Pentest research data: pricing index and provider market snapshot
PentestCompare publishes open pentest research data computed from its provider dataset: 66 providers checked on 9 November 2026, of which 21 publish 68 price rows. The pricing index groups prices by billing unit and ships as a CSV. Each study states its method and limits. The computed tables are free to reuse under CC BY 4.0 with credit.
Last updated 9 November 2026. This page lists the open pentest research data from PentestCompare: what each dataset holds, how we collected it, when it updates and how to cite it. Each study is computed from the open provider dataset, where every fact carries its source and the date we checked it.
Which pentest research datasets are available?#
Two datasets are available. The pricing index covers published prices by billing unit. The market snapshot counts providers by delivery model, sample report access and published turnaround. Both come from the same 66-provider dataset.
| Dataset | What it holds | Size on 9 November 2026 | Format |
|---|---|---|---|
| Pentest pricing index 2026 | Published price rows, grouped by unit, with amount, unit, source URL and check date | 68 rows from 21 providers; 50 rows used in range statistics, 18 not comparable | Page and CSV |
| Pentest provider market 2026 | Provider counts by delivery model, scope, sample reports and published turnaround | 66 providers | Page |
| Provider dataset | Every provider with prices, retest claims, credentials and sources | 66 providers | JSON and CSV |
Sister sites publish survey-based statistics pages with their own sources: how often companies pentest and AI security statistics. Those pages cite third-party surveys. This site computes only from its own dataset.
What does the market snapshot show?#
The 66 providers split by delivery model into 32 human-led, 19 hybrid and 15 automated. Of the 66, 21 publish at least one price, 14 publish a sample report, 7 give one on request and 45 publish none. 35 publish no turnaround claim.
| Measure | Count | Of |
|---|---|---|
| Human-led providers | 32 | 66 |
| Hybrid providers | 19 | 66 |
| Automated providers | 15 | 66 |
| Providers that list at least one price | 21 | 66 |
| Public sample report | 14 | 66 |
| Sample report on request | 7 | 66 |
| Turnaround "Not published" | 35 | 66 |
Source: PentestCompare provider dataset, counted on 9 November 2026. A count is a count of records, not a market share.
How is the data collected?#
We read each provider's own pages and record a fact only when a page states it. The record keeps the URL and the check date. Unknown values stay "Not published". We never fill a gap with an estimate and never convert currencies or units.
For prices we copy the amount as published, with its unit, and mark starting prices. A row enters range statistics only when its unit is clear and comparable. Open-ended ranges and credit-based plans stay in the CSV with a stated reason. The methodology page lists the full rules and the publisher disclosure.
When does the data update?#
This release is dated 9 November 2026. Each provider record shows its own check date. We re-check a record when a provider sends a correction and when we review the dataset. We have not published a fixed review schedule, so treat the check date as the age of each fact.
How do I cite and reuse the data?#
Cite the page and the date. Example: "PentestCompare, Pentest pricing index 2026, https://pentestcompare.com/research/pentest-pricing-index-2026/, checked 9 November 2026." The computed tables, the CSV and the JSON are under CC BY 4.0. Quote a median only together with its unit, its provider count and the date.
All research pages#
- Pentest pricing index 2026: medians by unit from 21 providers Lab researchPentest pricing index from 68 published price rows of 21 providers, grouped by unit. Median per test is $5,000 (9 providers). Every row sourced, CSV included.
- PTaaS market snapshot 2026: 66 pentest providers by model Lab researchPTaaS market snapshot from 66 pentest providers: 32 human-led, 19 hybrid, 15 automated. Only 21 publish prices and 14 a public sample report. Counts, method, CSV.
Questions
Can I reuse the pentest research data?
Yes. The computed tables and the CSV are under CC BY 4.0. Credit PentestCompare, link to the page you used and state the check date (9 November 2026 for this release). Do not present a starting price as a quote.
Do these datasets show what companies pay for a pentest?
No. They show what providers publish on their own pages. 45 of the 66 providers publish no price, and many published prices are starting prices. A quote after scoping can differ.
Why is a provider missing or wrong?
The dataset only holds providers we could source. Send a correction with the page that shows the right fact and we will check it and update the record.
Who publishes this data?
Excession Labs, which is also a pentest provider. PentestCompare shows every provider by the same rules and from the same kind of source, and discloses this on the methodology page.
Sources
- PentestCompare provider dataset (providers.json) (checked 9 November 2026)
- PentestCompare pricing index 2026 (CSV) (checked 9 November 2026)
- Creative Commons Attribution 4.0 International (CC BY 4.0) (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.