API penetration testing companies: who states API scope
API penetration testing companies differ in what they say about API scope. This page lists providers whose own pages state API testing, with price, retest and sample report columns and the date each fact was checked. Ask each one for spec import, roles tested, BOLA and BFLA checks, and the rate limit on test traffic.
API penetration testing companies are easy to find and hard to tell apart. Most pages say "web and API" in one phrase. The table lists providers whose own pages state API testing, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026.
48 of 48 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| AikidoApplication security platform, Multiple (United States, Belgium, United Kingdom) | automated | Yes | Yes | ? | Yes | Yes | Yes | $4,000 per assessment +1 more | TYPICAL Pentest: same-day results. The AI pentest page also says a… | Free retesting for up to 6 months, including checks for bypasses of… | Public |
| Astra SecurityPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $2,999 per year (card also shows $199 per month) +3 more | Manual pentest: 10-15 working days. Pentest Auto: first report the… | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days… | not published |
| Bishop FoxOffensive security consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| BreachLockPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive).… | on request |
| BridewellCyber security services provider | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| ClaranetManaged services and cyber security provider | human-led | Yes | Yes | ? | Yes | Yes | ? | Custom quote | Not published | Retesting is included as part of the engagement. | not published |
| CobaltPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within… | Comparison table: free retesting for 6 months (Standard) or 12… | on request |
| Compass SecurityConsultancy, Switzerland | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| CYBRIPenetration testing consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | $5,000 starts at, per engagement +3 more | From 5 business days (Web Application and Custom), 10 (Web, API,… | Remediation testing is included in the $9,500 and $20,000 tiers.… | not published |
| DetectifyApplication security platform | automated | Yes | Yes | ? | ? | ? | ? | from EUR 0 per year (annual platform fee) +4 more | Not published | Not stated on the pricing page. | not published |
| DoyensecBoutique consultancy | human-led | Yes | Yes | Yes | ? | Yes | Yes | Custom quote | Not published | Not stated on the homepage or company page. Some public reports are… | Public |
| EquixlyAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Revalidates whenever applications and AI systems change; no separate… | not published |
| EscapeApplication security platform, France | automated | Yes | Yes | ? | Yes | ? | Yes | Custom quote | Continuous AI pentesting: results in minutes on merge, deploy or… | Open issues are re-checked; external network pentesting is followed… | not published |
| Excession LabsPublisherSecurity lab (AI-assisted testing) | hybrid | Yes | Yes | ? | ? | ? | Yes | Custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | Public |
| GiskardAI-assisted testing service, France | hybrid | ? | Yes | ? | ? | ? | Yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| HackerOneCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Product page gives no start time or test length. HackerOne docs list… | Retesting is included after remediation. Docs say unlimited retests… | not published |
| Halo SecurityPTaaS platform | hybrid | Yes | Yes | ? | Yes | Yes | ? | Custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues… | not published |
| Horizon3.ai (NodeZero)Autonomous testing platform, United States | automated | Yes | Yes | Yes | Yes | ? | ? | $15 per asset, per test (12-month term) +4 more | Not published as a time. WebApp page says tests can be set up… | Findings include fix actions with one-click verify. On Core, Pro and… | not published |
| Include SecurityApplication security consultancy, United States | human-led | Yes | Yes | ? | ? | Yes | ? | Not published | Report target: a week after the assessment conclusion. | Not published | not published |
| Integrity360Cyber security services provider, Ireland | human-led | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Not published | Continuous retest options are mentioned. | not published |
| MindgardApplication security platform | hybrid | ? | Yes | ? | ? | ? | Yes | Custom quote | Not published | Teams can retest fixes; Assure re-triggers when the AI system changes. | not published |
| NetSPIPenetration testing as a service (PTaaS) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| NoveeAutonomous testing platform | automated | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code… | not published |
| Outpost24PTaaS platform | hybrid | Yes | Yes | ? | ? | Yes | Yes | Custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT… | Snapshot and Assure each include a 60-day retest window. SWAT checks… | not published |
| PacketlabsPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | The homepage says Packetlabs supports security teams with retesting;… | on request |
| ParameterAI-assisted testing service | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher… | Public |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| Pen Test PartnersConsultancy | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | PTaaS: scoped within minutes and can start immediately; results in… | Not published | not published |
| PenteraAutonomous testing platform | hybrid | Yes | Yes | Yes | Yes | ? | ? | Custom quote | Not published | Remediation is followed by re-testing; the FAQ says it revalidates… | not published |
| Pentest PeoplePenetration testing provider (part of WorkNest Secure) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | not published |
| Pentest-Tools.comVulnerability scanning and pentest platform | hybrid | Yes | Yes | Yes | Yes | ? | Yes | from $96 per month, 16 assets +3 more | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| Prescient SecurityConsultancy | hybrid | Yes | Yes | Yes | Yes | Yes | ? | from $6,000 per engagement (scope-based) +5 more | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms… | not published |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| RunSybilAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | Custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and… | on request |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| Software SecuredConsultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner;… | Request retesting within 12 months of report delivery;… | not published |
| SPLXApplication security platform | automated | ? | Yes | ? | ? | ? | Yes | Custom quote | Not published | No retest policy; testing is described as continuous. | not published |
| StingraiPenetration testing consultancy and platform, Canada | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | US$3,000 per assessment +1 more | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says… | Public |
| StrixAutonomous testing platform | automated | Yes | Yes | Yes | ? | ? | ? | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or… | not published |
| SynackCrowdsourced platform | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $5,085 per test (starting price) +2 more | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days… | Patch verification is listed as included in each product; the… | not published |
| SySSConsultancy, Germany | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published. A Quick Penetration Test option can start right after… | A retest after fixes confirms the fixes work and checks for new… | not published |
| TurboPentestAI-assisted testing service | automated | Yes | Yes | ? | Yes | ? | Yes | $99 per credit (one pentest) +4 more | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no… | Public |
| VumetricPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Most penetration tests can be performed within a couple of days, but… | Not stated | on request |
| XBOWAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | Custom quote | First validated findings arrive in hours; testing is continuous or… | Retests after a fix are described as free and unlimited. | not published |
| ZeroThreatAutonomous testing platform | automated | Yes | Yes | ? | ? | ? | ? | $100 per target per month +2 more | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting… | not published |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
What does API penetration testing cover?#
An API penetration test sends authenticated requests to your endpoints and checks what a caller can read or change. The OWASP API Security Top 10 (2023 edition) is the usual checklist. It starts with API1:2023 Broken Object Level Authorization and includes API5:2023 Broken Function Level Authorization and API4:2023 Unrestricted Resource Consumption.
A test also covers the auth flow, object properties, business flows and third-party calls. The method itself is on the service sites. See API penetration testing for how a test runs. This page helps you choose who runs it.
Who needs an API pentest, and when?#
You need one when an API holds data for more than one customer, or when a mobile app, partner or customer integration depends on it. The usual triggers are a first launch, a new public endpoint, a change to roles or tenants, and a buyer's security questionnaire.
A scan of the API does not replace a test. OWASP describes API1:2023 as an attacker "manipulating the ID of an object that is sent within the request". A scanner has no second account to compare against, so a person has to find that flaw.
What should you ask API pentest providers?#
Ask for these six items in writing before you sign. Each answer should be a sentence in the scope document.
| Question | Why it matters |
|---|---|
| Do you import an OpenAPI or Postman file? | Without a spec, testers map endpoints by hand, and quotes rise. |
| How many roles and tenants do you test? | Object level checks need at least two accounts for each role. |
| Which tests are manual? | Authorization flaws are judged by a person, not a tool. |
| Do you test function level access (BFLA)? | A low role calling an admin function is API5:2023. |
| What rate limit applies to your test traffic? | API4:2023 tests can lock accounts or hit paid third-party calls. |
| What does the retest cover and how long does it run? | Compare the Retest column below with the quote. |
Our guide questions to ask a pentest provider has the longer list.
What drives the price of an API pentest?#
Price follows the number of endpoints, roles and tenants, the depth of testing, and the retest terms. Many providers quote after scoping. The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact and not a low price. See penetration testing cost for the ranges we sourced.
How do you read the table?#
The API column shows "yes" only where the provider's own page names API testing. "Unknown" means the pages we read did not say. The Sample report column says whether a report is public, on request or not published. Click a provider name for its sources and check date. Read how we compare for the rules.
What scoping mistakes cause weak API tests?#
Four mistakes recur. The first is a spec that lists only public routes, so internal ones go untested. The second is one test account, which makes object level checks impossible. The third is staging data that differs from production. The fourth is an unstated rate limit, so the test stops at the first block. Send the spec, accounts and limits before the kickoff call.
Also see web application penetration testing providers and cloud penetration testing providers if your API sits behind a web app or a cloud account.
Questions
Is an API pentest different from a web app pentest?
The scope differs. An API test works from a spec or traffic capture, not from screens. It checks authorization on every object and function. Many providers sell both, so ask whether API testing is a named line item in the quote.
What should I send a provider before an API test?
Send an OpenAPI or Postman file, a staging base URL, and one test account for each role. Add the rate limits you enforce. Providers can then scope by endpoint count and role, which is how most quotes are built.
Does the OWASP API Top 10 set the scope of a test?
No. It is a list of risk classes, not a test plan. Use it as a checklist when you read a provider's method page. A good report names the OWASP category for each finding and shows the request that proved it.
Can a scanner replace an API pentest?
A scanner finds missing headers and known versions. Broken object level authorization needs two accounts and a person to judge the result. Ask the provider which checks are manual.
Sources
- OWASP API Security Top 10 2023 (checked 9 November 2026)
- OWASP API1:2023 Broken Object Level Authorization (checked 9 November 2026)
- OWASP API4:2023 Unrestricted Resource Consumption (checked 9 November 2026)
- OWASP API5:2023 Broken Function Level Authorization (checked 9 November 2026)
- PentestCompare provider dataset (each row links to its provider sources) (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.