# OT and ICS penetration testing companies: compared

Source: https://pentestcompare.com/services/ot-ics-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

ICS and OT penetration testing companies from one sourced dataset, A to Z. Six safety questions, the NIST and IEC 62443 references and what to scope first.

> **Short answer:** ICS and OT penetration testing checks systems that control physical processes, such as plant controllers and building systems. Safety comes before coverage: agree what testers may touch, what stays passive and who can stop the test. NIST SP 800-82 Rev. 3 and the ISA/IEC 62443 series are the main public references. The table lists providers whose record includes OT or ICS testing, A to Z.

ICS and OT penetration testing companies test systems that run physical processes: industrial controllers, plant networks, building systems and the links between them and the office network. This page is for asset owners and engineers who must pick a provider and agree safe limits. The table lists every provider in our dataset whose record includes OT or ICS testing, in A to Z order. It is not a ranking, and no provider pays for position.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

## What does OT and ICS penetration testing cover?

OT and ICS testing covers the systems that monitor or control physical equipment, and the paths that reach them. NIST defines OT as programmable systems and devices that interact with the physical environment or manage devices that do, and names industrial control systems, building automation, transportation systems and physical access control as examples ([NIST SP 800-82 Rev. 3](https://csrc.nist.gov/pubs/sp/800/82/r3/final), checked 9 November 2026).

In practice a scope names some of these items:

- The boundary between the office network and the plant network
- Remote access paths, such as vendor VPNs and jump hosts
- Engineering workstations and historian servers
- Controller and gateway configuration
- Protocol exposure on the plant network
- Wireless links in the plant

NIST says OT security must address "unique performance, reliability, and safety requirements". That sentence is the reason this page puts safety before price.

## What are the six safety questions?

Ask each provider these six questions before you ask about price. The answers decide how the test runs.

1. Which methods are passive (listening, configuration review) and which are active (scans, commands)? Where is the line in the rules of engagement?
2. Will active tests run on a lab or staging copy first?
3. Who on the asset owner's side can stop the test at once, and how do testers reach them?
4. Which systems are out of scope by name, for example safety instrumented systems?
5. Does the equipment vendor need to approve the test plan or the test window?
6. What happens if a device stops responding? Who restores it, and what is the fallback to manual control?

A provider that cannot answer in writing has not planned the test.

## Which standards do OT testers use?

Two public references appear most often. ISA describes the ISA/IEC 62443 series as defining requirements and processes for implementing and maintaining electronically secure industrial automation and control systems, and as a way to assess security performance ([ISA](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards), checked 9 November 2026). NIST SP 800-82 Rev. 3 gives OT security guidance and countermeasures.

Neither source sets a mandatory penetration test report format. Ask the provider which reference the report follows, and ask for a sample. Some providers in the dataset list IEC 62443 among their compliance mentions. We record that as the provider's own claim, not as proof of depth.

## Who needs it and when?

Asset owners need OT testing when a plant network links to corporate IT, when remote vendor access is new, or after a major control system change. A test can also follow an acquisition that adds sites with unknown networks.

If you have no asset inventory, start with an inventory and a passive assessment. A penetration test of an unknown network wastes the test window.

## What to ask providers

Send the same questions to every provider, and compare the written answers.

1. Have your testers worked in OT before? Ask for the protocols and vendor families they know.
2. Which test types do you offer: passive assessment, architecture review, active test in a lab, active test on the live network?
3. How do you handle data from the plant network, such as captures and configs?
4. Does the report separate IT findings from OT findings, and rank by safety impact?
5. Is a retest included, and how is it run?
6. Can we see a sample report? The table shows which providers publish one.

## Price drivers

Most providers in the table publish no price, and OT work is quoted case by case. What changes the quote:

- Number of sites and zones in scope
- Passive only, lab testing, or live active testing
- Number of vendor and protocol families
- On-site days versus remote work
- Travel and safety training for testers
- Report type and retest terms

## How to read the table

A row appears when the provider's record lists OT or ICS testing as a service. The dataset records a stated service, not proof of OT experience. Check Type and Delivery first. The Delivery column shows whether people or software run the test, and OT work needs a clear answer on who is on the keyboard.

Then read Published price, Turnaround and Retest. Turnaround claims often describe one kind of event, such as a start date, so ask which. Open the provider profile for the source link behind each claim.

## Common scoping mistakes

- Skipping the asset list, so scope is a guess.
- Allowing active scans on live controllers with no stop contact.
- Putting safety systems in scope without vendor approval.
- Testing only the IT side of the boundary and calling it an OT test.
- Giving vendor remote access to testers with no logging.
- Planning one test with no time for fixes and a retest.

## Where to go next

Compare providers across all services in the [provider directory](/directory/) or the [services index](/services/). For the network layer, see [network penetration testing](/services/network-penetration-testing/). Before you request quotes, read [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

## Questions

### Is OT penetration testing the same as ICS penetration testing?

The terms overlap. NIST describes operational technology (OT) as programmable systems that interact with the physical environment, and lists industrial control systems (ICS) as one example. Providers use both words for the same kind of work, so check the scope list, not the label.

### Can testers run active scans on a live plant network?

Only if the plant owner and the equipment vendor agree. Many OT devices handle unexpected traffic badly. A common safer path is passive network capture, a review of configurations, and active tests in a lab or staging copy. Write the allowed methods into the rules of engagement.

### Which standard should an OT test map to?

ISA/IEC 62443 defines requirements and processes for securing industrial automation and control systems. NIST SP 800-82 Rev. 3 gives OT security guidance. Ask the provider which one the report uses. Neither one names a required pentest format.

### Who should sign off before an OT test?

The asset owner, the plant or operations lead and, where it applies, the equipment vendor. Process safety staff should know the test window. Name one person who can stop the test at once, and agree how to reach them.

## Sources

- [NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [ISA: ISA/IEC 62443 series of standards](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards)
- [PentestCompare provider dataset (filter: ot-ics)](https://pentestcompare.com/data/providers.json)