# Mobile app penetration testing companies

Source: https://pentestcompare.com/services/mobile-app-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Mobile app penetration testing companies from their own pages, A to Z, with price, retest and sample report columns, plus OWASP MASVS scoping questions.

> **Short answer:** Mobile application penetration testing checks an iOS or Android app and the backend it calls. This page lists providers whose own pages state mobile testing, A to Z, with published price, retest and sample report columns and the date each fact was checked. Ask each one for platforms, OWASP MASVS coverage, backend API scope and retest terms before you compare quotes.

Mobile application penetration testing companies describe the same service in very different words. Some name iOS and Android, some say "mobile" once in a list. The table lists providers whose own pages state mobile testing, in A to Z order with no ranking. Each row shows the facts we could source, and "Not published" where a provider says nothing. Facts were checked on 9 November 2026.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Claranet](https://pentestcompare.com/providers/claranet/) | Managed services and cyber security provider | human-led | yes | yes | unknown | unknown | custom quote | Not published | Retesting is included as part of the engagement. | not published |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cure53](https://pentestcompare.com/providers/cure53/) | Boutique consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not published. The site says assignments do not end with the report and that critical bugs are usually fixed by report time. | public |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Include Security](https://pentestcompare.com/providers/include-security/) | Application security consultancy | human-led | yes | yes | unknown | unknown | not published | Report target: a week after the assessment conclusion. | Not published | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Rhino Security Labs](https://pentestcompare.com/providers/rhino-security-labs/) | Penetration testing firm | human-led | yes | unknown | yes | unknown | not published | Not published | Not published | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

## What does mobile app penetration testing cover?

A mobile app penetration test examines the app on the device and the backend it talks to. Testers install a build, inspect local storage, intercept traffic, and try to read or change data they should not reach. The OWASP Mobile Application Security Verification Standard (MASVS) is the usual checklist. It groups app controls into eight areas: storage, cryptography, authentication and authorization, network communication, platform interaction, code quality, resilience against reverse engineering and tampering, and privacy.

The OWASP Mobile Application Security Testing Guide (MASTG) holds the test procedures for Android and iOS. A provider that cites MASVS areas in its reports lets you check coverage against a public list. The method itself is on the service sites. See [web application penetration testing](/services/web-application-penetration-testing/) for the web side of the same job.

## Who needs a mobile app pentest, and when?

You need one when an app holds user data on the device, handles payments or sessions, or is the main way customers reach your service. Common triggers are a first store release, a new login method, a change to how the app stores tokens, and a customer security review.

A scan of the store listing or the binary does not replace a test. Authorization flaws live in the backend, so a test that stops at the app misses them. Pair the app test with an [API penetration test](/services/api-penetration-testing/) or confirm the quote covers both.

## What should you ask mobile pentest providers?

Ask for these answers in writing before you sign. Each one should become a sentence in the scope document.

| Question | Why it matters |
|---|---|
| Which platforms and OS versions are in scope? | iOS and Android are separate builds with separate checks. |
| Is the backend API in scope, and with how many roles? | App tests that skip the API miss object and function level flaws. |
| Which MASVS areas do you test, and which do you skip? | A skipped area is a gap you should know about. |
| Do you test on rooted or jailbroken devices? | Runtime checks often need them. |
| How do you handle certificate pinning and root detection? | Testers may need a build with them off. |
| What does the retest cover and how long does it run? | Compare the Retest column below with the quote. |

Our guide [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) has the longer list.

## What drives the price of a mobile app pentest?

Price follows the number of platforms, the size of the app, the number of roles, the depth of runtime testing, whether the backend API is included, and the retest terms. Many providers quote after scoping. Some publish a unit price. Securitum, for example, lists 640 EUR to 890 EUR per man day on its pricing page, with the rate set by project length, team size and delivery mode.

The "Published price" column shows a figure only where a provider lists one, so a blank price is a missing fact and not a low price. See [penetration testing cost](/guides/penetration-testing-cost/) for the ranges we sourced.

## How do you read the table?

Providers appear in the table when their own pages state mobile testing. The Web, API, Cloud and AI apps columns show "yes" only where the provider names that scope, and "unknown" means the pages we read did not say. The Sample report column says whether a report is public, on request or not published. Click a provider name for its sources and check date. Read [how we compare](/methodology/) for the rules.

The table does not split iOS from Android. Ask each provider directly, and compare the answer with the platforms you ship.

## Which scoping mistakes cause rework?

Three mistakes cause most change requests. Teams send a production build with pinning on and ask for a runtime test. Teams list the app but forget the backend. Teams give one test account when the app has several roles.

> **Demonstration:** Demonstration only. Harbor Notes is a fictional app and no real customer system was tested. This is a sample scope sheet, not a quote.
> 
> | Item | Harbor Notes value |
> |---|---|
> | Platforms | iOS 17 and later, Android 13 and later |
> | Builds | TestFlight invite, signed APK with pinning off |
> | Roles | Member, workspace admin |
> | Backend | https://api.example.com, OpenAPI file attached |
> | Out of scope | Third-party analytics SDK servers |
> | Retest | One round on Critical and High findings |
Compare other service pages in the [directory](/directory/) when your app also exposes a [cloud](/services/cloud-penetration-testing/) back end.

## Questions

### Is a mobile app pentest different from an API pentest?

Yes, in scope. A mobile test covers the app binary on the device, local storage and the traffic it sends. The backend API needs its own authorization tests. Ask whether the quote names the API as a line item or leaves it out.

### Do testers need a jailbroken or rooted device?

Often, for runtime checks. The app owner should say whether jailbreak and root detection is in scope. Some teams ask for a test build with that detection off, so testers can reach the checks behind it.

### What do I send a provider before a mobile test?

Send the build for each platform (IPA or APK, or a TestFlight invite), test accounts for each role, the backend base URL and any API spec. Add the minimum OS versions you support.

### Does OWASP MASVS set the scope of a test?

It sets a checklist, not a scope. MASVS groups app controls into eight areas. A provider that maps findings to those areas gives you a shared language, but you still agree the platforms, roles and backend in writing.

## Sources

- [OWASP MAS: Mobile Application Security Verification Standard (MASVS)](https://mas.owasp.org/MASVS/)
- [OWASP MAS: Mobile Application Security Testing Guide (MASTG)](https://mas.owasp.org/MASTG/)
- [Securitum pricing (unit shown as man day)](https://securitum.com/pricing.html)
- [PentestCompare provider dataset (each row links to its provider sources)](https://pentestcompare.com/methodology/)