# Social engineering testing companies: compared

Source: https://pentestcompare.com/services/social-engineering-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Social engineering penetration testing providers compared from their own pages, with rules of engagement, phishing and vishing scope, price drivers and questions.

> **Short answer:** Social engineering penetration testing tries to trick staff into giving up information or access, through email, phone calls, messages or in person. Agree rules of engagement, HR and legal sign-off and how results are reported before the test. The table lists providers that state this service, sorted A to Z, with price and sample report status as published.

Social engineering penetration testing checks whether people and procedures resist a trick, such as a fake email, a call to the help desk or a visitor who asks for a door to be held open. This page lists providers whose own pages state social engineering as a service. Facts come from the [PentestCompare dataset](/directory/), checked on 9 November 2026, sorted A to Z. Excession Labs (publisher of this site) appears only where its dataset row matches.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Claranet](https://pentestcompare.com/providers/claranet/) | Managed services and cyber security provider | human-led | yes | yes | unknown | unknown | custom quote | Not published | Retesting is included as part of the engagement. | not published |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [NCC Group](https://pentestcompare.com/providers/ncc-group/) | Security consultancy | human-led | unknown | unknown | yes | unknown | not published | Not published | Not published | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Rhino Security Labs](https://pentestcompare.com/providers/rhino-security-labs/) | Penetration testing firm | human-led | yes | unknown | yes | unknown | not published | Not published | Not published | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

## What does social engineering testing cover?

It covers attempts to make a person reveal information or perform an action. NIST SP 800-115 section 5.3 defines social engineering as "an attempt to trick someone into revealing information (e.g., a password) that can be used to attack systems or networks". It says the test can reveal weaknesses in user behavior "such as failing to follow standard procedures".

NIST names analog means (conversations in person or by telephone) and digital means (email, instant messaging). Phishing is the best known digital form. Providers sell these methods under several names:

| Method | What the tester does |
|---|---|
| Phishing | Sends crafted emails to a list of staff and records who clicks or enters data |
| Vishing | Calls staff or the help desk with a pretext |
| Smishing | Sends text messages with a link or request |
| On-site | Visits a site and tries to gain access; this overlaps with [physical penetration testing](/services/physical-penetration-testing/) |

The table does not split these methods. Open each provider page, or ask for a method list in writing.

## Who needs a social engineering test, and when?

Buyers need one when staff handle sensitive data or reset credentials, when a regulator or customer asks for awareness evidence, or after an incident that started with a phone call or an email. It also suits a company that already tested its network and applications and wants to learn whether an attacker could skip them by asking.

NIST says targets can be specific, such as executives, or a broad set of staff, and that specific targets are chosen when the organization knows of a threat to them. Decide which of the two you want before you request quotes.

## What should you ask a social engineering testing provider?

Ask these questions before signing:

1. Which methods are in scope (email, phone, text, on-site), and which are excluded?
2. Who approves the pretexts, and will you show us the scenarios first?
3. How do you report: by named person, by team or by total?
4. What happens when a staff member reports the attack? Do you stop?
5. How do you store the data you collect, and when do you delete it?
6. What actions are off limits (for example, real payments or access to real patient data)?
7. Do you provide a sample report?

Rules of engagement matter more here than in a network test, because the targets are people. Get written authorization from the system owner. Our [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/) covers general contract points.

## What drives the price of a social engineering test?

Price follows the number of targets, the number of methods, how much research each pretext needs, the length of the campaign and whether any on-site visit is in scope. Custom pretexts cost more than a template email. Reporting by individual adds data-handling work.

Most providers in the table quote after scoping, and a few list a price for a product or tier. Compare only after you fix the same method list and number of targets.

## How should you read the table?

Each row shows what that provider says on its own pages. "Not published" means we found no statement. The dataset shows human-led and hybrid delivery for this service. Check the provider page to see whether a person writes the pretexts, or a tool sends template campaigns.

The Sample report column matters here, because a report on social engineering can show how the provider treats employees. Prefer a provider that reports patterns and fixes over one that lists names.

## What scoping mistakes do buyers make?

Common mistakes:

- Telling no one in HR or legal, then facing complaints after the test.
- Running the test with no plan for a staff member who reports the attack.
- Allowing pretexts that use real events such as layoffs or illness, which can harm staff.
- Measuring only click rate, which says little about calls or visits.
- Keeping raw data for longer than the report needs.

See the [pentest provider directory](/directory/) for other service types and the [network penetration testing](/services/network-penetration-testing/) page for the technical side.

## Questions

### Is phishing simulation the same as social engineering penetration testing?

Phishing is one method. NIST SP 800-115 describes social engineering as tricking someone into revealing information that can be used to attack systems, by analog means (conversations, phone calls) or digital means (email, instant messaging). A phishing platform covers only the email part.

### Who must approve a social engineering test?

The system owner must authorize it in writing. Many buyers also involve HR and legal, because the test touches employees. We found no standard that sets a fixed approver list, so agree it in the rules of engagement.

### Do testers name employees who fall for a test?

That is a scope decision. Ask providers whether they report by individual or by group, and how they store the data. Many buyers choose group totals so staff are not blamed.

### Do providers publish prices for these tests?

Most quote after scoping. The Published price column shows the pricing model, or the first listed price where one exists. Units differ, so ask for a total for the same scope.

## Sources

- [NIST SP 800-115: Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)
- [PentestCompare methodology and provider dataset](https://pentestcompare.com/methodology/)