# Vulnerability assessment services: providers compared

Source: https://pentestcompare.com/services/vulnerability-assessment/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Vulnerability assessment services in one sourced table, A to Z, with price, retest and report facts, plus six questions to ask before you buy a scan or review.

> **Short answer:** A vulnerability assessment finds and ranks known weaknesses in your systems, usually with scanners and a human review of the results. It does not try to exploit them the way a penetration test does. The table lists providers that state vulnerability assessment, A to Z and unranked. Compare scope, scan frequency, price units and what the report contains.

Buyers who search for vulnerability assessment services want one of two things: a recurring scan of their systems, or a one-off review with a ranked list of fixes. This page filters the PentestCompare dataset to providers whose pages state vulnerability assessment. Rows run A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [RunSybil](https://pentestcompare.com/providers/runsybil/) | Autonomous testing platform | automated | yes | yes | yes | unknown | custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and shows a replay button on findings. | on request |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [usd AG](https://pentestcompare.com/providers/usd-ag/) | Consultancy | human-led | unknown | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

## What does a vulnerability assessment cover?

A vulnerability assessment finds weaknesses and ranks them by risk. NIST's glossary defines it as a "systematic examination of an information system or product to determine the adequacy of security measures" (CNSSI 4009-2022, [NIST CSRC](https://csrc.nist.gov/glossary/term/vulnerability_assessment)). In practice scanners do most of the work and a person reviews the output.

The assessment stops where a penetration test starts. A pentest has a tester attempt to "circumvent or defeat the security features of a system" ([NIST CSRC](https://csrc.nist.gov/glossary/term/penetration_testing)) and so proves the effect. Our guide to [pentest versus vulnerability scan](/guides/pentest-vs-vulnerability-scan/) has a decision table and the PCI DSS split between scans and pentests.

Typical assessment targets are:

- External hosts and web apps, scanned from the internet.
- Internal networks, scanned from inside with credentials.
- Cloud accounts and container images, checked against configuration rules.
- Web apps and APIs, scanned with a dynamic scanner (DAST).

Providers on this page vary in all four. Check the Scope columns in the table for web, API, cloud and network.

## Who needs a vulnerability assessment, and when?

You need one when you must show regular, repeatable checking of known weaknesses. Common reasons are a customer questionnaire, a compliance scan requirement and an asset list that grows faster than staff can review.

Buy a pentest instead, or as well, when you need to know whether an attacker can chain weaknesses into real access. Many teams run scans continuously and a pentest once or twice a year.

Scanning for payment card compliance has its own rule. PCI DSS asks for external scans by an Approved Scanning Vendor. In the dataset, Halo Security lists PCI SSC Approved Scanning Vendor status with certificate 5078-01-11 ([Halo Security](https://www.halosecurity.com/pci-compliance/)), and Detectify lists PCI ASV scanning in its price plans ([Detectify](https://detectify.com/pricing)). Verify any ASV claim in the PCI SSC list of vendors before you rely on it.

## What should you ask vulnerability assessment providers?

Ask for written answers to these six questions.

1. Which assets are in scope, and how does the quote count them (host, domain, target, credit)?
2. Does a person confirm each finding and remove false positives before the report?
3. Do scans run with credentials (authenticated) or only from outside?
4. How often do scans run, and how fast do new checks arrive after a new vulnerability is published?
5. What does a rescan cost after you fix issues, and how many rescans does the quote include?
6. Does the report rank findings by exploitability or only by a severity score?

The Retest column in the table shows each provider's statement on rescans. Many providers answer "Not published".

## What drives the price?

Price units differ so much that one number never compares two quotes. The dataset shows five patterns, taken from provider price pages checked on 9 November 2026.

| Provider | Published unit | Example |
|---|---|---|
| Detectify | Annual platform fee | Standard from EUR 2,500 per year |
| Pentest-Tools.com | Monthly plan by assets | AppScan from $140 per month, 5 assets |
| ZeroThreat | Per target or per credit | Professional $100 per target per month |
| Securitum | Per man day | 640 EUR to 890 EUR per man day |
| Intruder | Per test | $3,500 per test |

Sources: [Detectify](https://detectify.com/pricing), [Pentest-Tools.com](https://pentest-tools.com/pricing), [ZeroThreat](https://zerothreat.ai/pricing), [Securitum](https://securitum.com/pricing.html) and [Intruder](https://www.intruder.io/pentest-pricing). The Intruder row is a pentest product, listed because Intruder also states vulnerability assessment.

Most firms in the table quote on request. For a fair comparison, give each provider the same asset list and ask for a total for twelve months.

## How do you read the table?

The table shows what a provider states, not how well it works. Rows run A to Z. "Not published" means we found no statement on the provider's pages.

Start with the Delivery column. Automated providers sell software that scans on a schedule. Human-led providers sell analyst time. Hybrid providers do both. The labels often hide a large gap in the amount of human review, so use question 2 above to settle it.

Then check the Published price column. A listed price means you can budget before you talk to sales. It does not mean the price fits your asset count.

## Which scoping mistakes cause trouble?

- The asset list is out of date. A scan can only report on what it can reach. Include forgotten domains, test systems and cloud accounts.
- Scans run unauthenticated only. An application behind a login stays unchecked without a test account.
- Scanner traffic hits production with no limits. Agree the scan rate and the time window first.
- The buyer assumes the report proves exploitability. A scan finding says a weakness may exist. Ask the provider to mark which findings a person confirmed.

Use the [scoping checklist](/tools/scoping-checklist/) to list assets, roles and limits before you ask for quotes.

## Questions

### What is the difference between a vulnerability assessment and a penetration test?

An assessment lists weaknesses and ranks them. A penetration test tries to exploit them and shows the effect. Many services mix the two under one name, so ask the provider whether a person confirms each finding and whether the report shows proof.

### How often should we run a vulnerability assessment?

It depends on how fast your systems change and on any standard you follow. Scanners run weekly or after each release for many teams. PCI DSS has its own scan rules in requirement 11.3. Ask your auditor which interval they expect.

### Do scan prices include a human review?

Not always. Platform plans such as Detectify and Pentest-Tools.com sell software access by period. Managed services add analyst time and cost more. Check whether the quote names a person who removes false positives.

### What scope units do vulnerability assessment quotes use?

Providers price by asset, by target, by scan credit, by year or by engagement. These units do not convert to each other. Count your assets first, then ask each provider for a total for the same list.

### Does a clean scan mean we are secure?

No. A scan only finds issues it has checks for. It does not find flaws in business logic or broken access control that need a person. A clean result is a data point on one date.

## Sources

- [NIST CSRC glossary: vulnerability assessment](https://csrc.nist.gov/glossary/term/vulnerability_assessment)
- [NIST CSRC glossary: penetration testing](https://csrc.nist.gov/glossary/term/penetration_testing)
- [Detectify: pricing](https://detectify.com/pricing)
- [Pentest-Tools.com: pricing](https://pentest-tools.com/pricing)
- [ZeroThreat: pricing](https://zerothreat.ai/pricing)
- [Halo Security: PCI compliance](https://www.halosecurity.com/pci-compliance/)
- [Securitum: pricing](https://securitum.com/pricing.html)