Penetration Testing Services: 13 Firms Compared by Published Price (2026)

Not every product on the market. How we rank Not ranked: Astra Security (sold as a yearly plan per target, not per test); Defense.com (priced plan is automated attack-surface testing; its manual test is quote-only). Quote-only firms are listed below.

How we ranked these penetration testing services

We ranked penetration testing services by one number: the lowest starting price each firm publishes for one web application test, as a logged-out US visitor sees it. We read every price on the firm’s own page on October 24, 2026. Ties would share a rank, ordered A to Z.

AI-led and human-led tests sit in the same table, labelled in the “Testing model” column, so you can see the price gap instead of two separate number ones. SecurityMetrics publishes a range rather than a starting price, so we ranked it at the low end and marked it “range”. Firms that only quote per project are listed A to Z further down, unranked. Whether a firm pays us has no effect on its position; none of these firms has an affiliate deal with us today.

Firms that publish prices

Six firms publish a per-test price, and two more publish yearly plans. Here is what each price buys, in rank order.

1. Cobalt: cheapest published test, for a limited time

Cobalt charges $3,500 per test for its Autonomous Pentest, a web application test run by AI systems with a Cobalt pentester directing scope and quality, according to Cobalt’s pricing page. The price is a promotion: the test has to start and finish before December 31, 2026. Cobalt says findings arrive within 24 hours. Its regular model is credits, where one credit equals 8 hours of testing, sold in annual packages.

• Who it’s for: a SaaS team that needs a web app test this quarter and already likes platform-based testing.
• Skip it if: you need a network or cloud test, or a price you can plan on after 2026.

2. Intruder: AI-led test with unlimited retests

Intruder sells a same-day, AI-led white-box web application pentest for $4,000 per test, or $3,500 if you also pay for its scanning platform. A pack of four costs $12,000. Intruder says the test is built by CREST-certified experts, connects to your code repository and includes unlimited retesting, with reports you can hand to SOC 2 and ISO 27001 auditors.

• Who it’s for: developers who want a fast, repeatable test tied to their codebase.
• Skip it if: you can’t connect your code repository, or you need network testing.

3. Synack: AI test, or researchers on a credit plan

Synack prices one AI Sara pentest from $4,181, a standard pentest by its researchers from $10,283, and its Synack14 test from $27,120. The catch: Synack’s pricing page says its platform is required and billed as a separate line item, so the starting price is not the full bill.

• Who it’s for: larger teams that want AI and human testing on one credit plan.
• Skip it if: you want one fixed number for the whole job.

4. Blaze Information Security: lowest human-led price

Blaze Information Security starts web application, API and focused external network tests at $4,999, mobile app tests at $5,299 and cloud tests at $7,500, per its 2026 pricing table. Blaze calls its testing “human-led by design”: researchers run the test and validate every finding, using AI for repetitive analysis.

• Who it’s for: a startup buying its first human-led web app test for SOC 2 or a customer questionnaire.
• Skip it if: you need a large internal network or red team engagement; Blaze quotes those separately.

5. Software Secured: human-led, with three retest rounds

Software Secured prices web and API pentests from $10,800, mobile from $5,400 and external network from $5,400. Its pricing page says certified full-time pentesters do the manual testing, and most web, API and mobile tests include three retest rounds over 12 months.

• Who it’s for: SaaS companies in finance or health that want named methodology and retests built in.
• Skip it if: budget is the main constraint; its web app start is the highest published starting price here.

6. SecurityMetrics: published range, retest included

SecurityMetrics does not list a starting price. Its FAQ says tests usually run $15,000–$30,000, and that a “pentest” listed for less than $4,000 is likely not a real one. That is the vendor’s view, not ours. SecurityMetrics includes retesting in its initial quote.

• Who it’s for: merchants and payment businesses already using SecurityMetrics for PCI compliance.
• Skip it if: you want a fixed price before talking to sales.

Not ranked: Astra Security and Defense.com

Astra Security sells pentests as yearly plans per target: Pentest Auto (autonomous) at $2,999, Pentest Expert (certified pentesters plus autonomous agents) at $5,999, and Enterprise from $9,999. A yearly plan isn’t a per-test price, so it sits outside the ranking. Defense.com lists an Application Attack Surface plan at $995, which it describes as automated scanning that confirms the weaknesses it finds; its manual Targeted Pen Test is quote-only.

Firms that quote per project (unranked, A to Z)

The five firms below sell penetration testing services but publish no price, so we can’t rank them on our criterion. Each row uses the firm’s own description of who does the testing.

PTaaS vs a traditional penetration test

Penetration testing as a service (PTaaS) delivers pentests through a web platform where findings appear as testers log them, retests are requested in the portal, and tests are booked on demand. A traditional engagement is scoped by email, runs for a set window and ends with a PDF report.

Software Secured also sells a PTaaS subscription. PTaaS fits teams that ship often and test several times a year. A traditional engagement fits a one-off test for an audit or a customer.

AI-led vs human-led penetration tests

AI-led penetration tests cost $3,500 to $4,181 among the firms we checked, while human-led tests start at $4,999 and run to $10,800 or more. The gap reflects tester time. Human testers spend days on business logic, such as whether one customer can read another customer’s invoices; Blaze lists 3 to 7 testing days for a simple SaaS app. AI-led testing isn’t the same as red teaming an AI model.

Ask any firm, AI-led or not, three things: who reviews the findings, whether the report names the methodology, and whether your auditor or customer will accept it. We found no auditor rule that rejects AI-led tests, so check with yours. To scan your own systems first, see our penetration testing tools list. For prices by test type (network, mobile, cloud), see our penetration testing cost breakdown.

Types of penetration testing services

Penetration testing services are sold by target: what the tester attacks decides the scope and the price.

Each type can be black box, gray box or white box, depending on how much access you give the tester.

How to choose a penetration testing company

Pick the firm whose quote states exactly what is tested and what you get back. Check these six things before you sign:

1. Scope unit: per app, per IP, per endpoint or per tester-day, written into the quote.
2. Who tests: named testers or stated certifications (OSCP, CREST), and whether AI does the first pass.
3. Retests: how many, and within what window.
4. Sample report: ask for one before you buy.
5. Compliance letter: an attestation your SOC 2 auditor or PCI assessor can use; the test is one line in SOC 2’s year-one cost.
6. Authorization: written rules of engagement signed before testing starts.

If an insurer asked you for a pentest, our guide to small business cyber insurance covers what carriers look for.