# Web application penetration testing companies compared

Source: https://pentestcompare.com/services/web-application-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

Web application penetration testing companies in one sourced table, A to Z, with price, retest and sample report facts plus six questions to ask each one.

> **Short answer:** A web application penetration test is an authorized attempt to break one web app and prove the effect, such as reading another user's data. The table lists providers that state web app testing, A to Z and unranked, with facts from each provider's own pages. Compare price, retest terms, sample reports and scope limits before you ask for quotes.

This page is for buyers who need a pentest of one or more web applications and want a shortlist. The table filters the PentestCompare dataset to providers whose pages state web app testing. It runs A to Z, no provider pays for position, and each fact links to the provider's own page with the date we checked it.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [7ASecurity](https://pentestcompare.com/providers/7asecurity/) | Boutique consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Free fix verification: 'verify your fixes, suggest improvements and ensure bypasses are not possible for free', during or after the test. | public |
| [A-LIGN](https://pentestcompare.com/providers/a-lign/) | Consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not stated. The page mentions RADAR monitoring between annual tests (Elite package). | not published |
| [Aikido](https://pentestcompare.com/providers/aikido/) | Application security platform | automated | yes | yes | unknown | yes | $4,000 per assessment | TYPICAL Pentest: same-day results. The AI pentest page also says a few hours, minutes, and in one place a report in days. | Free retesting for up to 6 months, including checks for bypasses of fixes. | public |
| [Astra Security](https://pentestcompare.com/providers/astra-security/) | PTaaS platform | hybrid | yes | yes | yes | yes | $2,999 per year (card also shows $199 per month) | Manual pentest: 10-15 working days. Pentest Auto: first report the same day. | Re-scans included: Auto 1, Expert 2, Enterprise 4; window 30 days (Auto, Expert) or 90 days (Enterprise). The page FAQ says 2 re-scans for PTaaS plans. | not published |
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Black Hills Information Security](https://pentestcompare.com/providers/black-hills-information-security/) | Security consultancy | human-led | yes | unknown | unknown | yes | not published | Not published | Not published | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bridewell](https://pentestcompare.com/providers/bridewell/) | Cyber security services provider | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Claranet](https://pentestcompare.com/providers/claranet/) | Managed services and cyber security provider | human-led | yes | yes | unknown | unknown | custom quote | Not published | Retesting is included as part of the engagement. | not published |
| [Cobalt](https://pentestcompare.com/providers/cobalt/) | PTaaS platform | hybrid | yes | yes | yes | yes | $3,500 per test | Autonomous Pentest: findings in 24 hours. Annual tiers: start within 3 / 2 / 1 business days (Standard / Premium / Enterprise); footnote says start times vary by engagement type. | Comparison table: free retesting for 6 months (Standard) or 12 months (Premium, Enterprise). FAQ says unlimited on-demand retesting during the contract term. The two statements differ. | on request |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Cure53](https://pentestcompare.com/providers/cure53/) | Boutique consultancy | human-led | yes | unknown | yes | unknown | custom quote | Not published | Not published. The site says assignments do not end with the report and that critical bugs are usually fixed by report time. | public |
| [Cyberis (Cyberis Reply)](https://pentestcompare.com/providers/cyberis/) | Penetration testing and cyber security consultancy | human-led | yes | unknown | yes | yes | custom quote | Not published | Not published | not published |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [Equixly](https://pentestcompare.com/providers/equixly/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published | Revalidates whenever applications and AI systems change; no separate retest policy is stated. | not published |
| [Escape](https://pentestcompare.com/providers/escape/) | Application security platform | automated | yes | yes | unknown | yes | custom quote | Continuous AI pentesting: results in minutes on merge, deploy or schedule. | Open issues are re-checked; external network pentesting is followed by a retest. No limits stated. | not published |
| [Excession Labs](https://pentestcompare.com/providers/excession-labs/) | Security lab (AI-assisted testing) | hybrid | yes | yes | unknown | yes | custom quote | Not published | Retest of fixed findings is offered; terms are set in each quote. | public |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Hadrian](https://pentestcompare.com/providers/hadrian/) | Autonomous testing platform | hybrid | yes | unknown | unknown | unknown | From EUR 1,250 per test, excluding VAT | Most tests finish within 24 to 48 hours; same-day start possible. | Not published | not published |
| [Halo Security](https://pentestcompare.com/providers/halo-security/) | PTaaS platform | hybrid | yes | yes | unknown | unknown | custom quote | Not published | One round of retesting is included; Halo verifies fixes and issues an updated report. | not published |
| [Horizon3.ai (NodeZero)](https://pentestcompare.com/providers/horizon3/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $15 per asset, per test (12-month term) | Not published as a time. WebApp page says tests can be set up quickly and run as often as needed. | Findings include fix actions with one-click verify. On Core, Pro and Elite retests carry no extra charge because testing is unlimited; for Flex the page does not say whether a verify counts as a new billed test. | not published |
| [Include Security](https://pentestcompare.com/providers/include-security/) | Application security consultancy | human-led | yes | yes | unknown | unknown | not published | Report target: a week after the assessment conclusion. | Not published | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [Intruder](https://pentestcompare.com/providers/intruder/) | Application security platform | automated | yes | unknown | unknown | unknown | $3,500 per test | Setup in minutes; results within hours; the pricing page says reports are delivered the same day with no lead times. | Unlimited retesting on the single test and the 4-pack. Packs expire after 1 year. | not published |
| [JUMPSEC](https://pentestcompare.com/providers/jumpsec/) | Consultancy | human-led | unknown | unknown | unknown | yes | custom quote | Not published | Not stated. The page recommends testing quarterly or semi-annually and after significant changes. | not published |
| [LRQA (Nettitude)](https://pentestcompare.com/providers/lrqa-nettitude/) | Assurance and cyber security provider (Nettitude is now part of LRQA) | human-led | yes | unknown | yes | yes | custom quote | Mobile tests: start within two weeks and usually at least three days per application. | Not published | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Novee](https://pentestcompare.com/providers/novee/) | Autonomous testing platform | automated | yes | yes | unknown | yes | custom quote | Not published. Testing is described as continuous. | Retests run automatically after fixes, and on new deployments, code changes and emerging threats. | not published |
| [Outpost24](https://pentestcompare.com/providers/outpost24/) | PTaaS platform | hybrid | yes | yes | unknown | yes | custom quote | Snapshot is 10 days of manual testing and Assure is 3 days. SWAT runs for 12 months. | Snapshot and Assure each include a 60-day retest window. SWAT checks fixes for 12 months. No retest terms found for the AI and LLM service. | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Parameter](https://pentestcompare.com/providers/parameter/) | AI-assisted testing service | automated | yes | yes | unknown | unknown | custom quote | First findings in 24 hours; most runs finish the same day they start. | Free re-testing is listed for Single App and inherited by higher tiers. | public |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pen Test Partners](https://pentestcompare.com/providers/pen-test-partners/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | PTaaS: scoped within minutes and can start immediately; results in real time, short report at the end of the test window. Standard pen tests: Not published. | Not published | not published |
| [Penligent](https://pentestcompare.com/providers/penligent/) | AI-assisted testing service | automated | yes | unknown | unknown | unknown | $0 per month | What takes humans a week, Penligent takes an hour (homepage tagline). | Pro includes task re-runs, scheduled recurring runs and risk re-scans to verify fixes. Limits and credit use are not stated. | public |
| [Pentera](https://pentestcompare.com/providers/pentera/) | Autonomous testing platform | hybrid | yes | yes | yes | unknown | custom quote | Not published | Remediation is followed by re-testing; the FAQ says it revalidates fixes. | not published |
| [Pentest People](https://pentestcompare.com/providers/pentest-people/) | Penetration testing provider (part of WorkNest Secure) | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Rhino Security Labs](https://pentestcompare.com/providers/rhino-security-labs/) | Penetration testing firm | human-led | yes | unknown | yes | unknown | not published | Not published | Not published | public |
| [RunSybil](https://pentestcompare.com/providers/runsybil/) | Autonomous testing platform | automated | yes | yes | yes | unknown | custom quote | Not published | No retest policy; the platform re-evaluates on every deployment and shows a replay button on findings. | on request |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Securitum](https://pentestcompare.com/providers/securitum/) | Consultancy | human-led | yes | unknown | yes | yes | 640 EUR to 890 EUR per man day | Not published. Typical engagement length is 1 to 4 weeks for a single application or area. | Not published | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Stingrai](https://pentestcompare.com/providers/stingrai/) | Penetration testing consultancy and platform | hybrid | yes | yes | yes | yes | US$3,000 per assessment | Autonomous Pentest: same-day results. | Automated retests are listed on the Autonomous plan; the page says retests are included in the fixed plans. No window is stated. | public |
| [Strix](https://pentestcompare.com/providers/strix/) | Autonomous testing platform | automated | yes | yes | yes | unknown | $29 per seat per month | Not published | The platform retests its own generated fixes; no retest policy or cost is stated on the pricing page. | not published |
| [Synack](https://pentestcompare.com/providers/synack/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | $5,085 per test (starting price) | Test windows: 4-5 business days (Sara), 5 days (SynackST), 14 days (Synack14). | Patch verification is listed as included in each product; the platform subscription lets you request patch verifications and retests. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [Terra Security](https://pentestcompare.com/providers/terra-security/) | AI-assisted testing service | hybrid | yes | unknown | unknown | yes | custom quote | Vendor says tests drop from 4-6 weeks to 2-4 hours versus traditional pentests. | Not published | not published |
| [TurboPentest](https://pentestcompare.com/providers/turbopentest/) | AI-assisted testing service | automated | yes | yes | unknown | yes | $99 per credit (one pentest) | All tiers typically complete in a few hours. | A retest is a full new pentest at the same per-target price; no separate retest SKU. A free re-pentest applies if zero actionable findings (once per domain). | public |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |
| [XBOW](https://pentestcompare.com/providers/xbow/) | Autonomous testing platform | automated | yes | yes | unknown | unknown | custom quote | First validated findings arrive in hours; testing is continuous or on demand. | Retests after a fix are described as free and unlimited. | not published |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

## What does a web application penetration test cover?

A web application penetration test is an authorized attempt to break a web app and prove what an attacker could do. The tester works from the outside, or signed in as a normal user, and tries to reach data or actions the account should not reach.

The standard reference for the work is the [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/). Its stable release is v4.2 (the "latest" branch is development work toward 5.0). Providers also name the [OWASP ASVS](https://asvs.owasp.org/), a list of security requirements for web apps, as a coverage target. ASVS 5.0.0 was published on 30 May 2025.

Four areas make up most scopes:

- Authentication and session handling: login, password reset, tokens, multi-factor steps.
- Access control: whether user A can read or change user B's records, and whether a normal user can reach admin functions.
- Input handling: injection, cross-site scripting, file upload, server-side request forgery.
- Business logic: flows that follow the rules of the code but break the rules of the business, such as applying a coupon twice.

Ask the provider to confirm which areas are in the quote. A scanner-only product usually covers input handling. Access control and business logic need a person or an agent that holds several accounts.

## Who needs a web application pentest, and when?

You need one when customers, auditors or your own risk review ask for evidence that someone tried to break your app. Common triggers are a first enterprise sale, a security questionnaire, a major release that changes login or billing, and a compliance cycle.

Compliance frameworks do not all require a pentest. For example, SOC 2 names penetration testing only as one example of an evaluation. See our guide to [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/) before you buy for an audit, and ask your auditor what they accept.

Test when the app is stable enough to hold real flows. A test of a half-built app finds issues that the next release removes.

## What should you ask web app pentest providers?

Ask for written answers to these six questions before you compare quotes. The [full question list](/guides/questions-to-ask-a-pentest-provider/) has more.

1. Which roles and test accounts will the tester use, and who creates them?
2. Is the API behind the front end in scope, and are API endpoints that the front end never calls in scope?
3. Does the report include requests and responses for each finding, so your developers can reproduce it?
4. What does the quote say about retesting: how many rounds, and for how long?
5. Can we see a sample report before we sign?
6. Which testing runs on your production system, and which limits apply (rate, uploads, email sending)?

The table has a column for the sample report and one for the provider's retest statement. Many providers answer "Not published" for turnaround. That is a fact about their pages and not a judgment of the work.

## What drives the price of a web application pentest?

Scope drives price more than any other factor. The provider's own price pages name these drivers:

| Driver | What changes the price |
|---|---|
| Size of the app | Number of pages, roles, API endpoints |
| Depth | Black box (no access), grey box (user accounts) or white box (source and docs) |
| Delivery model | Automated product, hybrid, or manual testing by people |
| Retesting | Included, limited to a period, or billed as a new test |
| Report | Standard report, or extra material for an audit |

Published prices in the dataset show the range. As of 9 November 2026, Intruder listed its single pentest at $3,500 per test ([Intruder](https://www.intruder.io/pentest-pricing)). Stingrai listed an autonomous pentest at US$3,000 per assessment ([Stingrai](https://www.stingrai.io/pricing)). CYBRI listed a web application test starting at $5,000 per engagement ([CYBRI](https://cybri.com/pricing/)). Secure Ideas listed its smallest web application test at $13,600 starting flat fee ([Secure Ideas](https://secureideas.com/pricing)). These are start prices for the smallest scope each provider lists, so they are not comparable quotes. Most providers quote on request; the [cost guide](/guides/penetration-testing-cost/) lists more providers' prices.

## How do you read the table?

Read the table as a screening step, not a ranking. Rows are sorted A to Z. A row shows what the provider states on its own pages, and "Not published" means we found no statement.

Use the Delivery filter above the table to split the field. Manual depth, compliance packaging and continuous or automated testing are different products that all use the words "web application penetration testing". Pick the delivery model first, then compare price, retest terms and sample reports inside that group.

Check the sample report column before anything else. A public sample report lets you judge the evidence standard without a sales call. Our guide to [judging a provider by its sample report](/guides/judge-a-pentest-provider-by-its-sample-report/) lists what to look for.

## Which scoping mistakes cost the most?

Four mistakes appear in most quotes that later change.

- Scope names the domain but not the roles. The tester then has one account and cannot test access control between users.
- The API is left out. Modern web apps put most logic in the API, so a front end only test misses it.
- Third-party systems sit in scope without permission. Payment, email and identity providers have their own testing rules. Get written permission or exclude them.
- The test runs against production with no limits. Agree limits on uploads, password guessing and email sending first.

> **Sample scope sentence:** This is a demonstration scope line for a fictional app, Harbor Notes. No real system was tested.
> 
> "In scope: app.example.com and api.example.com, with three test accounts per role (viewer, editor, admin) created by the customer. Out of scope: the payment provider's hosted checkout. Limits: no more than 5 requests per second, no email sending to real addresses."
Use the [scoping checklist](/tools/scoping-checklist/) to build a scope like this one. It covers roles, API size, environments and limits.

## Questions

### What is the difference between a web application pentest and a vulnerability scan?

A scan lists known weaknesses with software. A pentest has a tester try to exploit them and show the effect, for example by reading another account's record. Many web app pentests start with a scan, then add manual work for logic and access control flaws.

### How long does a web application penetration test take?

Providers rarely publish this. Most pages in the dataset say 'Not published' for turnaround. Some automated products state fast results on their pricing pages. Ask for a written start date and report date in the quote, and confirm what counts as the finish.

### Should the tester use test accounts for each role?

Yes. Authorization flaws show only when the tester has two accounts at the same level and one account at each higher level. Give the provider test accounts and test data so the tester never touches real customer records.

### Does the pentest have to include the API behind the web app?

Not by default. Some quotes cover the web front end only. Ask whether the API endpoints the front end calls are in scope, and whether API endpoints the front end never calls are in scope.

### Can an automated tool replace a manual web app pentest?

It depends on the risk you need to cover. Automated products are fast and cheaper, and some publish prices. Manual testers cover business logic and chained flaws more often. The table shows each provider's delivery model so you can see which it sells.

## Sources

- [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [OWASP Application Security Verification Standard](https://asvs.owasp.org/)
- [Intruder: pentest pricing](https://www.intruder.io/pentest-pricing)
- [Secure Ideas: pricing](https://secureideas.com/pricing)
- [CYBRI: pricing](https://cybri.com/pricing/)
- [Stingrai: pricing](https://www.stingrai.io/pricing)