# Penetration testing pricing comparison: published prices by provider

Source: https://pentestcompare.com/pricing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Penetration testing pricing comparison: which of 66 providers publish a price, in what unit, checked 9 November 2026, with links to each price page.

> **Short answer:** Of the 66 providers in the PentestCompare dataset, 21 list at least one price on their own pages as of 9 November 2026. The units differ: per test, per assessment, per credit, per asset, per target, per month or per year. Each provider's published prices, units and source are listed on this page. The other 45 quote after scoping or publish nothing.

Penetration testing pricing comparison starts with one fact: most providers do not publish a price. As of 9 November 2026, 21 of the 66 providers in our dataset list at least one price on their own pages. Each price below links to the page we read, and every record was checked on 9 November 2026.

## Which providers publish a price?

The table lists every provider with a published price, A to Z. It shows the first three price items per provider. Open the profile for the rest. "Starting" means the provider calls it a starting price.

| Provider | Published prices (first three items) | Price page |
|---|---|---|
| [Aikido](/providers/aikido/) | TYPICAL Pentest: $4,000 per assessment; Rightsized Pentest: $50 to $30,000+ per assessment | [Source](https://www.aikido.dev/pricing) |
| [Astra Security](/providers/astra-security/) | Pentest Auto: $2,999 per year (card also shows $199 per month); Pentest Expert: $5,999 per year; Pentest Enterprise: from $9,999 per year; 1 more on the source page | [Source](https://www.getastra.com/pricing) |
| [Cobalt](/providers/cobalt/) | Autonomous Pentest (limited-time offer): $3,500 per test | [Source](https://www.cobalt.io/pricing) |
| [CYBRI](/providers/cybri/) | Web Application: $5,000 starts at, per engagement; Web App, API, Cloud, or AI: $9,500 starts at, per engagement; Multiple Apps, APIs, and Clouds: $20,000 starts at, per engagement; 1 more on the source page | [Source](https://cybri.com/pricing/) |
| [Detectify](/providers/detectify/) | Starter: from EUR 0 per year (annual platform fee); Standard: from EUR 2,500 per year (annual platform fee); Professional: from EUR 5,000 per year (annual platform fee); 2 more on the source page | [Source](https://detectify.com/pricing) |
| [Giskard](/providers/giskard/) | Free: $0 no billing unit given | [Source](https://www.giskard.ai/pricing) |
| [Hadrian](/providers/hadrian/) | Nova test: From EUR 1,250 per test, excluding VAT | [Source](https://hadrian.io/pricing) |
| [Horizon3.ai (NodeZero)](/providers/horizon3/) | Flex: $15 per asset, per test (12-month term); Core: $50 per asset, annual subscription; Pro: $65 per asset, annual subscription; 2 more on the source page | [Source](https://horizon3.ai/use-case/pricing/) |
| [Intruder](/providers/intruder/) | Single pentest: $3,500 per test; 4 pentest pack: $12,000 per pack of 4 tests (about $3,000 each); AI Pentesting (product page): $4,000 per test, standalone purchase | [Source](https://www.intruder.io/pentest-pricing) |
| [Payatu](/providers/payatu/) | AI-Native Express: $3,500 per test (starts from); AI-Led Expert: $5,000 per test (starts from) | [Source](https://payatu.com/pricing) |
| [Penligent](/providers/penligent/) | Free: $0 per month; Pro: $99.9 per month; Trial task top-up: $19.9 per top-up, one-time | [Source](https://www.penligent.ai/pricing) |
| [Pentest-Tools.com](/providers/pentest-tools/) | NetScan: from $96 per month, 16 assets; AppScan: from $140 per month, 5 assets; Exploit: from $190 per month, 5 assets; 1 more on the source page | [Source](https://pentest-tools.com/pricing) |
| [Penti](/providers/penti/) | Starter: $20 per month ($216 per year billed annually); Launch: $300 per month ($3,240 per year billed annually); Plus: $1,000 per month ($10,800 per year billed annually); 3 more on the source page | [Source](https://penti.ai/pricing) |
| [Prescient Security](/providers/prescient-security/) | Traditional Pentest: from $6,000 per engagement (scope-based); Compliance Pentest: from $3,000 per engagement (scope-based); Cait subscription (AI): $850 per month per asset; 3 more on the source page | [Source](https://prescientsecurity.com/penetration-testing-services/cacilian/pricing) |
| [Secure Ideas](/providers/secure-ideas/) | External Penetration Test (smallest scope): $8,160 per test (flat fee, starting); API Penetration Test (smallest scope): $10,880 per test (flat fee, starting); Web Application Test (smallest scope): $13,600 per test (flat fee, starting); 2 more on the source page | [Source](https://secureideas.com/pricing) |
| [Securitum](/providers/securitum/) | Time and materials: 640 EUR to 890 EUR per man day; Fixed time and cost: 3,500 EUR to 14,000 EUR per engagement (typical total) | [Source](https://securitum.com/pricing.html) |
| [Stingrai](/providers/stingrai/) | Autonomous Pentest: US$3,000 per assessment; Hybrid Pentest: US$6,800 per assessment | [Source](https://www.stingrai.io/pricing) |
| [Strix](/providers/strix/) | Pro: $29 per seat per month | [Source](https://strix.ai/pricing) |
| [Synack](/providers/synack/) | Sara Pentest: $5,085 per test (starting price); SynackST (compliance): $10,283 per test (starting price); Synack14: $27,120 per test (starting price) | [Source](https://www.synack.com/pricing/) |
| [TurboPentest](/providers/turbopentest/) | Audit-Ready: $99 per credit (one pentest); Threat-Hunt: $299 per credit (one pentest); Adversarial-Depth: $699 per credit (one pentest); 2 more on the source page | [Source](https://turbopentest.com/pricing) |
| [ZeroThreat](/providers/zerothreat/) | Professional: $100 per target per month; Pay Per Scan: $125 for 5 scan credits ($25 per credit, valid 1 year); Free: $0 1 scan credit per month, 1 target | [Source](https://zerothreat.ai/pricing) |

Prices are copied from provider pages. We did not convert currencies, average anything or add tax. Excession Labs, the publisher of this site, publishes no prices on this table.

## What do the filterable columns show?

This second table uses the same dataset and shows delivery model, scope, turnaround, retest terms and sample report status for each provider with a published price. Use the filters to narrow it.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Strix](https://pentestcompare.com/providers/strix/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or cost is stated on the pricing page. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

## What price units do providers use?

Providers bill in at least seven units, and a price in one unit does not convert to another. The dataset shows these:

| Unit | Example from the table | What it buys |
|---|---|---|
| Per test or assessment | Synack Sara Pentest, $5,085 (starting) | One test of a defined scope |
| Per credit | TurboPentest Audit-Ready, $99 | One pentest, sized by the credit tier |
| Per engagement | CYBRI Web Application, $5,000 (starts at) | A scoped project |
| Per man day | Securitum, 640 EUR to 890 EUR | Tester time |
| Per asset | Horizon3.ai Core, $50 per asset, annual subscription | Coverage of each discovered asset |
| Per target | Astra Scanner Lite, $69 monthly / $699 annual | One scanned target |
| Per month or year | Detectify Standard, from EUR 2,500 per year | Platform access |

The [cost guide](/guides/penetration-testing-cost/) covers the pricing models and what drives a quote. This page is the lookup by vendor.

## Where are the pricing pages by vendor?

These pages explain one vendor's price, unit, retest terms and quote checklist. Pages marked planned are still being written.

- [XBOW pricing](/pricing/xbow/): no price published, usage-based.
- [Astra Security pricing](/pricing/astra-security/): plans per target, per year.
- Planned: [Cobalt](/pricing/cobalt/), [HackerOne](/pricing/hackerone/), [Horizon3.ai](/pricing/horizon3/), [Pentera](/pricing/pentera/), [Synack](/pricing/synack/), [Intruder](/pricing/intruder/), [Detectify](/pricing/detectify/) and [Aikido](/pricing/aikido/).

## What about providers that do not publish a price?

Most providers quote after scoping. In the dataset, 45 of the 66 have no sourced price. Examples are HackerOne, Bugcrowd, Pentera and XBOW, whose records say the price is a custom quote or not published. A missing price tells you the vendor sells through a call. It does not tell you the test costs more or less.

Ask these providers for the same items in writing:

1. The unit and the total, with taxes stated.
2. The scope: apps, APIs, roles and environments.
3. Who tests and who reviews findings.
4. Retest terms: window, count and any fee.
5. Platform or support fees and the minimum term.
6. A sample report.

The [scoping checklist](/tools/scoping-checklist/) helps you write the scope once and send it to every provider. The [questions guide](/guides/questions-to-ask-a-pentest-provider/) lists what to ask about the team and the report.

## How do you compare prices that use different units?

Convert every quote to a total for your scope over 12 months, then compare the totals.

1. Write one scope summary: number of apps, APIs, roles and environments.
2. Ask each provider for the 12-month total for that scope, including retests.
3. Add platform and support fees.
4. Note what the total includes: who tests, depth and report.
5. Compare totals only where the scope and depth match.

> **Worked example with fictional numbers:** This is a demonstration of the method. No real provider or quote is shown. Provider A bills $4,000 per test. Provider B bills $9,000 per year for one target with 2 re-scans. For one test and one re-scan, A costs $4,000 and B costs $9,000. For four tests in a year, A costs $16,000 and B still costs $9,000. The cheaper option flips when the number of tests changes, so fix the scope before you compare.
Found a wrong price or a missing provider? [Send a correction](/methodology/#corrections) or [list your company](/list-your-company/).

## Questions

### How many pentest providers publish a price?

As of 9 November 2026, 21 of the 66 providers in our dataset list at least one price on their own pages. The rest quote after scoping or publish nothing. The count comes from the dataset: a provider counts if its record has a sourced price.

### Why can I not compare these prices directly?

The units differ. One provider bills per test, another per asset, per credit, per month or per year. Scope, depth, who tests and retest terms differ too. Price the same scope for 12 months with each provider, then compare the totals.

### Are the listed prices the final price?

No. Many are starting prices. Some exclude VAT or a platform fee. Check the notes on each provider profile and ask for a written quote for your scope before you decide.

### What if a provider changes its price?

Each row shows the page we read and the date. If a price on a provider page differs from ours, send a correction and we will check the source and update the record.

## Sources

- [PentestCompare provider dataset](https://pentestcompare.com/data/providers.json)
- [PentestCompare methodology](https://pentestcompare.com/methodology/)