# PTaaS market snapshot 2026: 66 pentest providers by model

Source: https://pentestcompare.com/research/pentest-provider-market-2026/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

PTaaS market snapshot from 66 pentest providers: 32 human-led, 19 hybrid, 15 automated. Only 21 publish prices and 14 a public sample report. Counts, method, CSV.

> **Short answer:** We counted what 66 pentest providers publish, using the PentestCompare dataset checked on 9 November 2026. By delivery model, 32 are human-led, 19 hybrid and 15 automated. Of the 66, 21 publish a price, 14 publish a public sample report and 31 publish a turnaround claim. The counts say nothing about market size in dollars, which we do not report.

Last updated 9 November 2026. This PTaaS market snapshot counts what 66 pentest providers say about themselves on their own public pages. Every count comes from the [PentestCompare dataset](/data/providers.json), with the predicate stated under each table. We report no market-size dollar figures.

## Headline counts for the pentest provider market

Of 66 providers in the dataset on 9 November 2026, 32 are human-led, 19 are hybrid and 15 are automated. Twenty-one publish a price, 14 publish a public sample report and 31 publish a turnaround claim. Nineteen publish none of the three: no price, no sample report and no turnaround.

| Count | Providers | Share of 66 | Predicate |
|---|---|---|---|
| Human-led | 32 | 48% | Dataset delivery label is "human-led" |
| Hybrid | 19 | 29% | Dataset delivery label is "hybrid" |
| Automated | 15 | 23% | Dataset delivery label is "automated" |
| Publish at least one price | 21 | 32% | At least one price row with a source |
| Public sample report | 14 | 21% | Sample report status is "public" |
| Sample report on request | 7 | 11% | Status is "on request" |
| Publish a turnaround claim | 31 | 47% | Turnaround is not "Not published" |
| Publish headquarters country | 33 | 50% | Country is not "Not published" |

## How we counted

Researchers read each provider's public site and recorded each fact with its source URL and a check date. The dataset records "unknown" when a page does not show a fact. "Unknown" is not "no": a provider may do the work and not say so.

Each provider has one delivery label from the dataset (human-led, hybrid or automated), one type string as published, one pricing model and one sample report status. Scope fields (web application, API, cloud, network, mobile, AI applications) are "yes", "partial" or "unknown". All 66 providers were checked on 9 November 2026. The full [methodology](/methodology/) describes how researchers record and check facts. The dataset is a researched list, not a census, and counts change when providers are added or corrected.

## How many providers are human-led, hybrid or automated?

Human-led providers are the largest group at 32 of 66, and they are mostly consultancies. The three delivery labels split by what the provider publishes as follows.

| Delivery model | Providers | Share | Publish a price | Public sample report | Publish a turnaround |
|---|---|---|---|---|---|
| human-led | 32 | 32 (48%) | 3 | 8 | 11 |
| hybrid | 19 | 19 (29%) | 10 | 2 | 11 |
| automated | 15 | 15 (23%) | 8 | 4 | 9 |
| All | 66 | 100% | 21 | 14 | 31 |

Human-led providers publish the least. Three of 32 list a price (9%), against 10 of 19 hybrid providers (53%) and 8 of 15 automated providers (53%). The gap is smaller for sample reports: 8 of 32 human-led providers have a public one (25%), against 2 of 19 hybrid (11%) and 4 of 15 automated (27%). For what each model means for a buyer, read [AI vs human pentesting](/guides/ai-vs-human-pentesting/) and [PTaaS vs traditional pentesting](/guides/ptaas-vs-traditional-pentesting/).

## What types of pentest provider are in the market?

We grouped the 20 type strings, exactly as the dataset records them, into three families. Platform-type providers (26) include 9 labeled "Autonomous testing platform", 7 "Application security platform" and 7 labeled PTaaS ("PTaaS platform" or "Penetration testing as a service (PTaaS)"). Consultancy-type providers (34) are mostly human-led.

| Type family | Providers | Human-led | Hybrid | Automated |
|---|---|---|---|---|
| Consultancy or services provider | 34 | 31 | 3 | 0 |
| Platform or PTaaS | 26 | 1 | 13 | 12 |
| AI-assisted testing service | 6 | 0 | 3 | 3 |

Family rules: "Platform or PTaaS" holds every type string that contains "platform" or "PTaaS", except strings that also say "consultancy" or "security services". "AI-assisted testing service" holds the 6 providers with that exact type. Everything else is "Consultancy or services provider". One type ("Penetration testing consultancy and platform") goes to the consultancy family under this rule.

The type strings as published:

| Type as published | Providers |
|---|---|
| Consultancy | 12 |
| Autonomous testing platform | 9 |
| Application security platform | 7 |
| AI-assisted testing service | 6 |
| PTaaS platform | 6 |
| Security consultancy | 5 |
| Penetration testing consultancy | 4 |
| Boutique consultancy | 3 |
| Crowdsourced platform | 2 |
| Cyber security services provider | 2 |
| Application security consultancy | 1 |
| Assurance and cyber security provider (Nettitude is now part of LRQA) | 1 |
| Managed services and cyber security provider | 1 |
| Offensive security consultancy | 1 |
| Penetration testing and cyber security consultancy | 1 |
| Penetration testing as a service (PTaaS) | 1 |
| Penetration testing consultancy and platform | 1 |
| Penetration testing firm | 1 |
| Penetration testing provider (part of WorkNest Secure) | 1 |
| Vulnerability scanning and pentest platform | 1 |

## Which scopes do providers cover?

Web application testing is the scope most providers confirm: 57 of 66 (86%). The share falls as the scope widens. Coverage in this table is the scope a provider's own pages show, so "unknown" means the dataset found no statement, not that the provider declines the work.

| Scope | Yes | Partial | Unknown | Share "yes" |
|---|---|---|---|---|
| Web application | 57 | 0 | 9 | 86% |
| API | 47 | 0 | 19 | 71% |
| Cloud | 41 | 1 | 24 | 62% |
| Network | 43 | 2 | 21 | 65% |
| Mobile | 39 | 0 | 27 | 59% |
| AI applications | 42 | 0 | 24 | 64% |

Nineteen providers show all six scopes as "yes". Forty-four show both web application and API as "yes". If your project is a mobile app, 27 providers (41%) have no confirmed coverage in the dataset, so ask them directly.

## Where are pentest providers headquartered?

Only 33 of 66 providers (50%) publish a headquarters country, and the dataset records the other 33 as "Not published". Among the 33 that do, 14 are in the United States. The counts below use the country as the provider states it.

| Headquarters country | Providers |
|---|---|
| Not published | 33 |
| United States | 14 |
| Canada | 4 |
| Germany | 3 |
| United Kingdom | 3 |
| France | 2 |
| Ireland | 2 |
| India | 1 |
| Multiple (United States, Belgium, United Kingdom) | 1 |
| Netherlands | 1 |
| Poland | 1 |
| Switzerland | 1 |

The country is a poor guide to where testers work or where data is stored. A provider with a US head office can run its tests from anywhere. Ask where tests run if data residency matters to you.

## How transparent are providers about price, sample reports and turnaround?

Transparency is low for human-led work and uneven overall. Twenty-one of 66 providers (32%) publish a price, 21 offer a sample report (14 public, 7 on request) and 31 publish a turnaround claim of some kind. The dataset's pricing model label shows how that splits:

| Pricing model (dataset label) | Providers | With at least one price row |
|---|---|---|
| custom quote | 37 | 0 |
| published | 12 | 12 |
| mixed | 9 | 9 |
| not published | 8 | 0 |

"Custom quote" and "not published" together cover 45 providers, none of which has a price row. "Published" and "mixed" cover the 21 that do.

| Sample report status | Providers | Share |
|---|---|---|
| public | 14 | 14 (21%) |
| on request | 7 | 7 (11%) |
| not published | 45 | 45 (68%) |

Of the 21 providers with a price row, 6 also have a public sample report, 1 has a sample report on request, and 14 publish a turnaround claim. Seven of the 21 publish a price and nothing else. Of the 45 providers with no price, 19 also publish neither a sample report nor a turnaround claim. To judge a report before you buy, use [how to judge a pentest provider by its sample report](/guides/judge-a-pentest-provider-by-its-sample-report/).

Turnaround claims are not comparable between providers. They range from hours for a first automated report to "10-15 working days" for a manual test, and they describe different starting points. Treat them as claims that need a written scope.

## What are the limits of these counts?

The counts describe the 66 providers in a researched dataset. They are not a count of all pentest providers, and the dataset was built to compare buyers' options, so well-known and well-documented providers are more likely to be in it. We do not report a market size in dollars. Published analyst figures for PTaaS and penetration testing markets are paywalled and differ between firms, and we did not open a primary source for any of them.

A provider can be counted as "not published" when it shares the fact with customers after a call. The hybrid label covers any mix of AI and human testing, and we assigned labels from each provider's own description, not from a test of its work. The type family grouping is our rule (stated above), so another rule would move providers between families. PentestCompare is published by Excession Labs, which is not a row in this dataset, so none of these counts include it. Corrections go through the [correction form](/contact/).

## Download the data and cite it

[Download provider-market-2026.csv](/research-data/provider-market-2026.csv). It has one line per provider (66 lines) with type, type family, delivery model, headquarters country, pricing model, whether a price is published, sample report status, whether a turnaround is published, the six scope fields and the check date. The computed tables are under CC BY 4.0. For the price rows behind these counts, see the [pentest pricing index](/research/pentest-pricing-index-2026/).

Cite it as: PentestCompare, "PTaaS market snapshot 2026", 9 November 2026, https://pentestcompare.com/research/pentest-provider-market-2026/. State the predicate and the date with any figure, for example "21 of 66 providers publish a price, 9 November 2026".

## Questions

### How big is the PTaaS market in dollars?

This page does not say. Analyst market-size figures are paywalled and differ between firms, and we did not open a primary source for any of them. We count providers and what they publish. Ask an analyst firm for its method before you cite a dollar figure.

### How many pentest providers are there?

The dataset has 66, checked on 9 November 2026. It is a researched list, not a census of all providers. Any provider can ask for a listing or a correction, and counts here change when the dataset changes.

### What share of providers publish a price?

21 of 66 (32%) list at least one price on their own pages. Only 3 of the 32 human-led providers do, against 10 of 19 hybrid and 8 of 15 automated providers.

### Does PTaaS mean the same as automated pentesting?

No standard fixes it. In this dataset, 7 providers label their type as PTaaS, and the 26 platform-type providers split into 13 hybrid, 12 automated and 1 human-led. Check who tests, which scope is covered and what the report shows.

## Sources

- [PentestCompare provider dataset (providers.json)](https://pentestcompare.com/data/providers.json)
- [PentestCompare methodology](https://pentestcompare.com/methodology/)