What 66 penetration testing providers do not publish

Last updated 9 November 2026. We counted what 66 penetration testing providers leave off their public pages, using only the PentestCompare provider dataset. Every count states its rule, and every provider was checked on 9 November 2026. No provider is named here. The per-provider flags are in the study CSV.

Headline counts#

Of the 66 providers, 45 publish no price and 45 publish no sample report of any kind. 39 give no time for the work, and 28 make no statement about retesting. 35 list no credential that the dataset could link to evidence.

The linked price count opens the filter on the main table. The other counts come from the CSV, one line per provider. The summary file holds every figure on this page.

How we counted#

Researchers read each provider's public site and recorded a fact only when a page stated it, with the URL and the check date. All 66 records carry the check date 9 November 2026. A value the pages do not show is stored as "Not published" or "unknown". The methodology page gives the rules for each field.

Most counts apply a fixed rule to one dataset field (the table above). Two counts needed a reading of free text, and we coded them by hand on 9 November 2026:

• Retest limit stated: the retest text gives a number of rounds, a time window, the word "unlimited" or a price for the retest.
• Turnaround that ends at a report: the turnaround text gives a time that ends when a report is delivered.

Both have their own column in the CSV, so you can check each line against the dataset text. Excession Labs publishes PentestCompare and sells security testing. Its own row is excluded from every count here, as it is from every filtered table on this site.

The dataset has no field for a published testing methodology, for individual tester certifications, for insurance or for report format. We did not count those, so this page makes no claim about them.

How many publish all five facts?#

4 of the 66 providers publish all five of these facts: a price, a public sample report, a time for the work, a retest statement and a credential with evidence. 9 publish none of the five. The median provider publishes 2.

For this count a sample report must be public. A report "on request" cannot be checked before a call.

Gaps by delivery model#

Human-led providers publish the fewest prices (3 of 32) and the fewest retest statements (10 of 32). Automated providers publish the fewest credentials (3 of 15).

Delivery labels come from each provider's own description (delivery field), not from a test of its work.

Price and sample reports#

45 providers publish no price. In the dataset's pricing model field, 37 are "custom quote" and 8 "not published". The 21 that publish a price have 68 price rows between them, and the units differ (a test, a year, a month, credits). The pricing index groups them by unit.

14 providers link a public sample report and 7 offer one on request. 45 show no sample report. 31 providers publish neither a price nor any kind of sample report, and only 6 publish both a price and a public report.

Turnaround#

35 providers have no turnaround text at all. 4 more have text that opens with "Not published" and then gives a partial figure, such as a typical engagement length. That leaves 27 that state some time.

The 27 claims measure different things: time to start, time to first findings, the length of the test window, or time to a report. Only 7 give a time that ends at report delivery. A time to first findings and a time to the final report are different promises, so read what each claim measures before you compare two providers.

Retesting#

28 providers make no statement about retesting. 38 do, but only 21 state a limit: how many rounds, for how long, "unlimited", or the price of a retest. The other 17 say retests happen or are included and give no limit.

Retest terms set what it costs to confirm a fix after the report. A statement such as "retesting is included" leaves open how many rounds you get, how long the offer lasts and whether a retest produces an updated report.

Credentials#

35 providers list no credential with an evidence link. The dataset lists a credential only when a page links a certificate or a directory entry, so a badge alone does not count. Of the 31 that list one or more:

A provider can hold more than one. These are company credentials. CREST's membership FAQ says individual certifications are not a mandatory requirement for accreditation, though some schemes set their own. A company credential does not tell you who will test your system. Check each claim on the issuer's register.

Scope and headquarters#

33 providers do not publish a headquarters country. For scope, the dataset marks a field "unknown" when the pages do not say whether the provider tests that surface.

19 providers have no unknown scope field. If you need a mobile or cloud test, ask about it directly, because 27 and 24 providers do not say.

What a buyer should ask for#

Each request below closes one of the gaps counted above. Ask for the answer in writing, in the proposal or the contract.

1. A price for your scope, with its unit (per test, per year, per asset or per credit) and what it excludes. 45 of 66 publish no price.
2. A sample report for the same kind of test you are buying, redacted if needed. 45 publish none. The sample report guide lists what to look for in it.
3. The date you get the final report, counted from a stated start point. Only 7 of 66 publish a time that ends at a report.
4. Retest terms: the number of rounds, the window after the report, the price, and whether you get an updated report. 45 publish no limit (28 say nothing, 17 give no limit).
5. The credentials that cover the service you buy, with the register entry, and the names and qualifications of the people who will test. 35 list no credential with evidence.
6. Confirmation that every system in your scope is covered, by name. Up to 27 providers do not say whether they test a given surface.
7. The country the testers work from and where your data is stored, if that matters to you. 33 do not publish a headquarters country.

The questions to ask a pentest provider guide has the full list.

Limits#

• The counts describe 66 providers in a researched dataset, not every pentest provider. Well-documented providers are more likely to be in it.
• "Not published" means the pages we read did not state the fact on 9 November 2026. A provider may share it after a call, and its pages may have changed since.
• A published fact is a claim by the provider. We did not test whether a provider keeps its stated terms.
• Two counts (retest limit, turnaround that ends at a report) depend on how we read free text. Another reader could code a few lines differently. The CSV shows our coding for each line.
• The counts change when the dataset changes. Quote a figure with its rule and the date, for example "45 of 66 providers publish no price, 9 November 2026".

Download the data and cite it#

• providers.csv: one line per provider (66 lines) with the flags behind every count on this page and the check date.
• summary.json: every figure on this page.
• providers.json: the source dataset, with the text and source URL for each fact.

The files are under the MIT licence. Cite as: PentestCompare, "What 66 penetration testing providers do not publish", 9 November 2026, https://pentestcompare.com/research/what-pentest-providers-do-not-publish/. Corrections go through the correction form.