Network penetration testing companies: compared by scope

Network penetration testing services check whether an attacker can reach and abuse your hosts, services and internal systems. This page lists providers whose own pages state network scope. Facts come from the PentestCompare dataset, checked on 9 November 2026. Sort order is A to Z and no provider pays for position. Excession Labs (publisher of this site) appears only where its dataset row matches.

What does network penetration testing cover?#

A network pentest covers hosts, ports, services, network devices and the paths between them. NIST SP 800-115 splits testing by viewpoint. External testing is "conducted from outside the organization's security perimeter". Internal testing has assessors "work from the internal network and assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses". Providers use the same words, so check which one a quote means.

Typical work items are host discovery, port and service identification, vulnerability validation, password attacks, movement between systems and a segmentation check. Active Directory work usually sits inside internal tests. NIST lists network discovery and port and service identification as separate techniques (sections 4.1 and 4.2).

The table has no network column because the filter already selects it. A provider appears when its pages list network testing or its scope field says yes. Other columns show delivery (human-led, hybrid or automated), published price, turnaround, retest and sample report status.

Who needs a network penetration test, and when?#

You need one when systems are reachable from the internet, when a customer or auditor asks for external or internal evidence, or after a large network change. PCI SSC testing guidance also covers segmentation testing, which applies when you use segmentation to reduce the scope of a card data environment. Your assessor decides what counts, so ask before you buy.

Cloud-first companies often have little classic network. Their questions sit in cloud and web layers, covered in web application penetration testing and cloud penetration testing. Offices, data centers, remote access and hybrid links still fit a network test.

What should you ask a network pentest provider?#

Ask each provider these seven questions in writing:

1. Do you test internal, external or both, and from which vantage points (remote, on-site device, VPN)?
2. How do you handle Active Directory: credentials given, assumed breach, or none?
3. Do you test segmentation, and how do you prove it?
4. Which tests do you run against production, and which need a window?
5. What is your retest policy, and how long does it last?
6. Can I see a sample report with a network finding?
7. Who does the manual work, and what do tools do?

Our guide on questions to ask a pentest provider adds general questions.

What drives the price of a network pentest?#

The main drivers are the number of IP addresses or live hosts, internal and external scope, Active Directory depth, number of sites, segmentation checks and on-site travel. Retest terms and report format add cost or time. A /24 range with five live hosts is a different job from a /24 range with 200.

Most providers in the table quote after scoping. A few publish a price for a product or tier, and those prices use different units (per test, per year, per asset). Do not compare them without matching scope. See penetration testing cost for published prices from named providers.

How should you read the table?#

Read each row as that provider's statement, not as a ranking or a test result. "Not published" means we found no statement on the provider's pages. It does not mean the provider lacks the item.

Open the provider page for sources and the check date.

What scoping mistakes do buyers make?#

Four mistakes recur in network tests:

• Handing over a subnet list that includes IP addresses you do not own, such as cloud or ISP ranges. Written authorization from the system owner is required before testing.
• Asking for "internal and external" without saying whether credentials or an assumed-breach device are provided.
• Leaving out segmentation when a compliance rule depends on it.
• Skipping the retest window, then finding that fixes cannot be verified.

Check the rules of engagement before the start date. Our pentest providers directory and the services index list other test types, such as wireless penetration testing.