Penetration testing companies in the USA: sourced list

Penetration testing companies in the USA are listed below from the PentestCompare dataset, checked on 9 November 2026. The list runs A to Z and no provider pays for position. Excession Labs (publisher of this site) appears only where its dataset row matches.

How does the dataset assign a provider to a country?#

It uses the headquarters country that the provider states on its own pages. If the pages do not state one, the dataset records "Not published", and the provider does not appear on country pages. Many remote-first providers publish no headquarters, so absence from this list says nothing about their quality or their US clients.

A US headquarters tells you where the company is based. It does not tell you where testers work or where your data goes. Ask for both in writing.

What rules and needs drive a US pentest?#

We found no general US law that requires a penetration test, and no state rule that we sourced here. The needs come from frameworks and contracts. PCI DSS requirement 11.4 names penetration testing for card data environments. The HIPAA Security Rule at 45 CFR 164.308 requires a periodic technical and nontechnical evaluation. The eCFR text, current on 5 November 2026, does not contain the word "penetration". Customers, insurers and auditors may still ask for a test.

Our guides cover the text: HIPAA penetration testing, PCI DSS penetration testing requirements and cyber insurance requirements.

What should you ask a US provider?#

Ask these seven questions in writing:

1. Where are the testers located, and who has access to our data?
2. Where do you store the report and the evidence, and for how long?
3. What is the retest policy?
4. Can I see a sample report?
5. Which frameworks have you written reports for?
6. Who signs the report, and can you provide an attestation letter?
7. How do you handle a critical finding found during testing?

Our guide on questions to ask a pentest provider adds general questions.

What drives the price of a US pentest?#

Price follows the scope (applications, APIs, hosts, user roles), the depth, the report format and the retest terms. Providers in the table mostly quote after scoping, and a few publish a price for a product or tier. Compare prices only for the same scope. See penetration testing cost for named published prices.

How should you read the table?#

Each row is that provider's statement, sorted A to Z. "Not published" means we found no statement, not that the item is absent. Delivery shows whether people, tools or both do the work. The dataset shows more human-led providers than automated ones for the US headquarters filter, but that reflects who publishes a headquarters, not the market.

For sample reports, "public" means you can read one before you buy. Our list of pentest companies with sample reports filters on that field alone.

Does remote or on-site delivery, and data location, matter?#

Most application and API testing runs remotely. Network, wireless and physical work may need people on site, and travel changes the quote. Ask where the tester sits for each part of the work.

For data, ask where the evidence is stored and whether it leaves the US. For comparison with another market, see penetration testing companies in the United Kingdom.