Penetration testing
Most SOC 2 and ISO audits expect a recent penetration test, and any of these providers say they can run one. Compare 92 penetration testing providers on published prices, what they offer and how each fact was checked.
Updated 1 Oct 2026. How we research- Firms listed
- 92
- Published prices
- $95 to $60,000 · €1,500 to €10,000 16 firms, each linked to its source
- Checked in an official register
- 17 of 92
FiltersClear all
Prescient Security & Assurance5 verifiedAudit firm and certification body and consultant, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
A-LIGN2 verifiedAudit firm and certification body, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
Aprio2 verifiedAudit firm- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
BARR Advisory2 verifiedAudit firm and certification body and consultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
ControlCase2 verifiedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
DigitalXRAID2 verifiedConsultant, United Kingdom- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
Fortreum2 verifiedAudit firm- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
Linford & Company LLP2 verifiedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
- Schellman & Company2 verifiedAudit firm and certification body, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
URM Consulting Services2 verifiedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
360 Advanced1 verifiedAudit firm and certification body, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
- AARC-3601 verifiedAudit firm, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
Drummond Group1 verifiedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
- GRSee1 verifiedConsultant and audit firm
- Starting price
- From $15,000
- Legal entity
- Not stated
- Accreditations
- Verified
KirkpatrickPrice1 verifiedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
Patronusec1 verifiedConsultant, Poland. Signs as Patronusec Sp. z o.o.- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Verified
- VISTA InfoSec1 verifiedConsultant, India
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Verified
13 SecurityNot yet checkedConsultant, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
AdversisNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
AgencyNot yet checkedConsultant- Starting price
- From $2,500
- Legal entity
- Not stated
- Accreditations
- Not stated
AkantNot yet checkedConsultant, France. Signs as AKANT SAS- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Not stated
AmagisTech LimitedNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Astra SecurityNot yet checkedPentest platform- Starting price
- From $2,999
- Legal entity
- Not stated
- Accreditations
- Firm states
AtoroNot yet checkedConsultant, Ireland- Starting price
- From €1,500
- Legal entity
- Not stated
- Accreditations
- Firm states
Auditsuisse AssuranceNot yet checkedAudit firm. Signs as Auditsuisse Assurance NA PC- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
AuditVisorNot yet checkedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
BD EmersonNot yet checkedAudit firm and consultant, United States- Starting price
- From $7,000
- Legal entity
- Not stated
- Accreditations
- Firm states
- Bird Rock SystemsNot yet checkedConsultant, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
BreachLock Inc.Not yet checkedPentest platform, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Bright DefenseNot yet checkedConsultant, United States- Starting price
- From $1,000
- Legal entity
- Not stated
- Accreditations
- Not stated
Brown EdwardsNot yet checkedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
- CAS AssuranceNot yet checkedAudit firm, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
CBIZNot yet checkedAudit firm- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
CEREIV Advisory LLPNot yet checkedCertification body, India. Signs as CEREIV Advisory LLP- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
CGVantage (formerly CyberGuard Advantage)Not yet checkedAudit firm- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
CibersafetyNot yet checkedConsultant, Spain- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
- CobaltNot yet checkedPentest platform
- Starting price
- From $3,500
- Legal entity
- Not stated
- Accreditations
- Firm states
- Consilium LabsNot yet checkedAudit firm and certification body, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
- CORAL eSecureNot yet checkedConsultant
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
- ctrl:cyberNot yet checkedConsultant, Australia
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Cyber AllyNot yet checkedConsultant, Australia- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
CyberSapiensNot yet checkedAudit firm, Australia- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Cybertryzub Infosec Private LimitedNot yet checkedCertification body, India. Signs as Cybertryzub Infosec Private Limited- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
- DCR Partners LtdNot yet checkedConsultant, United Kingdom. Signs as DCR Partners Ltd
- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
Design AssuranceNot yet checkedAudit firm- Starting price
- From $17,900
- Legal entity
- Not stated
- Accreditations
- Firm states
DNX SolutionsNot yet checkedConsultant, Australia. Signs as DNX Solutions- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Not stated
Echelon Risk + CyberNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Eden DataNot yet checkedConsultant, United States- Starting price
- From $3,000
- Legal entity
- Not stated
- Accreditations
- Not stated
FinAudit CPANot yet checkedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
- GBQ PartnersNot yet checkedAudit firm
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
GRC ConciergeNot yet checkedConsultant, Canada- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
HackerOneNot yet checkedPentest platform- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Innovative Quality Certifications Pvt. Ltd.Not yet checkedCertification body, India. Signs as Innovative Quality Certifications Pvt. Ltd.- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
Insight AssuranceNot yet checkedAudit firm and certification body, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
IS PartnersNot yet checkedAudit firm and certification body, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
- ISSPL Limited (IRQS)Not yet checkedCertification body, India. Signs as ISSPL Limited
- Starting price
- From $3,000
- Legal entity
- Firm states
- Accreditations
- Firm states
Kaamel TechnologyNot yet checkedConsultant, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Kobalt.ioNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
LBMCNot yet checkedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Logic WeaveNot yet checkedConsultant, Australia- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
- Mirai SecurityNot yet checkedConsultant
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
OmniCyber Security LtdNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Oread Risk & AdvisoryNot yet checkedAudit firm and consultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Pentest-Tools.comNot yet checkedPentest platform- Starting price
- From $95
- Legal entity
- Not stated
- Accreditations
- Firm states
PentiNot yet checkedConsultant, United States. Signs as Certypie Inc- Starting price
- From $300
- Legal entity
- Firm states
- Accreditations
- Not stated
PericuloNot yet checkedConsultant, United Kingdom- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Pivot Point SecurityNot yet checkedConsultant, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Razorthorn SecurityNot yet checkedConsultant, United Kingdom- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Realize Security LtdNot yet checkedConsultant, United Kingdom- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Red Citadel LimitedNot yet checkedConsultant, United Kingdom- Starting price
- From £750
- Legal entity
- Not stated
- Accreditations
- Firm states
Red SentryNot yet checkedPentest platform- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
- Revolution InfoSecNot yet checkedConsultant, New Zealand
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
RhymetecNot yet checkedConsultant, United States. Signs as Rhymetec LLC- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Not stated
Saepio Information SecurityNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
SapphireNot yet checkedConsultant, United Kingdom- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
SecuranceNot yet checkedAudit firm- Starting price
- From €10,000
- Legal entity
- Not stated
- Accreditations
- Not stated
Secure AuditNot yet checkedAudit firm, Netherlands- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
SecurePoint 360, LLCNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
- Securis360Not yet checkedConsultant, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Security DecodedNot yet checkedConsultant, Singapore. Signs as Security Decoded- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Firm states
SeisoNot yet checkedConsultant, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Sensiba LLPNot yet checkedAudit firm and certification body- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
Software SecuredNot yet checkedConsultant, Canada- Starting price
- From $5,400
- Legal entity
- Not stated
- Accreditations
- Not stated
Soter AdvisoryNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Strike SecurityNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Tagore ASNot yet checkedConsultant, Norway. Signs as Tagore AS- Starting price
- Not published
- Legal entity
- Firm states
- Accreditations
- Not stated
TevoraNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
- Trava SecurityNot yet checkedConsultant, United States
- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
UzadoNot yet checkedConsultant, Canada- Starting price
- From $24,000
- Legal entity
- Not stated
- Accreditations
- Not stated
Wattlecorp Cybersecurity LabsNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
WorkstreetNot yet checkedConsultant- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Not stated
Zero Day CPANot yet checkedAudit firm, United States- Starting price
- Not published
- Legal entity
- Not stated
- Accreditations
- Firm states
No firms match these filters. Clear all filters
How to choose a penetration testing provider
Check what is in scope (web app, API, cloud, mobile), who does the testing, and whether the report is acceptable to your auditor. Ask about re-testing after you fix findings.
Some providers are firms with testers on staff and some are platforms that match you with testers. Both can work, so ask who is accountable for the report.
Related lists
Do I need a penetration test for SOC 2?
It is not strictly required, but many auditors and customers expect a recent one.
What does CREST accredited mean?
CREST is a body that accredits penetration testing companies. We show it only when the firm states it or a register confirms it.
How is this list ordered?
By the sort you choose. The default is the number of verified credentials, then alphabetical. Payment never changes the order, and a Featured slot is shown apart from the results and labelled as paid.