# Penetration testing companies in the USA: sourced list

Source: https://pentestcompare.com/locations/united-states/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing companies in the USA, listed A to Z from the PentestCompare dataset with published prices, sample reports and sources, checked 9 November 2026.

> **Short answer:** Penetration testing companies in the USA appear here when their own pages state a US headquarters. The list runs A to Z and no provider pays for rank. Check price, sample report, retest terms and where testers and data sit. No US state sets a pentest rule that we sourced here. Contracts and frameworks such as PCI DSS usually drive the need.

Penetration testing companies in the USA are listed below from the [PentestCompare dataset](/directory/), checked on 9 November 2026. The list runs A to Z and no provider pays for position. Excession Labs (publisher of this site) appears only where its dataset row matches.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Black Hills Information Security](https://pentestcompare.com/providers/black-hills-information-security/) | Security consultancy | human-led | yes | unknown | unknown | yes | not published | Not published | Not published | not published |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Include Security](https://pentestcompare.com/providers/include-security/) | Application security consultancy | human-led | yes | yes | unknown | unknown | not published | Report target: a week after the assessment conclusion. | Not published | not published |
| [IOActive](https://pentestcompare.com/providers/ioactive/) | Security consultancy | human-led | unknown | unknown | unknown | yes | not published | Not published | Not published | not published |
| [Lakera](https://pentestcompare.com/providers/lakera/) | Application security platform | hybrid | unknown | unknown | unknown | yes | custom quote | Not published | Not published | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Rhino Security Labs](https://pentestcompare.com/providers/rhino-security-labs/) | Penetration testing firm | human-led | yes | unknown | yes | unknown | not published | Not published | Not published | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |

## How does the dataset assign a provider to a country?

It uses the headquarters country that the provider states on its own pages. If the pages do not state one, the dataset records "Not published", and the provider does not appear on country pages. Many remote-first providers publish no headquarters, so absence from this list says nothing about their quality or their US clients.

A US headquarters tells you where the company is based. It does not tell you where testers work or where your data goes. Ask for both in writing.

## What rules and needs drive a US pentest?

We found no general US law that requires a penetration test, and no state rule that we sourced here. The needs come from frameworks and contracts. PCI DSS requirement 11.4 names penetration testing for card data environments. The HIPAA Security Rule at 45 CFR 164.308 requires a periodic technical and nontechnical evaluation. The eCFR text, current on 5 November 2026, does not contain the word "penetration". Customers, insurers and auditors may still ask for a test.

Our guides cover the text: [HIPAA penetration testing](https://penetrationtestservices.com/guides/hipaa-penetration-testing/), [PCI DSS penetration testing requirements](https://penetrationtestservices.com/guides/pci-dss-penetration-testing-requirements/) and [cyber insurance requirements](https://penetrationtestservices.com/guides/cyber-insurance-penetration-testing-requirements/).

## What should you ask a US provider?

Ask these seven questions in writing:

1. Where are the testers located, and who has access to our data?
2. Where do you store the report and the evidence, and for how long?
3. What is the retest policy?
4. Can I see a sample report?
5. Which frameworks have you written reports for?
6. Who signs the report, and can you provide an attestation letter?
7. How do you handle a critical finding found during testing?

Our guide on [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) adds general questions.

## What drives the price of a US pentest?

Price follows the scope (applications, APIs, hosts, user roles), the depth, the report format and the retest terms. Providers in the table mostly quote after scoping, and a few publish a price for a product or tier. Compare prices only for the same scope. See [penetration testing cost](/guides/penetration-testing-cost/) for named published prices.

## How should you read the table?

Each row is that provider's statement, sorted A to Z. "Not published" means we found no statement, not that the item is absent. Delivery shows whether people, tools or both do the work. The dataset shows more human-led providers than automated ones for the US headquarters filter, but that reflects who publishes a headquarters, not the market.

For sample reports, "public" means you can read one before you buy. Our list of [pentest companies with sample reports](/lists/pentest-companies-with-sample-reports/) filters on that field alone.

## Does remote or on-site delivery, and data location, matter?

Most application and API testing runs remotely. Network, wireless and physical work may need people on site, and travel changes the quote. Ask where the tester sits for each part of the work.

For data, ask where the evidence is stored and whether it leaves the US. For comparison with another market, see [penetration testing companies in the United Kingdom](/locations/united-kingdom/).

## Questions

### Does US law require a penetration test?

We sourced no general US rule. PCI DSS requirement 11.4 names pentests for card data environments. The HIPAA Security Rule text at 45 CFR 164.308 does not contain the word penetration, as of 5 November 2026. Contracts and customers often ask for tests.

### How does this page decide that a company is American?

It uses the headquarters country in the dataset, taken from the provider's own pages. Where the pages do not state a headquarters, the field reads Not published and the provider is not listed on country pages.

### Are the listed companies ranked?

No. The list is A to Z. No provider pays for position. Use the table to compare published price, retest terms and sample report status, then ask for quotes on the same scope.

### Can a company outside the USA test my US systems?

Usually yes, since most testing is remote. The questions are where the testers sit, where your data goes and which law applies to the contract. Ask each provider in writing.

## Sources

- [PCI SSC Penetration Testing Guidance v1.1 (September 2017)](https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf)
- [eCFR: 45 CFR 164.308 Administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)
- [PentestCompare methodology and provider dataset](https://pentestcompare.com/methodology/)