# LLM penetration testing companies: who tests AI apps

Source: https://pentestcompare.com/services/ai-llm-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

LLM penetration testing providers in one sourced table, A to Z, with a scope split of model, app, agent and infrastructure and six questions to ask each.

> **Short answer:** LLM penetration testing checks an AI application for flaws such as prompt injection, data leaks and excessive agency. The table lists providers that state AI application testing, A to Z and unranked. Before you compare quotes, decide which layer you need tested: the model, the application, the agents and tools, or the infrastructure.

Teams that ship a chatbot, a copilot, a retrieval system or an agent now ask for a pentest of it. This page filters the PentestCompare dataset to providers whose pages state AI application testing. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Black Hills Information Security](https://pentestcompare.com/providers/black-hills-information-security/) | Security consultancy | human-led | yes | unknown | unknown | yes | not published | Not published | Not published | not published |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [Equixly](https://pentestcompare.com/providers/equixly/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published | Revalidates whenever applications and AI systems change; no separate retest policy is stated. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [IOActive](https://pentestcompare.com/providers/ioactive/) | Security consultancy | human-led | unknown | unknown | unknown | yes | not published | Not published | Not published | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [Lakera](https://pentestcompare.com/providers/lakera/) | Application security platform | hybrid | unknown | unknown | unknown | yes | custom quote | Not published | Not published | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [Mindgard](https://pentestcompare.com/providers/mindgard/) | Application security platform | hybrid | unknown | yes | unknown | yes | custom quote | Not published | Teams can retest fixes; Assure re-triggers when the AI system changes. | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [SPLX](https://pentestcompare.com/providers/splx/) | Application security platform | automated | unknown | yes | unknown | yes | custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |

## What does LLM penetration testing cover?

LLM penetration testing is an authorized test of an AI application to find flaws an attacker could use. It tests the whole system around the model, including tools, data stores and permissions.

Providers split the work into four layers. Ask which layers a quote includes, because the names overlap.

| Layer | What the tester examines | Example finding |
|---|---|---|
| Model | Training data, fine-tuning, refusal behavior | The model repeats private training text |
| Application | Prompts, retrieval, output handling, user permissions | A user reads another tenant's documents through the retrieval index |
| Agent and tools | What the model can call, and what approval each call needs | An injected instruction makes the agent send an email |
| Infrastructure | APIs, secrets, hosting, logging | A key sits in a client-side bundle |

The common baseline is the OWASP Top 10 for LLM Applications. OWASP published its 2026 edition on 4 August 2026. The 2026 list names Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), Excessive Agency (LLM03), Supply Chain (LLM04), Data and Model Poisoning (LLM05), Unbounded Consumption (LLM06), Misinformation (LLM07), Hidden Context Exposure (LLM08), Vector and Embedding Weaknesses (LLM09) and Improper Output Handling (LLM10) ([OWASP 2026 README](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/README.md)). Some blogs still show the 2025 list. Ask which edition the test follows.

For a wider view of the market, see our guides on [AI penetration testing services](/guides/ai-penetration-testing-services/) and [AI red teaming providers](/guides/ai-red-teaming-providers/). This page covers the scope question for LLM applications only.

## Who needs an LLM application pentest, and when?

You need one when the AI feature can read private data or take actions for a user. A chatbot that only answers public questions carries a different risk from an agent that reads a mailbox or writes to a database.

Test before launch of a feature that connects the model to tools or customer data, and again after you add a new tool, a new data source or a new model. A model change can alter behavior that earlier tests covered.

## What should you ask LLM pentest providers?

Ask for written answers to these six questions.

1. Which of the four layers (model, application, agent and tools, infrastructure) does the quote cover?
2. Which OWASP edition or other list does the test follow?
3. Which test accounts and roles will the tester use, and how do you stop tests from touching real user data?
4. How does the report prove a finding: the full prompt, the response, the account and the effect?
5. What do you retest, and for how long after the report?
6. Who reviews each finding before it reaches the report, a person or software alone?

The table's Sample report column helps with question 4. A public sample report shows the evidence standard before you sign.

## What drives the price?

Few AI-specific prices are public. Most price rows in the dataset belong to general pentest products from providers that also state AI testing. Two examples show what is published. CYBRI lists a "Web App, API, Cloud, or AI" tier starting at $9,500 per engagement ([CYBRI](https://cybri.com/pricing/)). Giskard lists a Free plan at $0 with no billing unit given ([Giskard](https://www.giskard.ai/pricing)). Both were checked on 9 November 2026.

The drivers you can control are the number of tools and data sources the model can reach, the number of user roles, and whether you want model-level testing or only application testing. Each added tool is another path for the tester to try.

## How do you read the table?

Read the table as a screening step. The AI/LLM label here means the provider's page states AI application testing. It does not tell you how deep the testing goes, or which layers it covers.

Compare the Delivery column first. Automated, hybrid and human-led providers sell different products under the same name. JUMPSEC, for example, states that its AI penetration testing covers apps, chatbots and large language models, with the OWASP LLM Top 10 as a baseline ([JUMPSEC](https://www.jumpsec.com/ai-penetration-testing/)). Use a statement like this as a starting point for a question and not as proof of quality.

## Which scoping mistakes weaken an LLM pentest?

- The scope names the chatbot but not its tools. The agent's actions are where most impact sits.
- Only one test account exists. The tester then cannot check whether user A reaches user B's documents through the model.
- The test uses production data. Use test-owned accounts and records marked as test data.
- The quote counts prompts and not findings. A fixed list of prompts finds known attacks. Ask how the tester adapts.

> **Sample scope sentence:** This is a demonstration for a fictional app, Harbor Notes Assistant. No real system was tested.
> 
> "In scope: the assistant at app.example.com, its retrieval index, and the three tools it can call (search notes, send email, create task). Two test tenants with one admin and one viewer each. Out of scope: the hosted model provider's own infrastructure. Limits: no email to real addresses."
Use the [scoping checklist](/tools/scoping-checklist/) to set roles, environments and limits before you ask for quotes.

## Questions

### Is LLM penetration testing the same as AI red teaming?

The terms overlap and providers use them in different ways. Red teaming often means probing the model for unsafe output. A penetration test of an LLM application also covers the app around the model: tools, data stores, permissions and APIs. Ask each provider to define its term in the quote.

### Which standard do LLM pentests follow?

No single standard governs the work. Providers commonly use the OWASP Top 10 for LLM Applications as a baseline. OWASP published a 2026 edition on 4 August 2026, so check which edition the quote names.

### Do I need to give the tester access to the model weights?

Usually not. Most application tests work through the same interface a user has. Testing the model itself, for example for poisoned training data, needs more access. Say in the scope which of the two you want.

### Can a pentest prove that prompt injection is fixed?

No. A test shows which attacks worked on a given date. It cannot show that no attack works. Ask the provider to retest your fixes and to list what it tried that failed.

### What does an AI pentest report need to show?

It needs the prompt or request, the response, the account used and the effect, such as data returned or a tool called. A screenshot of a chatbot saying something odd is not enough for a finding about access control or data exposure.

## Sources

- [OWASP GenAI Security Project: OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/)
- [OWASP GenAI-LLM-Top10 2026 README](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/README.md)
- [CYBRI: pricing](https://cybri.com/pricing/)
- [Giskard: pricing](https://www.giskard.ai/pricing)
- [JUMPSEC: AI penetration testing](https://www.jumpsec.com/ai-penetration-testing/)