LLM penetration testing companies: who tests AI apps
LLM penetration testing checks an AI application for flaws such as prompt injection, data leaks and excessive agency. The table lists providers that state AI application testing, A to Z and unranked. Before you compare quotes, decide which layer you need tested: the model, the application, the agents and tools, or the infrastructure.
Teams that ship a chatbot, a copilot, a retrieval system or an agent now ask for a pentest of it. This page filters the PentestCompare dataset to providers whose pages state AI application testing. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it.
44 of 44 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 7ASecurityBoutique consultancy, Ireland | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and… | Public |
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| Astra SecurityPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $2,999 per year (card also shows $199 per month) +3 more | Manual pentest: 10-15 working days. Pentest Auto: first report the… | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… | not published |
| Bishop FoxOffensive security consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| Black Hills Information SecuritySecurity consultancy, United States | human-led | Yes | ? | ? | ? | ? | Yes | Not published | Not published | Not published | not published |
| BridewellCyber security services provider | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| CobaltPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within… | Comparison table: free retesting for 6 months (Standard) or 12… | on request |
| Compass SecurityConsultancy, Switzerland | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| Cyberis (Cyberis Reply)Penetration testing and cyber security consultancy | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | not published |
| CYBRIPenetration testing consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | $5,000 starts at, per engagement +3 more | From 5 business days (Web Application and Custom), 10 (Web, API,… | Remediation testing is included in the $9,500 and $20,000 tiers.… | not published |
| DoyensecBoutique consultancy | human-led | Yes | Yes | Yes | ? | Yes | Yes | Custom quote | Not published | Not stated on the homepage or company page. Some public reports are… | Public |
| EquixlyAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Revalidates whenever applications and AI systems change; no separate… | not published |
| EscapeApplication security platform, France | automated | Yes | Yes | ? | Yes | ? | Yes | Custom quote | Continuous AI pentesting: results in minutes on merge, deploy or… | Open issues are re-checked; external network pentesting is followed… | not published |
| Excession LabsPublisherSecurity lab (AI-assisted testing) | hybrid | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | Public |
| GiskardAI-assisted testing service, France | hybrid | ? | Yes | ? | ? | ? | Yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| HackerOneCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Product page gives no start time or test length. HackerOne docs list… | Retesting is included after remediation. Docs say unlimited retests… | not published |
| IOActiveSecurity consultancy, United States | human-led | ? | ? | ? | ? | ? | Yes | Not published | Not published | Not published | not published |
| JUMPSECConsultancy, United Kingdom | human-led | ? | ? | ? | ? | ? | Yes | Custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually… | not published |
| LakeraApplication security platform, United States | hybrid | ? | ? | ? | ? | ? | Yes | Custom quote | Not published | Not published | not published |
| LRQA (Nettitude)Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | Yes | ? | Yes | Yes | Yes | Yes | Custom quote | Mobile tests: start within two weeks and usually at least three days… | Not published | not published |
| MindgardApplication security platform | hybrid | ? | Yes | ? | ? | ? | Yes | Custom quote | Not published | Teams can retest fixes; Assure re-triggers when the AI system changes. | not published |
| NetSPIPenetration testing as a service (PTaaS) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| NoveeAutonomous testing platform | automated | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code… | not published |
| Outpost24PTaaS platform | hybrid | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT… | Snapshot and Assure each include a 60-day retest window. SWAT checks… | not published |
| PacketlabsPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | The homepage says Packetlabs supports security teams with retesting;… | on request |
| ParameterAI-assisted testing service | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher… | Public |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| Pen Test PartnersConsultancy | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | PTaaS: scoped within minutes and can start immediately; results in… | Not published | not published |
| Pentest PeoplePenetration testing provider (part of WorkNest Secure) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | not published |
| Pentest-Tools.comVulnerability scanning and pentest platform | hybrid | Yes | Yes | Yes | Yes | ? | Yes | from $96 per month, 16 assets +3 more | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| SecuritumConsultancy, Poland | human-led | Yes | ? | Yes | Yes | Yes | Yes | 640 EUR to 890 EUR per man day +1 more | Not published. Typical engagement length is 1 to 4 weeks for a… | Not published | Public |
| Software SecuredConsultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner;… | Request retesting within 12 months of report delivery;… | not published |
| SPLXApplication security platform | automated | ? | Yes | ? | ? | ? | Yes | Custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| SynackCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $5,085 per test (starting price) +2 more | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days… | Patch verification is listed as included in each product; the… | not published |
| SySSConsultancy, Germany | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published. A Quick Penetration Test option can start right after… | A retest after fixes confirms the fixes work and checks for new… | not published |
| Terra SecurityAI-assisted testing service | hybrid | Yes | ? | ? | Yes | ? | Yes | Custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus… | Not published | not published |
| TrustedSecSecurity consultancy, United States | human-led | ? | ? | Yes | ? | ? | Yes | Not published | Not published | Not published | not published |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
| usd AGConsultancy, Germany | human-led | ? | ? | Yes | ? | Yes | Yes | Custom quote | Not published | Not published | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does LLM penetration testing cover?#
LLM penetration testing is an authorized test of an AI application to find flaws an attacker could use. It tests the whole system around the model, including tools, data stores and permissions.
Providers split the work into four layers. Ask which layers a quote includes, because the names overlap.
| Layer | What the tester examines | Example finding |
|---|---|---|
| Model | Training data, fine-tuning, refusal behavior | The model repeats private training text |
| Application | Prompts, retrieval, output handling, user permissions | A user reads another tenant's documents through the retrieval index |
| Agent and tools | What the model can call, and what approval each call needs | An injected instruction makes the agent send an email |
| Infrastructure | APIs, secrets, hosting, logging | A key sits in a client-side bundle |
The common baseline is the OWASP Top 10 for LLM Applications. OWASP published its 2026 edition on 4 August 2026. The 2026 list names Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), Excessive Agency (LLM03), Supply Chain (LLM04), Data and Model Poisoning (LLM05), Unbounded Consumption (LLM06), Misinformation (LLM07), Hidden Context Exposure (LLM08), Vector and Embedding Weaknesses (LLM09) and Improper Output Handling (LLM10) (OWASP 2026 README). Some blogs still show the 2025 list. Ask which edition the test follows.
For a wider view of the market, see our guides on AI penetration testing services and AI red teaming providers. This page covers the scope question for LLM applications only.
Who needs an LLM application pentest, and when?#
You need one when the AI feature can read private data or take actions for a user. A chatbot that only answers public questions carries a different risk from an agent that reads a mailbox or writes to a database.
Test before launch of a feature that connects the model to tools or customer data, and again after you add a new tool, a new data source or a new model. A model change can alter behavior that earlier tests covered.
What should you ask LLM pentest providers?#
Ask for written answers to these six questions.
- Which of the four layers (model, application, agent and tools, infrastructure) does the quote cover?
- Which OWASP edition or other list does the test follow?
- Which test accounts and roles will the tester use, and how do you stop tests from touching real user data?
- How does the report prove a finding: the full prompt, the response, the account and the effect?
- What do you retest, and for how long after the report?
- Who reviews each finding before it reaches the report, a person or software alone?
The table's Sample report column helps with question 4. A public sample report shows the evidence standard before you sign.
What drives the price?#
Few AI-specific prices are public. Most price rows in the dataset belong to general pentest products from providers that also state AI testing. Two examples show what is published. CYBRI lists a "Web App, API, Cloud, or AI" tier starting at $9,500 per engagement (CYBRI). Giskard lists a Free plan at $0 with no billing unit given (Giskard). Both were checked on 9 November 2026.
The drivers you can control are the number of tools and data sources the model can reach, the number of user roles, and whether you want model-level testing or only application testing. Each added tool is another path for the tester to try.
How do you read the table?#
Read the table as a screening step. The AI/LLM label here means the provider's page states AI application testing. It does not tell you how deep the testing goes, or which layers it covers.
Compare the Delivery column first. Automated, hybrid and human-led providers sell different products under the same name. JUMPSEC, for example, states that its AI penetration testing covers apps, chatbots and large language models, with the OWASP LLM Top 10 as a baseline (JUMPSEC). Use a statement like this as a starting point for a question and not as proof of quality.
Which scoping mistakes weaken an LLM pentest?#
- The scope names the chatbot but not its tools. The agent's actions are where most impact sits.
- Only one test account exists. The tester then cannot check whether user A reaches user B's documents through the model.
- The test uses production data. Use test-owned accounts and records marked as test data.
- The quote counts prompts and not findings. A fixed list of prompts finds known attacks. Ask how the tester adapts.
Sample scope sentence
This is a demonstration for a fictional app, Harbor Notes Assistant. No real system was tested.
"In scope: the assistant at app.example.com, its retrieval index, and the three tools it can call (search notes, send email, create task). Two test tenants with one admin and one viewer each. Out of scope: the hosted model provider's own infrastructure. Limits: no email to real addresses."
Use the scoping checklist to set roles, environments and limits before you ask for quotes.
Questions
Is LLM penetration testing the same as AI red teaming?
The terms overlap and providers use them in different ways. Red teaming often means probing the model for unsafe output. A penetration test of an LLM application also covers the app around the model: tools, data stores, permissions and APIs. Ask each provider to define its term in the quote.
Which standard do LLM pentests follow?
No single standard governs the work. Providers commonly use the OWASP Top 10 for LLM Applications as a baseline. OWASP published a 2026 edition on 4 August 2026, so check which edition the quote names.
Do I need to give the tester access to the model weights?
Usually not. Most application tests work through the same interface a user has. Testing the model itself, for example for poisoned training data, needs more access. Say in the scope which of the two you want.
Can a pentest prove that prompt injection is fixed?
No. A test shows which attacks worked on a given date. It cannot show that no attack works. Ask the provider to retest your fixes and to list what it tried that failed.
What does an AI pentest report need to show?
It needs the prompt or request, the response, the account used and the effect, such as data returned or a tool called. A screenshot of a chatbot saying something odd is not enough for a finding about access control or data exposure.
Sources
- OWASP GenAI Security Project: OWASP Top 10 for LLM Applications 2026 (checked 9 November 2026)
- OWASP GenAI-LLM-Top10 2026 README (checked 9 November 2026)
- CYBRI: pricing (checked 9 November 2026)
- Giskard: pricing (checked 9 November 2026)
- JUMPSEC: AI penetration testing (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.