# Cloud penetration testing companies for AWS, Azure, GCP

Source: https://pentestcompare.com/services/cloud-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Cloud penetration testing companies from one sourced dataset, A to Z, with what AWS, Microsoft and Google allow, what to scope and what to ask each provider.

> **Short answer:** Cloud penetration testing checks your own cloud accounts, services and configuration for weaknesses an attacker could use. AWS lets customers test listed services without prior approval, Google Cloud does not require contact, and Microsoft bans denial-of-service tests. The table lists providers whose dataset record includes cloud testing, A to Z. Ask each one which clouds, which services and which identities it tests.

Cloud penetration testing companies test your own cloud accounts for weaknesses an attacker could use: identity roles, storage, network paths and managed services on AWS, Azure or Google Cloud. This page is for buyers who must pick a provider and write a scope. The table lists every provider in our dataset whose record includes cloud testing, in A to Z order. It is not a ranking, and nobody pays for position.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cure53](https://pentestcompare.com/providers/cure53/) | Boutique consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not published. The site says assignments do not end with the report and that critical bugs are usually fixed by report time. | public |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [NCC Group](https://pentestcompare.com/providers/ncc-group/) | Security consultancy | human-led | unknown | unknown | yes | unknown | not published | Not published | Not published | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Pentera](https://pentestcompare.com/providers/pentera/) | Autonomous testing platform | hybrid | yes | yes | yes | unknown | custom quote | Not published | Remediation is followed by re-testing; the FAQ says it revalidates fixes. | not published |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Rhino Security Labs](https://pentestcompare.com/providers/rhino-security-labs/) | Penetration testing firm | human-led | yes | unknown | yes | unknown | not published | Not published | Not published | public |
| [RunSybil](https://pentestcompare.com/providers/runsybil/) | Autonomous testing platform | automated | yes | yes | yes | unknown | custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and shows a replay button on findings. | on request |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Strix](https://pentestcompare.com/providers/strix/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or cost is stated on the pricing page. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

The table shows what each provider says on its own pages, with the date we checked. "Not published" means we found no statement.

## What does a cloud penetration test cover?

A cloud penetration test covers the resources that you own in a cloud account and the paths between them. Typical items are identity and access roles, storage buckets, serverless functions, container platforms, network rules, secrets stores and the build pipeline that deploys to the cloud.

Providers name these areas differently. Ask for a list, not a label. This checklist turns "cloud testing" into items you can accept or remove.

| Area | Example items to name in scope |
|---|---|
| Identity | IAM roles and policies, service accounts, cross-account trust, access key age |
| Storage | Public buckets, signed URL rules, backup snapshots |
| Compute | Virtual machines, containers, serverless functions, metadata service access |
| Network | Security groups, load balancers, private endpoints, exposed management ports |
| Secrets | Key vaults, parameter stores, secrets in code or images |
| Pipeline | CI/CD roles that can change production |

## What do AWS, Microsoft and Google allow?

Each cloud provider publishes its own testing rules, and they differ. The rules apply to the tester, so read them before you sign the scope.

AWS says customers may test their AWS infrastructure without prior approval for the services on its Permitted Services list. All security testing that includes command and control (C2) requires prior approval, and AWS asks customers who want covert adversarial simulations to submit a Simulated Events form. AWS also states that customers may not assess AWS infrastructure or the AWS services themselves ([AWS policy](https://aws.amazon.com/security/penetration-testing/), checked 9 November 2026).

Google Cloud says you are not required to contact it. You must follow the Acceptable Use Policy and Terms of Service, and your tests may only affect your own projects ([Google Cloud FAQ](https://support.google.com/cloud/answer/6262505), checked 9 November 2026).

Microsoft's rules of engagement apply to the resource owner and to authorized agents such as consultancies. They prohibit denial-of-service testing, DDoS, network-intensive fuzzing, and testing a tenant you do not own ([Microsoft rules](https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement), checked 9 November 2026).

## Who needs it and when?

Teams need a cloud test when a cloud account holds production data and the last review of its roles is old. Common triggers are a first move to the cloud, a new multi-account setup, a merger that joins two accounts, and a customer or auditor request for evidence.

A test of the application alone does not show a role that lets an attacker move from a low-privilege function to a storage bucket. If your risk sits in the account, scope the account.

## What to ask providers

Send every provider the same questions, and compare the written answers.

1. Which clouds and which services will you test? Ask for the list in the quote.
2. Do you test from outside only, or with credentials for a low-privilege role and an admin-read role?
3. Which cloud provider policies apply, and who checks them before the test starts?
4. Will you run command and control tools, load tests or fuzzing? Each can need approval or be banned.
5. How do you protect the access keys we give you, and when do you delete them?
6. Does the report show attack paths with evidence, or a list of misconfigurations?
7. Is a retest included? If yes, for how long, and for which findings?
8. Can we see a sample report? The table shows which providers publish one.

## Price drivers

Cloud test price depends on the size of the environment and the depth of access. Most providers in the dataset publish no price, so you will get a quote. Compare quotes on the same inputs.

- Number of accounts, subscriptions or projects in scope
- Number of distinct services and regions
- Whether the test includes the applications that run in the cloud
- Credentialed access (more depth) or external only
- Report type and retest terms

For published prices and the units they use, read [penetration testing cost](/guides/penetration-testing-cost/).

## How to read the table

Read the Cloud column first: "yes" means the provider's own pages state cloud testing. "Unknown" means we found no statement either way. Then read Type and Delivery. A PTaaS platform, an autonomous platform and a consultancy run cloud tests in different ways, and the Delivery column shows who does the testing.

Next, check Published price, Turnaround and Retest. Each cell reflects the provider's own wording, and units differ. A turnaround claim can describe the start time, the test window or time to first results. Open the provider profile for the source link on each claim.

The table does not show cloud-specific proof. A "yes" in the Cloud column is a stated service, not evidence of AWS, Azure or GCP depth. Ask for a sample report or a named cloud certification, and check it yourself.

## Common scoping mistakes

- Listing "the cloud" as one asset. Name accounts, subscriptions or projects.
- Leaving identity out. Role and trust paths cause many cloud findings.
- Forgetting provider rules. A load test or C2 tool can need approval or be banned.
- Giving the tester admin keys with no expiry. Use short-lived credentials and delete them after the test.
- Testing production with no rollback plan for changes the tester makes.
- Skipping the retest. A fix to one role can open another path.

## Where to go next

Compare providers across all services in the [provider directory](/directory/) or the [services index](/services/). Before you request quotes, read [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

## Questions

### Do I need permission from AWS, Microsoft or Google before a cloud pentest?

It depends on the provider and the test. AWS lets customers test the services on its permitted list without prior approval, but any test with command and control needs approval. Google Cloud says you are not required to contact it. Microsoft sets rules of engagement and bans denial-of-service tests. Read each policy on the day you scope.

### Is a cloud pentest the same as a cloud configuration review?

No. A configuration review compares settings with a benchmark. A pentest also tries to use a weakness, for example a role that lets a low-privilege user reach storage. Many providers sell both. Ask which one the quote covers.

### Does a cloud pentest include the application running in the cloud?

Only when the scope says so. Cloud testing often covers accounts, identity roles, storage, networks and managed services. A web app or API test is a separate line item at many providers. Write both into the scope if you need both.

### Can a provider test AWS itself?

No. AWS states that customers may not run security assessments of AWS infrastructure or the AWS services themselves. Testers work on your resources in your account. A flaw found in an AWS service goes to AWS through its reporting route.

## Sources

- [AWS Penetration Testing policy](https://aws.amazon.com/security/penetration-testing/)
- [Google Cloud: penetration testing FAQ](https://support.google.com/cloud/answer/6262505)
- [Microsoft Security Testing Rules of Engagement](https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement)
- [PentestCompare provider dataset (filter: cloud)](https://pentestcompare.com/data/providers.json)