Who publishes PentestCompare, how the 15 providers were chosen, what each field means, how facts are checked, what we do not do, and how to send a correction.

PentestCompare is published by Excession Labs. Excession Labs also sells penetration tests, and it appears in the provider table as one row. We do not rank providers, and the table is sorted A to Z. The data was last checked on 9 November 2026.

Who publishes this site#

Excession Labs publishes PentestCompare and pays for it. Excession Labs sells web application, API and AI application testing, so it competes with the other providers listed. We handle that conflict in four ways:

Excession Labs is one row in the table, with the same fields as the others.
The table has no ranking, score or "best" label. It is sorted A to Z by provider name.
No provider pays for a listing or a position. We use no affiliate links.
Every fact comes from a public page, and each profile shows the source and the date we checked it.

If a page here reads like advice to buy from Excession Labs, report it with the correction form below.

How we chose the 15 providers#

We aimed to cover every delivery type a buyer meets: consultancies with human testers, crowdsourced and PTaaS platforms, and automated or AI-agent products. The list draws on two sources. The first is a review of 24 competing firms dated 8 November 2026. The second is a set of well-known providers that the review did not cover. BreachLock and Horizon3.ai are in the second group. Pentera was considered and dropped because we found too little public information about it.

The list is not complete and not a ranking. A provider's absence says nothing about its quality. To suggest a provider, send it through the correction form.

Provider table, sorted A to Z#

Provider	Delivery (by its own description)	Type
Aikido	Automated	Application security platform
BreachLock	Hybrid	PTaaS platform
Cobalt	Hybrid	PTaaS platform
Escape	Automated	Application security platform
Excession Labs (publisher)	Hybrid	AI-assisted testing service
HackerOne	Hybrid	Crowdsourced platform
Hadrian	Hybrid	Autonomous testing platform
Horizon3.ai (NodeZero)	Automated	Autonomous testing platform
Parameter	Automated	AI-assisted testing service
Pen Test Partners	Human-led	Consultancy
Secure Ideas	Human-led	Consultancy
Synack	Hybrid	Crowdsourced platform
Terra Security	Hybrid	AI-assisted testing service
TurboPentest	Automated	AI-assisted testing service
XBOW	Automated	Autonomous testing platform

What each field means#

Field	Meaning
Delivery	Who does the testing, as the provider describes it. Human-led: people run the tests. Hybrid: people and AI agents or a crowd work together, or the provider sells both. Automated: software or AI agents run the tests, and any human step is limited or not described. We assign the label from the provider's own text, not from hands-on testing.
Scope	Web app, API, cloud, network, mobile and AI apps. Each is yes, no or unknown. Yes means the provider's pages name it. Unknown means the pages we read do not say. Unknown is not a no.
Pricing model	Published (list prices with units), mixed (some prices published, some by quote) or custom quote (no prices).
Price units	We copy the unit the provider uses: per test, per asset, per credit, per hour, per month or per year. Units are not comparable with each other. The cost guide explains why.
Turnaround	The provider's own claim, plus what the claim measures (time to start, time to first findings or time to final report).
Retesting	The provider's stated terms. When its pages disagree, we show both statements.
Sample report	Public (a link), on request or not published.
Credentials	Certifications and accreditations the provider lists, with the page that lists them. We report them as claims.

How we check facts#

We read the provider's own pages: pricing, product, security or trust center, and documentation. A search snippet is not a source.
Each fact carries a source URL and a check date. The profile shows the date, and the dataset has a last_checked field.
A value the provider does not publish appears as "Not published" or "unknown". We do not estimate prices, turnaround or scope.
We give no ratings or scores. We do not copy review-site scores.
A vendor claim stays a claim. If a page says "no human drives the attack", we write "the vendor says".
When a provider's pages contradict each other, we show both statements and say so.
We use no affiliate links. Links to providers go to their official sites.

What we do not do#

We have not tested any provider's service. We did not buy a test, read a customer report or measure a vendor's accuracy. Findings quality, tester skill and report quality are outside what public pages can show, and the data here cannot tell you which provider is better. To judge quality, ask for a sample report and a scope statement. The sample report guide and the questions guide say what to look for.

We do not rely on provider reviews, and we publish no testimonials.

Open data#

The dataset is free to reuse under CC BY 4.0. Credit PentestCompare and link to this page.

Corrections#

Prices, plans and credentials change often. If a fact here is wrong or out of date, send the provider name, the page, what you think is correct, and a public link that shows it. We re-read the source, fix the data when the source supports your report, and note the change. Providers can use the same form, including Excession Labs competitors and Excession Labs itself. A correction needs a public source. We do not remove a fact because a provider asks us to, but we do update it when its page changes.

How PentestCompare works: publisher, method and corrections