Penetration testing pricing comparison: published prices by provider
Of the 66 providers in the PentestCompare dataset, 21 list at least one price on their own pages as of 9 November 2026. The units differ: per test, per assessment, per credit, per asset, per target, per month or per year. Each provider's published prices, units and source are listed on this page. The other 45 quote after scoping or publish nothing.
Penetration testing pricing comparison starts with one fact: most providers do not publish a price. As of 9 November 2026, 21 of the 66 providers in our dataset list at least one price on their own pages. Each price below links to the page we read, and every record was checked on 9 November 2026.
Which providers publish a price?#
The table lists every provider with a published price, A to Z. It shows the first three price items per provider. Open the profile for the rest. "Starting" means the provider calls it a starting price.
| Provider | Published prices (first three items) | Price page |
|---|---|---|
| Aikido | TYPICAL Pentest: $4,000 per assessment; Rightsized Pentest: $50 to $30,000+ per assessment | Source |
| Astra Security | Pentest Auto: $2,999 per year (card also shows $199 per month); Pentest Expert: $5,999 per year; Pentest Enterprise: from $9,999 per year; 1 more on the source page | Source |
| Cobalt | Autonomous Pentest (limited-time offer): $3,500 per test | Source |
| CYBRI | Web Application: $5,000 starts at, per engagement; Web App, API, Cloud, or AI: $9,500 starts at, per engagement; Multiple Apps, APIs, and Clouds: $20,000 starts at, per engagement; 1 more on the source page | Source |
| Detectify | Starter: from EUR 0 per year (annual platform fee); Standard: from EUR 2,500 per year (annual platform fee); Professional: from EUR 5,000 per year (annual platform fee); 2 more on the source page | Source |
| Giskard | Free: $0 no billing unit given | Source |
| Hadrian | Nova test: From EUR 1,250 per test, excluding VAT | Source |
| Horizon3.ai (NodeZero) | Flex: $15 per asset, per test (12-month term); Core: $50 per asset, annual subscription; Pro: $65 per asset, annual subscription; 2 more on the source page | Source |
| Intruder | Single pentest: $3,500 per test; 4 pentest pack: $12,000 per pack of 4 tests (about $3,000 each); AI Pentesting (product page): $4,000 per test, standalone purchase | Source |
| Payatu | AI-Native Express: $3,500 per test (starts from); AI-Led Expert: $5,000 per test (starts from) | Source |
| Penligent | Free: $0 per month; Pro: $99.9 per month; Trial task top-up: $19.9 per top-up, one-time | Source |
| Pentest-Tools.com | NetScan: from $96 per month, 16 assets; AppScan: from $140 per month, 5 assets; Exploit: from $190 per month, 5 assets; 1 more on the source page | Source |
| Penti | Starter: $20 per month ($216 per year billed annually); Launch: $300 per month ($3,240 per year billed annually); Plus: $1,000 per month ($10,800 per year billed annually); 3 more on the source page | Source |
| Prescient Security | Traditional Pentest: from $6,000 per engagement (scope-based); Compliance Pentest: from $3,000 per engagement (scope-based); Cait subscription (AI): $850 per month per asset; 3 more on the source page | Source |
| Secure Ideas | External Penetration Test (smallest scope): $8,160 per test (flat fee, starting); API Penetration Test (smallest scope): $10,880 per test (flat fee, starting); Web Application Test (smallest scope): $13,600 per test (flat fee, starting); 2 more on the source page | Source |
| Securitum | Time and materials: 640 EUR to 890 EUR per man day; Fixed time and cost: 3,500 EUR to 14,000 EUR per engagement (typical total) | Source |
| Stingrai | Autonomous Pentest: US$3,000 per assessment; Hybrid Pentest: US$6,800 per assessment | Source |
| Strix | Pro: $29 per seat per month | Source |
| Synack | Sara Pentest: $5,085 per test (starting price); SynackST (compliance): $10,283 per test (starting price); Synack14: $27,120 per test (starting price) | Source |
| TurboPentest | Audit-Ready: $99 per credit (one pentest); Threat-Hunt: $299 per credit (one pentest); Adversarial-Depth: $699 per credit (one pentest); 2 more on the source page | Source |
| ZeroThreat | Professional: $100 per target per month; Pay Per Scan: $125 for 5 scan credits ($25 per credit, valid 1 year); Free: $0 1 scan credit per month, 1 target | Source |
Prices are copied from provider pages. We did not convert currencies, average anything or add tax. Excession Labs, the publisher of this site, publishes no prices on this table.
What do the filterable columns show?#
This second table uses the same dataset and shows delivery model, scope, turnaround, retest terms and sample report status for each provider with a published price. Use the filters to narrow it.
21 of 21 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| Astra SecurityPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $2,999 per year (card also shows $199 per month) +3 more | Manual pentest: 10-15 working days. Pentest Auto: first report the… | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… | not published |
| CobaltPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within… | Comparison table: free retesting for 6 months (Standard) or 12… | on request |
| CYBRIPenetration testing consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | $5,000 starts at, per engagement +3 more | From 5 business days (Web Application and Custom), 10 (Web, API,… | Remediation testing is included in the $9,500 and $20,000 tiers.… | not published |
| DetectifyApplication security platform | automated | Yes | Yes | ? | ? | ? | ? | from EUR 0 per year (annual platform fee) +4 more | Not published | Not stated on the pricing page. | not published |
| GiskardAI-assisted testing service, France | hybrid | ? | Yes | ? | ? | ? | Yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| HadrianAutonomous testing platform, Netherlands | hybrid | Yes | ? | ? | ? | ? | ? | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| Horizon3.ai (NodeZero)Autonomous testing platform, United States | automated | Yes | Yes | Yes | Yes | ? | ? | $15 per asset, per test (12-month term) +4 more | Not published as a time. WebApp page says tests can be set up… | Findings include fix actions with one-click verify. On Core, Pro and… | not published |
| IntruderApplication security platform, United Kingdom | automated | Yes | ? | ? | ? | ? | ? | $3,500 per test +2 more | Setup in minutes; results within hours; the pricing page says… | Unlimited retesting on the single test and the 4-pack. Packs expire… | not published |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| PenligentAI-assisted testing service | automated | Yes | ? | ? | Yes | ? | ? | $0 per month +2 more | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk… | Public |
| Pentest-Tools.comVulnerability scanning and pentest platform | hybrid | Yes | Yes | Yes | Yes | ? | Yes | from $96 per month, 16 assets +3 more | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| Prescient SecurityConsultancy | hybrid | Yes | Yes | Yes | Yes | Yes | ? | from $6,000 per engagement (scope-based) +5 more | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms… | not published |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| StrixAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or… | not published |
| SynackCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $5,085 per test (starting price) +2 more | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days… | Patch verification is listed as included in each product; the… | not published |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
| ZeroThreatAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | $100 per target per month +2 more | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting… | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What price units do providers use?#
Providers bill in at least seven units, and a price in one unit does not convert to another. The dataset shows these:
| Unit | Example from the table | What it buys |
|---|---|---|
| Per test or assessment | Synack Sara Pentest, $5,085 (starting) | One test of a defined scope |
| Per credit | TurboPentest Audit-Ready, $99 | One pentest, sized by the credit tier |
| Per engagement | CYBRI Web Application, $5,000 (starts at) | A scoped project |
| Per man day | Securitum, 640 EUR to 890 EUR | Tester time |
| Per asset | Horizon3.ai Core, $50 per asset, annual subscription | Coverage of each discovered asset |
| Per target | Astra Scanner Lite, $69 monthly / $699 annual | One scanned target |
| Per month or year | Detectify Standard, from EUR 2,500 per year | Platform access |
The cost guide covers the pricing models and what drives a quote. This page is the lookup by vendor.
Where are the pricing pages by vendor?#
These pages explain one vendor's price, unit, retest terms and quote checklist. Pages marked planned are still being written.
- XBOW pricing: no price published, usage-based.
- Astra Security pricing: plans per target, per year.
- Planned: Cobalt, HackerOne, Horizon3.ai, Pentera, Synack, Intruder, Detectify and Aikido.
What about providers that do not publish a price?#
Most providers quote after scoping. In the dataset, 45 of the 66 have no sourced price. Examples are HackerOne, Bugcrowd, Pentera and XBOW, whose records say the price is a custom quote or not published. A missing price tells you the vendor sells through a call. It does not tell you the test costs more or less.
Ask these providers for the same items in writing:
- The unit and the total, with taxes stated.
- The scope: apps, APIs, roles and environments.
- Who tests and who reviews findings.
- Retest terms: window, count and any fee.
- Platform or support fees and the minimum term.
- A sample report.
The scoping checklist helps you write the scope once and send it to every provider. The questions guide lists what to ask about the team and the report.
How do you compare prices that use different units?#
Convert every quote to a total for your scope over 12 months, then compare the totals.
- Write one scope summary: number of apps, APIs, roles and environments.
- Ask each provider for the 12-month total for that scope, including retests.
- Add platform and support fees.
- Note what the total includes: who tests, depth and report.
- Compare totals only where the scope and depth match.
Worked example with fictional numbers
This is a demonstration of the method. No real provider or quote is shown. Provider A bills $4,000 per test. Provider B bills $9,000 per year for one target with 2 re-scans. For one test and one re-scan, A costs $4,000 and B costs $9,000. For four tests in a year, A costs $16,000 and B still costs $9,000. The cheaper option flips when the number of tests changes, so fix the scope before you compare.
Found a wrong price or a missing provider? Send a correction or list your company.
Questions
How many pentest providers publish a price?
As of 9 November 2026, 21 of the 66 providers in our dataset list at least one price on their own pages. The rest quote after scoping or publish nothing. The count comes from the dataset: a provider counts if its record has a sourced price.
Why can I not compare these prices directly?
The units differ. One provider bills per test, another per asset, per credit, per month or per year. Scope, depth, who tests and retest terms differ too. Price the same scope for 12 months with each provider, then compare the totals.
Are the listed prices the final price?
No. Many are starting prices. Some exclude VAT or a platform fee. Check the notes on each provider profile and ask for a written quote for your scope before you decide.
What if a provider changes its price?
Each row shows the page we read and the date. If a price on a provider page differs from ours, send a correction and we will check the source and update the record.
Sources
- PentestCompare provider dataset (checked 9 November 2026)
- PentestCompare methodology (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.