrer and campaign tags of your visit in your browser's session storage, so a form can include them. Session storage is cleared when you close the tab.

## Scoping checklist

The [scoping checklist](/tools/scoping-checklist/) saves your ticks and notes in your browser's local storage, so they are still there when you come back. They are never sent to us. Clear your browser's site data to remove them.

## Provider links

When you click a link to a provider's website, we record the click (provider, page, time, country) without cookies, so we can see which profiles are useful. We do not share your details with any provider, and providers do not pay us for listings or clicks.

## Sharing

We do not sell your data and we do not use advertising pixels on this site. Service providers that process data for us: Cloudflare (hosting, database, email routing and Turnstile) and PostHog (analytics).

## How long we keep it

We keep enquiries for as long as we need them to reply, to do the work you asked for, and to follow up on that business relationship. Then we delete them. You can ask us to delete them at any time.

## Your choices

Email [privacy@excessionlabs.ai](mailto:privacy@excessionlabs.ai) to see, correct, export or delete the data we hold about you. You can block analytics with any content blocker; the site works without it.


---

# Penetration testing providers

Source: https://pentestcompare.com/providers/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Profiles of penetration testing providers: what each tests, who does the testing, published prices, turnaround, retesting, credentials and sources.

Each profile uses the same fields, taken from the provider's own public pages, with the date we checked them. Profiles are in alphabetical order. Excession Labs, the publisher of this site, is one of them and is marked as the publisher.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |

Missing a provider, or found an error? [Send a correction or a suggestion](/methodology/#corrections).


---

# Penetration test scoping checklist

Source: https://pentestcompare.com/tools/scoping-checklist/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

An interactive checklist of what pentest providers ask before they quote: scope, roles, API size, environments, limits and report needs. Copy the summary.

> **Short answer:** Collect these answers before you contact providers: why you need the test and by when, every host and role in scope, API documentation, environments and test windows, off-limits actions, and what you expect back. Send the same summary to each provider so their quotes cover the same work.

Tick what you have ready and add short notes. The summary at the bottom updates as you go. Copy it into your email to each provider, so every quote covers the same scope.

## Why the same scope matters

Two quotes for the same application can differ a lot, because each provider assumed a different scope: one tested two roles, the other six; one included the API, the other did not. When every provider answers the same summary, the differences that remain are real ones: delivery model, depth, report and retest terms. Compare those in the [provider table](/), and read the [cost guide](/guides/penetration-testing-cost/) for pricing models.

## Questions

### Is my checklist saved?

Your ticks and notes are saved in your browser's local storage on this device, so they are still there when you come back. Nothing is sent to us or to any provider.

### Do I need every item before asking for a quote?

No. The first five items in each section matter most. Unknown answers are fine: write that they are unknown, and the provider will ask. Send every provider the same information.

### What is the difference between black box, grey box and white box?

Black box means the tester gets no information, only the public application. Grey box means test accounts and documentation. White box adds source code.


---

# Aikido: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/aikido/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Aikido at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Aikido sells an AI pentest with fixed and scoped pricing, plus continuous testing. Reports are aimed at SOC 2, ISO 27001 and HIPAA evidence, and a human-led CREST pentest can be requested.
- Website: https://www.aikido.dev/
- Type: Application security platform
- Delivery: automated. AI agents map, attack and verify; a human-led CREST pentest is available on request.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network yes; Mobile yes; AI apps yes
- Pricing model: mixed
  - TYPICAL Pentest: $4,000 per assessment (One application plus its primary APIs, whitebox; black-box and grey-box cost extra; same-day results; free retests for up to 6 months; no High or Critical finding means no charge.) https://www.aikido.dev/pricing
  - Rightsized Pentest: $50 to $30,000+ per assessment (Scoped to the application from the repos, endpoints and roles; priced by number of AI agents and credits.) https://www.aikido.dev/pricing
- Pricing note: Both prices are one-off assessments, not subscriptions. Continuous testing is custom priced. Aikido's platform subscriptions (separate from pentests) are not listed here. Prices are also shown in EUR, GBP and INR.
- Turnaround: TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. (Time to results for an automated run; the page's statements are not consistent.)
- Retesting: Free retesting for up to 6 months, including checks for bypasses of fixes.
- Sample report: public https://www.aikido.dev/attack/aipentest
- Credentials: SOC 2, ISO 27001, ISO 42001, CREST (as listed on the AI pentest page; CREST may relate to the human-led option) (https://www.aikido.dev/attack/aipentest)
- Compliance mentioned: SOC 2, ISO 27001, HIPAA
Good fit when: Small and mid-size teams that need a low-cost, fast automated pentest for audit evidence, with a pay-only-if-serious-findings guarantee.
Tradeoffs: The Rightsized range is very wide, so the real price is only known after scoping. Sample reports found cover network, mobile and AI, not web/API.
Last checked: 2026-11-09
Sources:
- Aikido pricing: https://www.aikido.dev/pricing (checked 2026-11-09)
- Aikido AI pentest: https://www.aikido.dev/attack/aipentest (checked 2026-11-09)


---

# BreachLock: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/breachlock/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

BreachLock at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

BreachLock offers human-led pentesting as a service from an in-house team, alongside attack surface discovery and an autonomous testing product. Pricing is tiered but quote-only.
- Website: https://www.breachlock.com/
- Type: PTaaS platform
- Delivery: hybrid. Human-led PTaaS by an in-house team described as expert-led and AI-accelerated, plus a separate autonomous product (Breach360).
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps unknown
- Pricing model: custom quote
- Pricing note: The pricing page describes Standard, Extended and Extensive tiers but lists no dollar figures; every tier links to a quote or discovery call.
- Turnaround: Pentests can be scoped and started within 24-48 hours. (Time to start a test. Test length and report delivery are not stated.)
- Retesting: Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting.
- Sample report: on request 
- Credentials: CREST-accredited provider (https://www.breachlock.com/)
- Compliance mentioned: PCI DSS, ISO 27001, HIPAA, SOC 2, GDPR, DORA, NIST CSF 2.0
Good fit when: Buyers who want a CREST-accredited in-house human team with audit-ready reports and a defined free-retest count per tier.
Tradeoffs: No prices or sample report are published. Retest allowances are stated differently in the tier table and the product text.
Last checked: 2026-11-09
Sources:
- BreachLock pentest pricing: https://www.breachlock.com/pricing/penetration-testing-pricing/ (checked 2026-11-09)
- BreachLock homepage: https://www.breachlock.com/ (checked 2026-11-09)


---

# Cobalt: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/cobalt/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cobalt at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Cobalt sells pentests through a platform that connects buyers with a network of vetted freelance testers, plus an autonomous pentest product. Work is bought mostly as annual credit packages, and results appear in the platform as testing proceeds.
- Website: https://www.cobalt.io/
- Type: PTaaS platform
- Delivery: hybrid. Testing is done by a network of vetted freelance pentesters (the Cobalt Core), with AI agents and a separate autonomous pentest option.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: mixed
  - Autonomous Pentest (limited-time offer): $3,500 per test (Web application test started through the platform; findings in 24 hours; offer says the test must start and finish before Dec 31, 2026.) https://www.cobalt.io/pricing
- Pricing note: Only the Autonomous Pentest has a dollar price, and it is a one-off test on a limited-time offer. Standard, Premium and Enterprise tiers are annual credit packages with no published price; one credit equals 8 hours of testing. Credits deducted for a test can vary with the contracted per-credit rate.
- Turnaround: Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. (Time to start a test (annual tiers) or time to first findings (autonomous test). Not the time to the final report.)
- Retesting: Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ.
- Sample report: on request 
- Credentials: SOC 2 Type II (Cobalt's own audit) (https://www.cobalt.io/trust-center); ISO 27001 certified (https://www.cobalt.io/trust-center); CREST Penetration Testing Service accreditation (https://www.cobalt.io/trust-center)
- Compliance mentioned: HIPAA
Good fit when: Teams that want human pentesters on a platform with fast starts and in-platform retesting, and that are happy to buy an annual credit package. The $3,500 autonomous option gives a published entry price for a web app test.
Tradeoffs: Prices for the human-led annual tiers are not published; you must ask for a quote. The retest window is stated two different ways on the pricing page.
Last checked: 2026-11-09
Sources:
- Cobalt pricing: https://www.cobalt.io/pricing (checked 2026-11-09)
- Cobalt homepage: https://www.cobalt.io/ (checked 2026-11-09)
- Cobalt Trust Center: https://www.cobalt.io/trust-center (checked 2026-11-09)


---

# Escape: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/escape/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Escape at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Escape is an application security platform with AI-driven continuous pentesting, business-logic-aware DAST and external network pentesting. Tests can run on merge, deploy or a schedule.
- Website: https://escape.tech/
- Type: Application security platform
- Delivery: automated. Testing is run by AI; the vendor describes AI pentesting as having no human in the loop, with an AI assistant for setup.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network yes; Mobile unknown; AI apps yes
- Pricing model: custom quote
- Pricing note: No prices, plans or units on the pricing page. It says the bill does not rise with scan volume, but names no billing unit. Also sold through AWS Marketplace and resellers.
- Turnaround: Continuous AI pentesting: results in minutes on merge, deploy or schedule. (Time to results for an automated run, not a manual engagement.)
- Retesting: Open issues are re-checked; external network pentesting is followed by a retest. No limits stated.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS
Good fit when: Developer-centred teams that want pentest-style testing triggered on every release alongside DAST, and external network checks.
Tradeoffs: No price or sample report is published. The vendor states it does not test internal network lateral movement. No company certifications are listed on the pages checked.
Last checked: 2026-11-09
Sources:
- Escape pricing: https://escape.tech/pricing (checked 2026-11-09)
- Escape AI pentesting: https://escape.tech/product/ai-pentesting (checked 2026-11-09)
- Escape external network pentesting (found via search; not opened directly): https://escape.tech/solutions/external-pentesting (checked 2026-11-09)


---

# Excession Labs: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/excession-labs/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Excession Labs at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Excession Labs is a security lab. It tests web applications, APIs, multi-tenant SaaS platforms and AI applications with AI testing agents and checks the evidence for each finding before it goes in the report. It publishes lab research and PentestCompare.
- Website: https://penetrationtestservices.com/
- Type: Security lab (AI-assisted testing)
- Delivery: hybrid. The lab's AI testing agents run the testing tasks under tool rules. Excession Labs scopes the work, checks the evidence for each finding and writes the report.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network unknown; Mobile unknown; AI apps yes
- Pricing model: custom quote
- Pricing note: Quotes follow a scoping call. A free pilot with a small written scope is available. No prices are published.
- Turnaround: Not published
- Retesting: Retest of fixed findings is offered; terms are set in each quote.
- Sample report: public https://penetrationtestservices.com/sample-report/
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2
Good fit when: Teams that want web app, API or multi-tenant SaaS testing with request-level evidence for each finding, and that want to judge the provider first through a free scoped pilot.
Tradeoffs: No published prices, turnaround or credentials. The public sample report is a demonstration for a fictional app, not a customer report. Network, cloud and mobile testing are not described on its pages.
Last checked: 2026-11-09
Sources:
- Penetration Test Services home page: https://penetrationtestservices.com/ (checked 2026-11-09)
- Pricing and scope: https://penetrationtestservices.com/pricing/ (checked 2026-11-09)
- Methodology: https://penetrationtestservices.com/methodology/ (checked 2026-11-09)
- How AI-assisted testing works: https://aipentestservices.com/how-it-works/ (checked 2026-11-09)
- AI red teaming services: https://airedteamingservices.com/ (checked 2026-11-09)


---

# HackerOne: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/hackerone/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

HackerOne at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

HackerOne offers pentest as a service in two forms: a human-led H1 Pentest and an H1 Agentic Pentest where AI agents work under human review. Results stream into the HackerOne platform and a final report closes the engagement.
- Website: https://www.hackerone.com/
- Type: Crowdsourced platform
- Delivery: hybrid. H1 Pentest is fully human-led; H1 Agentic Pentest pairs AI agents with human pentesters who review every agent finding.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: custom quote
- Pricing note: No dollar amounts on the pricing page; all tiers route to sales. The only metered unit shown is monthly automations for the platform tiers, which is not a pentest price. The agentic tier currently covers web apps and APIs only; the wider scope list applies to the human-led H1 Pentest.
- Turnaround: Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. (Docs figure is report delivery after the testing phase, not time to start.)
- Retesting: Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS, DORA, NIST CSF 2.0, GDPR
Good fit when: Organisations that already use HackerOne or want pentests from the same vendor as a bug bounty or disclosure program, and that want a choice between fully human and AI-assisted testing.
Tradeoffs: Pricing is quote-only, no sample report is offered and no testing lead time is published. Retest terms differ between product page, docs and older posts.
Last checked: 2026-11-09
Sources:
- HackerOne pricing: https://www.hackerone.com/pricing (checked 2026-11-09)
- HackerOne pentest product page: https://www.hackerone.com/product/pentest (checked 2026-11-09)
- HackerOne docs: retesting pentests (found via search; not opened directly): https://docs.hackerone.com/en/articles/8541386-retesting-pentests (checked 2026-11-09)


---

# Hadrian: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/hadrian/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Hadrian at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Hadrian Nova runs AI agent pentests against an application or environment the customer defines. Results stream live and a compliance-mapped PDF report is included.
- Website: https://hadrian.io/products/nova
- Type: Autonomous testing platform
- Delivery: hybrid. A fleet of AI agents runs the Nova tests; findings are described as human-reviewed, but who reviews them is not stated.
- Scope: Web apps yes; APIs unknown; Cloud unknown; Network unknown; Mobile unknown; AI apps unknown
- Pricing model: mixed
  - Nova test: From EUR 1,250 per test, excluding VAT (One agentic pentest with full reporting; bundles are available; what one test covers is not defined.) https://hadrian.io/pricing
- Pricing note: Priced in euros, as a starting price per test. Bundle sizes and prices are not published. Hadrian's Atlas attack surface product is priced by asset count with no figures shown.
- Turnaround: Most tests finish within 24 to 48 hours; same-day start possible. (Test duration after start; the page also uses hours and days elsewhere.)
- Retesting: Not published
- Sample report: not published 
- Credentials: SOC 2 Type 2 (badge on page) (https://hadrian.io/products/nova)
- Compliance mentioned: SOC 2, ISO 27001, NIS2, DORA
Good fit when: Teams that want a published starting price per test and a quick agentic test of an application before launch or after a major change.
Tradeoffs: The unit is not defined, retest terms are not stated, and no sample report is offered. The scope list does not name APIs, cloud or mobile.
Last checked: 2026-11-09
Sources:
- Hadrian Nova: https://hadrian.io/products/nova (checked 2026-11-09)
- Hadrian pricing: https://hadrian.io/pricing (checked 2026-11-09)


---

# Horizon3.ai (NodeZero): pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/horizon3/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Horizon3.ai (NodeZero) at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

NodeZero is an autonomous pentesting platform covering internal, external, cloud, Kubernetes and Active Directory testing, with a newer web application module. List prices are published per asset.
- Website: https://www.horizon3.ai/
- Type: Autonomous testing platform
- Delivery: automated. NodeZero is software that runs the attacks itself; no human pentesters are described on the pages checked.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile unknown; AI apps unknown
- Pricing model: published
  - Flex: $15 per asset, per test (12-month term) (Internal, external, cloud (AWS/Azure) and Kubernetes pentests, reports, fix verification; no add-ons.) https://horizon3.ai/use-case/pricing/
  - Core: $50 per asset, annual subscription (Unlimited testing; each asset billed once per 12 months; adds scheduling.) https://horizon3.ai/use-case/pricing/
  - Pro: $65 per asset, annual subscription (Core plus tripwires and rapid response.) https://horizon3.ai/use-case/pricing/
  - Elite: $85 per asset, annual subscription (Pro plus insights, high-value targeting, advanced data pilfering, threat actor intelligence and vulnerability prioritization.) https://horizon3.ai/use-case/pricing/
  - WebApp Flex: $10,000 per app, per test (12-month term) (Web application pentesting, sold as add-on or standalone; the page does not define the scope of one test.) https://horizon3.ai/use-case/pricing/
- Pricing note: The unit is a discovered asset (server, device, cloud resource or service), not a test or an engagement. Flex is per asset per test; Core, Pro and Elite are annual subscriptions. WebApp pricing is per app. Support tiers cost extra (Enhanced 10% of subscription, minimum $7,500/year; Premier 20%, minimum $25,000/year). Totals depend on asset count, which is not known in advance.
- Turnaround: Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. (No start time, test length or report time is stated.)
- Retesting: Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: PCI DSS, NIS 2
Good fit when: Security teams that want to test internal and external networks, cloud and Active Directory often, and can count their assets. The published per-asset prices make budgeting possible once the asset count is known.
Tradeoffs: Costs scale with asset count and are hard to compare with per-test prices. The pages checked do not mention mobile or human review of findings, and no sample report is offered.
Last checked: 2026-11-09
Sources:
- NodeZero pricing: https://horizon3.ai/use-case/pricing/ (checked 2026-11-09)
- Horizon3.ai homepage: https://www.horizon3.ai/ (checked 2026-11-09)
- NodeZero WebApp: https://horizon3.ai/nodezero/webapp/ (checked 2026-11-09)


---

# Intruder: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/intruder/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Intruder at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Intruder is a vulnerability management vendor that added AI Pentesting: autonomous, white-box web app tests priced from $3,500 per test with a same-day report.
- Website: https://www.intruder.io/
- Type: Application security platform
- Delivery: automated. AI Pentesting uses autonomous agents that work from your source code and check each finding against the live app. The page says a human in the loop is not needed for web app pentesting. Intruder also sells vulnerability scanning products.
- Scope: Web apps yes; APIs unknown; Cloud unknown; Network unknown; Mobile unknown; AI apps unknown
- Pricing model: published
  - Same day pentest: $3,500 per test (White-box AI web app test with repository integration (GitHub, GitLab, Azure DevOps or Bitbucket Cloud) and unlimited retesting.) https://www.intruder.io/pentest-pricing
  - 4 pentest pack: $12,000 per pack of 4 tests (about $3,000 each) (Four AI web app tests that must be used within 1 year of purchase; unlimited retesting.) https://www.intruder.io/pentest-pricing
  - AI Pentesting (product page): $4,000 per test, standalone purchase (The AI Pentesting page says tests start from $3,500 for existing customers and $4,000 as a standalone purchase; final price depends on app size and complexity. The pentest pricing page shows $3,500 for both.) https://www.intruder.io/platform/ai-pentesting
- Pricing note: Two Intruder pages disagree: the AI Pentesting page says $4,000 standalone, the pentest pricing page shows $3,500. Continuous pentesting has no listed price. Platform plans (Cloud, Pro) have no price in the page text we could read; Enterprise is custom. Prices exclude VAT.
- Turnaround: Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. (Time from launch to report for one AI web app test. Complex apps are not covered by a stated time.)
- Retesting: Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS, Cyber Essentials
Good fit when: Teams that can share source code and want a published per-test price for an AI web app test with unlimited retests.
Tradeoffs: Web apps only for the AI pentest. No sample report and no human review of findings are described. Auditor refund promise on the pricing page is a vendor claim we did not test.
Last checked: 2026-11-09
Sources:
- Intruder AI Pentesting: https://www.intruder.io/platform/ai-pentesting (checked 2026-11-09)
- Intruder pentest pricing: https://www.intruder.io/pentest-pricing (checked 2026-11-09)
- Intruder pricing: https://www.intruder.io/pricing (checked 2026-11-09)


---

# JUMPSEC: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/jumpsec/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

JUMPSEC at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

JUMPSEC is a UK security consultancy. Its AI penetration testing service covers apps, chatbots and large language models, with the OWASP LLM Top 10 as a baseline, and is sold by quote.
- Website: https://www.jumpsec.com/
- Type: Consultancy
- Delivery: human-led. The AI penetration testing page names experts and offers to speak to a pen test expert. It does not say whether tools or AI automate any of the testing.
- Scope: Web apps unknown; APIs unknown; Cloud unknown; Network unknown; Mobile unknown; AI apps yes
- Pricing model: custom quote
- Pricing note: The page asks you to get in touch to discuss prices and offers a no obligation quote. No amounts are published.
- Turnaround: Not published
- Retesting: Not stated. The page recommends testing quarterly or semi-annually and after significant changes.
- Sample report: not published 
- Credentials: CREST (listed on the AI penetration testing page) (https://www.jumpsec.com/ai-penetration-testing/); CHECK (listed on the AI penetration testing page) (https://www.jumpsec.com/ai-penetration-testing/); ISO 9001 (listed on the AI penetration testing page) (https://www.jumpsec.com/ai-penetration-testing/); ISO 27001 (listed on the AI penetration testing page) (https://www.jumpsec.com/ai-penetration-testing/)
- Compliance mentioned: ISO/IEC 42001
Good fit when: Teams that want a UK consultancy with listed accreditations to test AI applications, chatbots and LLM integrations, and that accept a quote-based process.
Tradeoffs: No prices, turnaround, sample report or retest terms. Some FAQ text on the page looks pasted from other pages (a red team answer, a pricing answer and an office move answer).
Last checked: 2026-11-09
Sources:
- JUMPSEC AI penetration testing: https://www.jumpsec.com/ai-penetration-testing/ (checked 2026-11-09)


---

# Novee: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/novee/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Novee at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Novee is an AI penetration testing platform built on its own offensive security model. It targets web and internal apps, mobile apps and their APIs, AI apps and agents, and the external attack surface.
- Website: https://novee.security/
- Type: Autonomous testing platform
- Delivery: automated. Testing is done by AI built on Novee's own offensive security model plus frontier models. The page does not say whether humans review findings. Test plans can be reviewed before execution.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network unknown; Mobile yes; AI apps yes
- Pricing model: custom quote
- Pricing note: No prices are listed. The site offers an ROI calculator and a Google Cloud Marketplace listing. The pricing page returned 404 on 2026-11-09.
- Turnaround: Not published. Testing is described as continuous. (No time to first finding or report is stated.)
- Retesting: Retests run automatically after fixes, and on new deployments, code changes and emerging threats.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: Not published
Good fit when: Teams that want continuous AI testing across web, mobile backends, APIs and AI agents, with deployment options of SaaS, a bastion node or on-prem.
Tradeoffs: No prices, no sample report, no stated human review. The homepage shows SOC 2 and ISO badges without naming the ISO standard, so no credential is listed here.
Last checked: 2026-11-09
Sources:
- Novee homepage: https://novee.security/ (checked 2026-11-09)


---

# Outpost24: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/outpost24/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Outpost24 at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Outpost24 sells PTaaS packages (SWAT, Snapshot, Assure) and CyberFlex, plus an expert-led AI penetration testing service that covers the model and prompt layer, RAG pipelines, agent workflows and connecting APIs.
- Website: https://outpost24.com/
- Type: PTaaS platform
- Delivery: hybrid. Certified testers do manual testing on the PTaaS packages (SWAT, Snapshot, Assure) alongside automated scanning. The AI and LLM penetration testing service is described as human-led by certified experts, not automated scanners.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network unknown; Mobile yes; AI apps yes
- Pricing model: custom quote
- Pricing note: No prices found in the page text we could read. CyberFlex uses a flexible budget model. Outpost24 pages returned HTTP 403 to direct fetches on 2026-11-09, so these facts come from search results of Outpost24 pages and were not opened directly.
- Turnaround: Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. (Length of the testing period for each package, not time to the report. An older 2023 PDF gives Snapshot as 30 days.)
- Retesting: Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service.
- Sample report: not published 
- Credentials: CREST penetration testing accreditation (web application security assessments) (https://outpost24.com/blog/Accreditation-body-CREST-Recognize-Outpost24-for-web-application-penetration-testing)
- Compliance mentioned: OWASP LLM Top 10
Good fit when: Teams that want human-led application or AI system testing with a retest window, from a vendor that also sells attack surface management.
Tradeoffs: Prices are not published. The AI service excludes the model provider's infrastructure, training data review and model weights. Sample report not found.
Last checked: 2026-11-09
Sources:
- Outpost24 PTaaS (not opened, 403; search snippet): https://outpost24.com/products/pentesting-as-a-service/ (checked 2026-11-09)
- Outpost24 launches AI pentesting (not opened, 403; search snippet): https://outpost24.com/blog/outpost24-launches-ai-pentesting/ (checked 2026-11-09)
- Outpost24 CREST accreditation (not opened; search snippet): https://outpost24.com/blog/Accreditation-body-CREST-Recognize-Outpost24-for-web-application-penetration-testing (checked 2026-11-09)


---

# Parameter: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/parameter/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Parameter at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Parameter offers AI-agent pentesting for web apps, APIs and infrastructure, needing only a URL and credentials. One run produces executive, customer, auditor and remediation reports.
- Website: https://www.parameter.ai/
- Type: AI-assisted testing service
- Delivery: automated. Autonomous AI agents run the pentest; they pause for the customer's approval before chaining or escalating.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network unknown; Mobile unknown; AI apps unknown
- Pricing model: custom quote
- Pricing note: Three tiers (Single App, Rightsized, Continuous) with no dollar amounts; all go to sales. Pricing follows the size of what is tested, not seats.
- Turnaround: First findings in 24 hours; most runs finish the same day they start. (Time from start to first findings and typical run length.)
- Retesting: Free re-testing is listed for Single App and inherited by higher tiers.
- Sample report: public https://www.parameter.ai/parameter-assets/sample-pentest-report.pdf
- Credentials: SOC 2 Type I report (Type II observation period in progress) (https://www.parameter.ai/security)
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS, FedRAMP, HIPAA
Good fit when: Teams that want a quick automated web app and API pentest with auditor-mapped reports and a public sample to review first.
Tradeoffs: No prices are published. The SOC 2 report is Type I only, and the Type II period is not complete.
Last checked: 2026-11-09
Sources:
- Parameter pentesting: https://www.parameter.ai/pentesting (checked 2026-11-09)
- Parameter homepage: https://www.parameter.ai/ (checked 2026-11-09)
- Parameter security: https://www.parameter.ai/security (checked 2026-11-09)


---

# Pen Test Partners: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/pen-test-partners/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Pen Test Partners at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Pen Test Partners is a cyber security consultancy offering manual pentesting, red teaming and compliance services across many sectors. A PTaaS subscription covers short tests of changes to web apps, mobile apps, APIs and external infrastructure.
- Website: https://www.pentestpartners.com/
- Type: Consultancy
- Delivery: human-led. A UK and US consultancy whose staff perform the tests, including CHECK testing for UK public sector; it also offers a time-block PTaaS service.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: custom quote
- Pricing note: No prices published. PTaaS is a subscription where you buy a block of time, billed in half-day blocks, for tests from half a day to two days.
- Turnaround: PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. (PTaaS start time after a contract is in place. Time to start a standard test is not stated.)
- Retesting: Not published
- Sample report: not published 
- Credentials: NCSC CHECK penetration testing (https://www.pentestpartners.com/); CREST member (https://www.pentestpartners.com/); ISO 27001 (https://www.pentestpartners.com/); PCI QSA (https://www.pentestpartners.com/)
- Compliance mentioned: PCI DSS, ISO 27001, Cyber Essentials, CBEST, TIBER
Good fit when: Regulated and public-sector buyers (UK especially), and organisations needing OT, IoT, transport or red team work from an accredited human team.
Tradeoffs: No prices, standard-test turnaround, retest terms or sample report are published. Credentials were read from homepage badges and links.
Last checked: 2026-11-09
Sources:
- Pen Test Partners homepage: https://www.pentestpartners.com/ (checked 2026-11-09)
- Pen Test Partners PTaaS: https://www.pentestpartners.com/service/pen-testing-as-a-service-ptaas/ (checked 2026-11-09)


---

# Penligent: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/penligent/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penligent at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Penligent is a desktop application for AI-assisted penetration testing, published by Future Share LLC. It combines scoping, tools, verification and reporting, and sells credit-based plans from free to enterprise.
- Website: https://www.penligent.ai/
- Type: AI-assisted testing service
- Delivery: automated. Desktop software for Windows, macOS and Linux that you operate. It has an agent mode and a manual mode with human-in-the-loop control. The page describes no managed human testers.
- Scope: Web apps yes; APIs unknown; Cloud unknown; Network yes; Mobile unknown; AI apps unknown
- Pricing model: published
  - Free: $0 per month (AI pentest workflow, attack surface mapping, baseline scans and 200+ on-demand tools; the Free plan includes one trial task. No credit cap is stated.) https://www.penligent.ai/pricing
  - Pro: $99.9 per month (13,000 monthly credits; 20,000 and 28,000 credit tiers exist but their prices are not shown. Adds WAF bypass testing, SOC 2 and ISO 27001 aligned exports, re-runs and risk re-scans.) https://www.penligent.ai/pricing
  - Trial task top-up: $19.9 per top-up, one-time (Adds 2,000 credits to an existing trial task.) https://www.penligent.ai/pricing
- Pricing note: Team and Enterprise are Contact Sales. The Yearly toggle shows no yearly price. A search result showed $39.92 per month billed annually for Pro, which the pricing page did not show when fetched.
- Turnaround: What takes humans a week, Penligent takes an hour (homepage tagline). (Marketing claim. No guaranteed timeline is given.)
- Retesting: Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated.
- Sample report: public https://www.penligent.ai/
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001
Good fit when: Consultants and engineers who want to run AI-assisted tests themselves from a desktop app and who accept a usage-based credit model.
Tradeoffs: You operate the tool and own the judgment on findings. The 19-page sample report is built on synthetic data and needs a free account to download. Penligent says reports are supporting evidence, not a SOC 2 examination report or ISO 27001 certificate. No certifications are listed for the company.
Last checked: 2026-11-09
Sources:
- Penligent homepage: https://www.penligent.ai/ (checked 2026-11-09)
- Penligent pricing: https://www.penligent.ai/pricing (checked 2026-11-09)


---

# Penti: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/penti/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penti at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Penti (penti.ai, owned by Certypie Inc) sells credit-based agentic AI penetration testing with plans from $20 to $2,000 per month, free unlimited retests, and optional human verification or manual test credits.
- Website: https://penti.ai/
- Type: AI-assisted testing service
- Delivery: hybrid. Autonomous AI agents run the exploits. A certified pentester can verify findings (included 3 per year on Plus, 6 on Advanced, paid add-on on Launch). Expert Pentest Credits buy scoped manual tests.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: published
  - Starter: $20 per month ($216 per year billed annually) (20 credits per month, external testing on Penti Cloud.) https://penti.ai/pricing
  - Launch: $300 per month ($3,240 per year billed annually) (300 credits per month, external scope, continuous scanning, human-verified findings as a paid add-on.) https://penti.ai/pricing
  - Plus: $1,000 per month ($10,800 per year billed annually) (1,200 credits per month, adds on-prem or hybrid internal scope, 3 human-verified findings per year.) https://penti.ai/pricing
  - Advanced: $2,000 per month ($21,600 per year billed annually) (2,600 credits per month, 6 human-verified findings per year.) https://penti.ai/pricing
  - Expert Pentest Credits, single application: $4,000 one-time per 15 hours ($3,000 per year if annual) (Human-led manual test of a mobile app, web app or API, scoped from scratch.) https://penti.ai/pricing
  - Expert Pentest Credits, networks and larger: $16,000 one-time per 60 hours ($12,000 per year if annual) (Human-led manual test, scoped from scratch.) https://penti.ai/pricing
- Pricing note: Pricing is in credits; each AI exploit costs 1 to 7 credits by model tier. Annual billing saves 10%. Enterprise is custom. Extra credits cost $3.00 (Starter) down to $0.80 (Advanced). Credit cost per test depth is given on the homepage only as rough figures. Earlier Penti material and G2 listed other models (one-time tests from $3,000), so check the live page.
- Turnaround: Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. (Marketing claim for AI runs. The page gives no time for Expert Pentest Credits.)
- Retesting: Every plan includes free unlimited retests.
- Sample report: not published 
- Credentials: SOC 2 Type II (Penti's own audit, report at trust.penti.ai) (https://penti.ai/)
- Compliance mentioned: SOC 2, ISO 27001, PCI DSS, HIPAA, CMMC, GDPR, NIST
Good fit when: Teams that want published monthly prices, credit-based AI testing across external, application, internal and identity layers, and an option to buy human-led hours.
Tradeoffs: Credit cost per test is only approximate, so the total cost of a full web app test is hard to predict. No downloadable sample report (an Evidence Player walkthrough exists). Human-verified findings are not a scoped manual pentest.
Last checked: 2026-11-09
Sources:
- Penti pricing: https://penti.ai/pricing (checked 2026-11-09)
- Penti homepage: https://penti.ai/ (checked 2026-11-09)


---

# Secure Ideas: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/secure-ideas/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Secure Ideas at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Secure Ideas is a boutique offensive security consultancy. It sells fixed-fee projects and PETaaS prepaid credits, with published hourly rates and starting prices by test type.
- Website: https://secureideas.com/
- Type: Consultancy
- Delivery: human-led. In-house consultants run the tests and write the reports; the vendor says it does not rely on automated scans.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network yes; Mobile yes; AI apps unknown
- Pricing model: published
  - External Penetration Test (smallest scope): $8,160 per test (flat fee, starting) (Smallest of four scope tiers.) https://secureideas.com/pricing
  - API Penetration Test (smallest scope): $10,880 per test (flat fee, starting) (Smallest of four scope tiers.) https://secureideas.com/pricing
  - Web Application Test (smallest scope): $13,600 per test (flat fee, starting) (Smallest of four scope tiers.) https://secureideas.com/pricing
  - Hourly rate: $340 per hour ($2,720 per day) (Standard consulting rate for flat fee or credits.) https://secureideas.com/pricing
  - PETaaS credit: $2,520 per credit (up to one day of expert work) (Minimum purchase 25 credits; volume discounts of 5-15% from 30 credits.) https://secureideas.com/pricing
- Pricing note: Flat-fee prices are starting prices for the smallest scope; larger scopes cost more, and the homepage says most tests cost $10K-$45K. Credits are a prepaid pool of effort-days, not a per-test price. Attestation letters and retesting can change the quote.
- Turnaround: Testing usually starts two to four weeks after contracting; one to two weeks of testing. (Time from contract to test start, and typical test duration, per the homepage. Report delivery time is not stated.)
- Retesting: Not included by default; retesting is listed as a factor that can change the quote.
- Sample report: public https://secureideas.com/sample-report
- Credentials: CREST accredited company (https://secureideas.com/)
- Compliance mentioned: PCI DSS, HIPAA, SOC 2, DORA
Good fit when: Buyers who want an experienced manual team with published rates and a sample report to review before talking to sales.
Tradeoffs: Entry prices are higher than automated options and the test starts weeks after contracting. The PETaaS credit plan needs a minimum purchase of 25 credits (about $63,000).
Last checked: 2026-11-09
Sources:
- Secure Ideas pricing: https://secureideas.com/pricing (checked 2026-11-09)
- Secure Ideas homepage: https://secureideas.com/ (checked 2026-11-09)


---

# Synack: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/synack/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Synack at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Synack sells pentests that mix an AI agent (Sara) with a vetted crowd of researchers, in point-in-time or continuous form. Pricing is published per product as a starting price, bought through credits.
- Website: https://www.synack.com/
- Type: Crowdsourced platform
- Delivery: hybrid. Combines Sara, an autonomous AI agent, with the Synack Red Team of vetted human researchers; the SynackST product uses a single human tester.
- Scope: Web apps yes; APIs yes; Cloud yes; Network yes; Mobile yes; AI apps yes
- Pricing model: mixed
  - Sara Pentest: $5,085 per test (starting price) (One Standard Sara Pentest, external web or host only; 4-5 business day window; patch verification and report included.) https://www.synack.com/pricing/
  - SynackST (compliance): $10,283 per test (starting price) (One Standard pentest by a single tester for one framework; up to 25 unauthenticated web apps, or 1 low-complexity authenticated web app, or 100 host IPs; 5-day window.) https://www.synack.com/pricing/
  - Synack14: $27,120 per test (starting price) (One Synack14 pentest by a team; up to 50 unauthenticated web apps, or 1 authenticated web app, or 250 host IPs; 14-day window.) https://www.synack.com/pricing/
- Pricing note: Prices are starting prices per test, bought with credits that expire one year after purchase. The Synack Platform is required for any test and is billed separately with no published price (a free Basic tier exists). Enterprise is custom.
- Turnaround: Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). (Length of the testing window, not time to start or time to report.)
- Retesting: Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests.
- Sample report: not published 
- Credentials: FedRAMP authorized (level not stated on the pages checked) (https://www.synack.com/pricing/)
- Compliance mentioned: FISMA, CMMC, NIST, SOC 2, PCI DSS
Good fit when: Buyers who want published starting prices for a range of depth levels, including a team-based 14-day test, and public-sector buyers who need FedRAMP-aligned procurement paths.
Tradeoffs: The mandatory platform subscription is not priced, so the all-in cost is not visible. Prices are starting prices that depend on scope. Synack merged with NetSPI (announced Sept 2, 2026), so offerings may change.
Last checked: 2026-11-09
Sources:
- Synack pricing: https://www.synack.com/pricing/ (checked 2026-11-09)
- Synack homepage: https://www.synack.com/ (checked 2026-11-09)
- NetSPI and Synack merger notice (found via search; not opened directly): https://www.synack.com/netspi-and-synack/ (checked 2026-11-09)


---

# Terra Security: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/terra-security/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Terra Security at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

Terra Security offers an AI-agent pentesting platform with human oversight through a workspace called TORCH. It covers web apps, AI red teaming, and external and internal networks.
- Website: https://www.terra.security/
- Type: AI-assisted testing service
- Delivery: hybrid. AI agents run the tests with human pentesters supervising; reports are signed by certified pentesters (certifications not named).
- Scope: Web apps yes; APIs unknown; Cloud unknown; Network yes; Mobile unknown; AI apps yes
- Pricing model: custom quote
- Pricing note: No pricing page found (it returned not found) and no prices on the homepage; the only path is to book a demo.
- Turnaround: Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. (A marketing comparison of testing time, not a defined service level.)
- Retesting: Not published
- Sample report: not published 
- Credentials: SOC 2 Type II (badge) (https://www.terra.security/); CREST Member 2025 (badge) (https://www.terra.security/)
- Compliance mentioned: Not published
Good fit when: Teams that want continuous AI testing with a human on the loop and signed reports, including AI application red teaming.
Tradeoffs: No prices, retest terms, named integrations or sample report are published, and the page names no frameworks.
Last checked: 2026-11-09
Sources:
- Terra Security homepage: https://www.terra.security/ (checked 2026-11-09)


---

# TurboPentest: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/turbopentest/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

TurboPentest at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

TurboPentest sells self-service AI pentests bought as credits online, with three depth tiers and a monthly option. Each test includes a report and a signed attestation letter.
- Website: https://turbopentest.com/
- Type: AI-assisted testing service
- Delivery: automated. Self-service AI agents run the pentest; the page does not say humans validate findings, and it provides a threat model for human follow-up.
- Scope: Web apps yes; APIs yes; Cloud unknown; Network yes; Mobile unknown; AI apps yes
- Pricing model: published
  - Audit-Ready: $99 per credit (one pentest) (1 target, 4 agents, up to 4 agent-hours; report and signed attestation letter.) https://turbopentest.com/pricing
  - Threat-Hunt: $299 per credit (one pentest) (Up to 4 targets, 10 agents, up to 20 agent-hours.) https://turbopentest.com/pricing
  - Adversarial-Depth: $699 per credit (one pentest) (Up to 8 targets, 20 agents, up to 80 agent-hours.) https://turbopentest.com/pricing
  - Monthly pentest: $99 per month (One verified target re-tested each month; cancel anytime.) https://turbopentest.com/pricing
  - Enterprise dedicated instance: $49,990 per year ($4,999 per month) (Unlimited targets and tiers in the customer's own cloud; cloud and model costs are paid separately.) https://turbopentest.com/pricing
- Pricing note: Credit prices are one-off tests; the monthly plan and enterprise instance are subscriptions. Extra targets cost $99 each (the 11-08 report cites a five-target example at $398: $299 for four plus $99 for one more). Bulk credit discounts of 10-30% apply from 10 credits.
- Turnaround: All tiers typically complete in a few hours. (Run time for the automated test until the report is ready.)
- Retesting: A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain).
- Sample report: public https://turbopentest.com/sample-report
- Credentials: States its own operations are PCI DSS and CMMC compliant (vendor claim) (https://turbopentest.com/)
- Compliance mentioned: SOC 2, ISO 27001, HIPAA, PCI DSS, CMMC
Good fit when: Teams that need a very low-cost, fast external web and API test with a signed letter for questionnaires and common audits, and are comfortable with automation only.
Tradeoffs: Business logic areas are flagged for manual follow-up and the report lists what automation could not test. Retests are paid new runs. Mobile and internal network testing are not mentioned.
Last checked: 2026-11-09
Sources:
- TurboPentest pricing: https://turbopentest.com/pricing (checked 2026-11-09)
- TurboPentest homepage: https://turbopentest.com/ (checked 2026-11-09)


---

# XBOW: pentest scope, pricing and delivery

Source: https://pentestcompare.com/providers/xbow/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

XBOW at a glance: what it tests, who does the testing, published prices, turnaround, retesting and sample reports. Sourced and dated.

XBOW is an autonomous testing platform that runs many AI agents in parallel against web applications and APIs and validates findings with exploits. Buyers set scope, impact level and testing windows.
- Website: https://xbow.com/
- Type: Autonomous testing platform
- Delivery: automated. The vendor says no human drives the attack: autonomous AI agents test and findings are reviewed before delivery (who reviews is not stated).
- Scope: Web apps yes; APIs yes; Cloud unknown; Network unknown; Mobile unknown; AI apps unknown
- Pricing model: custom quote
- Pricing note: Pricing is described as usage-based and scoped to your environment; no unit or amount is published. A $50,000 AWS Marketplace credit package noted on 2026-11-08 was not re-verified today, so it is not listed.
- Turnaround: First validated findings arrive in hours; testing is continuous or on demand. (Time to first findings, not a full report.)
- Retesting: Retests after a fix are described as free and unlimited.
- Sample report: not published 
- Credentials: None with public evidence found
- Compliance mentioned: SOC 2, ISO 27001, ISO 42001, PCI DSS, NIS 2
Good fit when: Engineering-led teams that want continuous automated testing of many web apps and APIs, with controls over scope, rate limits and test windows.
Tradeoffs: No price is published and the compliance list on the page does not make clear whether XBOW holds these certifications or supports the frameworks. Scope is web apps and APIs only on the page checked.
Last checked: 2026-11-09
Sources:
- XBOW homepage: https://xbow.com/ (checked 2026-11-09)
- XBOW pricing: https://xbow.com/pricing (checked 2026-11-09)