Menu
Auditors
Our picks by fit, each with a passed peer review
Every listed firm, filterable by price and timeline
Consultants
Readiness, pentest, vCISO, and ISO 27001 firms in one list
Software
Every platform we profile, with sourced prices and fit
Our picks by buyer fit, with the tradeoffs
Published prices, add-ons, and audit fees
Learn
Articles on cost, controls, timelines, and auditor choice
Free Tools
A few questions, then your best-fit auditors
Fit-ranked platforms with observed price bands
This directory helps buyers shortlist penetration testing firms for web applications, APIs, cloud infrastructure, mobile products, networks, and deeper adversary-led work. Compare what each firm publishes, then verify the exact scope, tester allocation, retest terms, and final report in its proposal.
The broad provider inventory across testing surfaces, regions, delivery models, framework support, specialties, and published price visibility. Use the search to narrow published attributes; confirm the final scope directly in each proposal.
Selection key
A firm is included when we list penetration testing among its services. Firms we've checked come first, then the list runs by firm name; paid placement does not reorder it. Any framework, delivery model, or price we could not find says “Not published.”
Showing 62 firms.
No firms match that search. Clear it to see every independent firm, or get matched anonymously instead.
Web and API tests focus on application logic, authentication, authorization, and data flow. Cloud tests examine configuration and identity paths. Mobile tests add device and platform behavior. Network tests focus on exposed and internal infrastructure. Red-team engagements go wider by testing how people, systems, and detection controls respond across an attack chain.
One provider may cover several surfaces, but breadth on a services page does not prove equal depth in each. Ask who will test your specific stack, how much manual time is included, and whether source-assisted review, authenticated roles, cloud control-plane access, or social engineering are inside or outside the engagement.
A point-in-time pentest answers whether a defined system can be exploited during a fixed window. PTaaS and continuous models add a portal, recurring access, or repeated testing as the system changes. The best model depends on release frequency and how quickly stakeholders need updated evidence.
Continuous branding is not a substitute for reading the service terms. Confirm whether testing is human-led, how often testers actively work, whether new features can be added to scope, how retests are requested, and what report or attestation artifact is available on demand.
Region affects working-hour overlap, data handling, procurement, and which credentials buyers recognize. CREST is commonly requested in the UK and other markets, while technology-specific certifications can support an individual tester's credentials. Neither replaces checking the named team, methodology, and relevant project experience.
Confirm where testing will be performed, whether subcontractors are used, what data leaves your environment, and whether the proposal commits qualified staff to the engagement. A company-level accreditation or badge does not guarantee that the assigned tester has the experience your application or infrastructure requires.
There is no honest universal price because quotes change with surface area, architecture, authenticated roles, testing depth, timeline, and retest coverage. 12 firms in this directory currently show a published price signal; every other record says “Not published” instead of substituting an estimate.
Use price only after normalizing scope. A proposal covering one web application with two roles is not comparable to one covering web, API, cloud configuration, mobile builds, internal networks, and multiple retests. Ask each shortlisted firm to separate base scope, optional surfaces, rush fees, and retest terms.
A firm appears here when we list penetration testing among its services. We use what the firm publishes where we can; any framework, engagement model, accreditation, or price we could not find shows as “Not published.” Each profile shows when we last checked the firm, or otherwise when we last updated the profile, plus the firm's website. Being listed is not a certification, endorsement, or claim that every firm fits every use case.
Firms we've checked come first, then the list runs alphabetically by firm name. Paid placement does not change that order. A visible Featured label may identify an active commercial placement, but it does not change eligibility, verification, or any claim about service quality.
Provider labels matter less than the engagement design. Compare the statement of work and sample deliverable before treating two quotes as equivalent.
| Factor | Stronger engagement | Weaker engagement |
|---|---|---|
| Scope | Named assets, roles, APIs, cloud boundaries, and exclusions | A device or URL count with unclear exclusions |
| Method | Human-led testing with tools used to support the work | Scanner output sold as a penetration test |
| Tester | Named lead or documented skill match for the technology | Staff assigned only after purchase with no skill commitment |
| Retest | Terms, window, and closure evidence defined in writing | Retesting priced or scoped only after findings appear |
| Report | Reproduction steps, impact, severity, remediation, and executive summary | Finding list without evidence or business context |
Start with what must be tested and why. Credentials and price become meaningful only after the scope and expected evidence are comparable.
List the applications, APIs, cloud accounts, mobile builds, networks, user roles, and excluded systems. State whether the test supports a release, customer review, compliance cycle, or broader risk decision.
A bounded annual test fits stable scope. PTaaS or continuous access fits frequent releases and repeated retesting. Red-team work tests detection and response across a wider attack path and should not be purchased as a substitute for an application pentest.
Request a redacted sample report, confirm who performs the work, and put retest limits and evidence format in the statement of work. A cheaper quote is not comparable when it excludes critical surfaces or closure evidence.
Answers about engagement design and provider fit, separate from any one compliance framework.
Share the systems in scope, testing surface, deadline, and evidence requirements. We’ll route the request for manual review so firms respond against the same brief.