US Penetration Testing Price Index

How we built it

Method and limits

• What counts. A price the firm publishes itself, on its own website or its official marketplace listing, readable without logging in, in US dollars, for a penetration test or a service that includes testing by people. Review sites, third-party estimates, "average cost" and "typical price" tables, undated ranges, price ceilings and fully automated tools are left out. 28 of the firms we checked publish only figures like these.
• Checked three times. One researcher recorded each price with the vendor's own wording, a second fetched every source again on November 8, 2026 and confirmed it, and we fetched all of them once more before publishing. Anything that could not be confirmed was dropped.
• How the medians work. Each firm counts once per test type, at its lowest published price for that type. Add-ons, partial scopes, bundles that include an audit, and monthly, hourly or day rates are shown in the table but kept out of the medians, because they do not compare with a price per test.
• Limits. Firms that publish prices are a minority and lean toward smaller, productized scopes, so these figures describe the entry point of the market, not a typical enterprise engagement. Scopes differ between vendors; read the "What it covers" column before comparing two numbers, and send every vendor the same scope, for example with our penetration testing RFP template.
• Disclosure. Invadel sells penetration testing and publishes its own prices. They are shown in their own column and excluded from every median, low and high.

No published price

Firms we checked that do not publish one

These 120 firms and platforms price penetration testing by quote. That is common, and not a criticism: it is why a public price index is useful. Several of them have a page where we compare penetration testing providers.

A-LIGN, Accorian, Affordable Pentesting, Aligned Technology Group, Alt Security, Altimetrik, Armakuni, BD Emerson, Bishop Fox, Black Hills Information Security, Blacklock, Blacksight, Breach Craft, BreachLock, Bright Security, Cadre Information Security, Check Point (PTaaS 360), Classmethod Security, Coalfire, Cognisys, Comp AI, Compass IT Compliance, CyberCraft, Cyberlinx, CyberPulse, CyberSecOp, DAS-Security, DeepStrike, Delve, Detectify, Drata, Edgescan, Emagine IT, Escala 24x7, Ethiack, Evolve Security, FireCompass, Fraktal, Framework Security, Futuralis, H One, Hacker Simulations, HackerGuardian (Sectigo), HackerOne, HackersEye, Hackmetrix, Hackrate, HALOCK, Hyperproof, IARM Information Security, IGI Cyber Security (PenLogic), ImmuniWeb, Insight Assurance, Intrinium, ioSENTRIX, IOvations, IT Governance USA (GRC Solutions), Johanson Group, Kroll, LASSecurity, Lightedge, Mercurius Cybersecurity, Mitnick Security, NCC Group, Netragard, NetSPI, NetWorks Group, Numen Cyber Technology, Oneleet, Optiv, Packetlabs, Pentera, Philistin & Heller Group, Pivot Point Security, Praetorian, Pragya, Prescient Security, Probely (Snyk API & Web), PurpleBox, PurpleSec, Rapid7, Raxis, Razilio, Red Sentry, Redbot Security, Rhino Security Labs, Rhymetec, RISCPoint, Schellman, Scrut, Secureframe, Secureworks (now Sophos), SecurityHQ, SecurityMetrics, SECUWALL, Sencode Cyber Security, SnapSoft, Sopra Steria, Sprinto, SRS Networks, Strike, Strike Graph, Strobes, TCM Security, The PenTesting Company, Thoropass (incl. Laika), Threat Protect, Trava Security, TrustedSec, Trustwave (LevelBlue), Usherwood, V-Secure, Vanta, VikingCloud, Vuln Voyager, Vumetric (TELUS), Wallarm, White Knight Labs, Workstreet, zeb.