Bugcrowd
Bugcrowd sells pen testing as a service in Standard, Plus and Max tiers across web, mobile, network, API, IoT, cloud and AI targets, with a sample report for the Standard web app test.
Visit Bugcrowd Back to comparison
Last checked 9 November 2026. Facts come from Bugcrowd's own public pages, linked below.
At a glance
| Type | PTaaS platform |
|---|---|
| Headquarters | United States |
| Services listed | Web application penetration testing, API penetration testing, Network penetration testing, Cloud penetration testing, Mobile app penetration testing, AI and LLM penetration testing, IoT penetration testing source |
| Delivery | hybrid Platform-run pen tests with vetted testers matched by CrowdMatch AI; Max tier pairs methodology-based testing with bug bounty. |
| Scope | Web apps: yes APIs: yes Cloud: yes Network: yes Mobile: yes AI apps: yes |
| Pricing model | custom quote |
| Turnaround | Tests launch in under 72 hours; Standard: launch within 3 business days. Time to launch, not time to final report. source |
| Retesting | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. source |
| Sample report | public source |
| Compliance mentioned | PCI DSS, HIPAA, GDPR, ISO 27001, SOC 2, DORA |
| Integrations | AWS Marketplace purchase |
Pricing
Prices are not published. You need to ask for a quote.
No prices on the PTaaS page. Purchase options named: subscription, flat-rate, or pay for impact. External web app and network tests can be bought through AWS Marketplace. Advanced targets (IoT/hardware, crypto, binary, OT, onsite) cost extra on the Plus tier.
Credentials
No credentials with public evidence found.
Our assessment
Editorial judgment by Excession Labs, based on the facts above. Not a rating.
Good fit when
Teams that want a platform-managed pen test with tiered scope and a path to continuous testing or bug bounty.
Tradeoffs
No prices are published. The site claims global CREST accreditation but no CREST directory entry was checked, so no credential is listed. Tiers limit retest scope and asset types.
Sources
- Bugcrowd PTaaS (checked 9 November 2026)
- Bugcrowd homepage (checked 9 November 2026)
- Bugcrowd contact (checked 9 November 2026)
See something wrong or out of date? Send a correction.
Compare with
- Astra SecurityAstra sells annual pentest plans from an autonomous test to manual expert testing, plus separate DAST, API and cloud scanner plans, all with prices on its…
- BreachLockBreachLock offers human-led pentesting as a service from an in-house team, alongside attack surface discovery and an autonomous testing product. Pricing is…
- CobaltCobalt sells pentests through a platform that connects buyers with a network of vetted freelance testers, plus an autonomous pentest product. Work is bought…
- Halo SecurityHalo Security offers web, API, mobile, network, wireless, social engineering and red team pentests with one retest round, plus attack surface management and…