Penetration testing firms, compared on what they publish.

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing

Reports for: SOC 2, ISO 27001, HIPAA, PCI DSS 11.4, GDPR, DORA, CERT-In

Pricing, as published: Pricing page (USD): Pentest Auto (autonomous AI pentest, 1 target) $199/month or $2,999/year; Pentest Expert (manual pentest by certified pentesters plus autonomous agents, 1 target) $5,999/year; Enterprise from $9,999/year. FAQ: Android/iOS apps sharing a code base priced from $2,200/app.

Retests, as published: Pentest Auto includes 1 human re-scan and Pentest Expert 2 human re-scans to verify fixes, plus automated re-scans; Enterprise lists 4 re-scans available for 90 days (pricing page).

Notable: Went through the Techstars accelerator in Berlin in 2018 and raised $2.7M in 2025 (Emergent Ventures, Neon Fund, Better Capital, Blume, Point One Capital). Added an autonomous-only pentest tier (Pentest Auto) in 2026, sold alongside manual pentests by in-house testers.

Sources (12): getastra.com, getastra.com, inc42.com, getastra.com, getastra.com, getastra.com, s3.amazonaws.com, help.getastra.com, marketplace.crest.org, cert-in.org.in, s3.amazonaws.com, pcisecuritystandards.org · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, social engineering, AI/LLM testing

Reports for: PCI DSS 11.4, HIPAA, SOC 2, FISMA, NIST 800-53, CMMC

Pricing, as published: Standard list prices (USD): Sara Pentest (agentic AI-led) from $5,085 for 1 Standard Sara Pentest; SynackST (human-led compliance pentest, 1 tester) from $10,283 for 1 Standard Pentest; Synack14/365 (team of researchers) from $27,120 for 1 Synack14 Pentest; Enterprise on request. The Synack Platform subscription is required and is a separate line item; FedRAMP offerings priced on request; credits expire one year from purchase.

Retests, as published: Patch verification (retest of remediated vulnerabilities by Synack Red Team researchers, requested through the platform) is listed as included in every testing package; no count or time limit is stated.

Notable: Merged with NetSPI in a KKR-supported deal that closed on 5 Oct 2026; each company continues to sell its own platform and contracts for now. Synack platform is FedRAMP certified at Moderate (Class C) since 19 Dec 2023, agency path; the authorization does not extend to NetSPI products.

Sources (15): synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com, synack.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, HIPAA, GDPR, ISO 27001

Retests, as published: Standard tier: 12 months of retesting (with 1 report update) for web apps, networks and APIs; Plus tier: 12 months of retesting (with 1 report update) for all asset types (PTaaS page).

Notable: Acquired Informer (UK attack surface management and pen testing firm) in May 2024 and Mayhem Security (formerly ForAllSecure) in November 2025. Bugcrowd for Government (BCGOV) became FedRAMP certified at Moderate on 19 Feb 2026.

Sources (16): bugcrowd.com, bugcrowd.com, securityweek.com, bugcrowd.com, bugcrowd.com, bugcrowd.com, bugcrowd.com, bugcrowd.com, fedramp.gov, bugcrowd.com, bugcrowd.com, bugcrowd.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, AI/LLM testing

Reports for: SOC 2, ISO 27001, PCI DSS 11.4, HIPAA, NIST 800-53, EU Cyber Resilience Act (CRA)

Pricing, as published: Cobalt Autonomous Pentest (AI-run web application test directed by Cobalt Core pentesters): $3,500 per test, limited-time promotional price; the test must be initiated and completed before 31 Dec 2026. Human-led PTaaS tiers (Standard, Premium, Enterprise) are sold as annual credit packages (1 Cobalt Credit = 8 hours of testing), quote only.

Retests, as published: Free retesting included: within 6 months (Standard tier) or 12 months (Premium and Enterprise tiers) per the pricing-page tier table; the pricing FAQ describes unlimited on-demand retesting throughout the contract term.

Notable: Launched Cobalt Autonomous Pentest (AI-run testing with human pentester oversight) in 2026; Cobalt states the autonomous product does not produce compliance attestation reports. Raised a $29M Series B led by Highland Europe in August 2020.

Sources (10): cobalt.io, securityweek.com, cobalt.io, cobalt.io, cobalt.io, cobalt.io, cobalt.io, docs.cobalt.io, fedramp.gov, marketplace.crest.org · checked 2026-11-08

Services: web app, network external, network internal, cloud

Reports for: PCI DSS 11.4, SOC 2, DORA, GDPR, NIST, CMMC, CIS, FedRAMP, NIS2

Pricing, as published: List prices in USD (NodeZero pricing page): Flex (episodic) $15 per asset per test, 12-month term; Core $50, Pro $65, Elite $85 per asset per year (annual subscriptions, unlimited testing). NodeZero WebApp Flex $10,000 per asset (app) per test, 12-month term; WebApp Continuous custom-priced. Premium support adds 10% (min $7,500/yr) or 20% (min $25,000/yr) of the annual subscription.

Retests, as published: Every weakness comes with Fix Actions and '1-click Verify' (targeted retest); Core/Pro/Elite subscriptions include unlimited pentests per licensed asset for 12 months, while Flex counts an asset each time it is tested (pricing page). For its OSCP-delivered compliance pentests, Horizon3 includes 12 months of NodeZero access with targeted retesting via 1-click Verify, repeatable 'as often as necessary' (compliance and PCI pages).

Notable: Raised a $250M Series E at a valuation above $2B in August 2026, co-led by NightDragon and NEA (press release) Horizon3 says NodeZero is the engine behind the NSA Cybersecurity Collaboration Center's Continuous Autonomous Penetration Testing (CAPT) program for Defense Industrial Base suppliers

Sources (13): horizon3.ai, horizon3.ai, horizon3.ai, horizon3.ai, horizon3.ai, horizon3.ai, horizon3.ai, trust.horizon3.ai, horizon3.ai, fedramp.gov, horizon3.ai, horizon3.ai · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, AI/LLM testing

Reports for: SOC 2, PCI DSS 11.4, HIPAA, ISO 27001, GDPR, NIS2

Retests, as published: Platform: users re-run tests on demand and retest fixes, including 'auto-triggered revalidation' and retest via Pentera Resolve (product pages). SECTOR11 human engagements include a revalidation step: 'Our team retests to confirm fixes and provides follow-up reporting' (services page). No number of retests or time window is stated.

Notable: Raised a $60M Series D led by Evolution Equity Partners in March 2025, bringing total funding to $250M (SecurityWeek) Acquired EVA Information Security, an offensive security firm specializing in AI red teaming and pentesting, in November 2025 (press release)

Sources (16): pentera.io, pentera.io, securityweek.com, pentera.io, pentera.io, pentera.io, pentera.io, pentera.io, pentera.io, pentera.io, trust.pentera.io, pentera.io · checked 2026-11-08

Services: web app, mobile, network external, network internal, cloud, red team, AI/LLM testing

Reports for: FDA premarket/postmarket cybersecurity (medical devices), ISO/SAE 21434 (automotive)

Pricing, as published: Not on praetorian.com (/pricing redirects to the contact page). Praetorian's own AWS Marketplace listing for the Praetorian Guard Platform shows a 12-month 'Enterprise' contract at USD 80,000, with 'reach out to sales@praetorian.com for custom pricing' and usage over the contracted value at USD 0.01/unit.

Retests, as published: AI/ML pentest page lists 'follow-up verification' of remediation; FDA postmarket service says it validates 'that remediation steps were effective'. No general retest terms published.

Notable: Its Chariot platform was renamed Praetorian Guard (praetorian.com/chariot now redirects to /guard) Maintains the open-source secrets scanner Titus (github.com/praetorian-inc/titus)

Sources (20): praetorian.com, praetorian.com, builtinaustin.com, praetorian.com, praetorian.com, praetorian.com, praetorian.com, praetorian.com, aws.amazon.com, praetorian.com, praetorian.com, trust.praetorian.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, HIPAA, SOC 2, ISO 27001, GLBA, CMMC

Pricing, as published: Raxis Attack (PTaaS subscription): 'Prices start at $25K for one year depending on the scope' (USD); point-in-time (Raxis Strike) pricing not published

Retests, as published: Point-in-time (Raxis Strike): remediated findings retested at no additional charge. PTaaS (Raxis Attack): unlimited retesting, 'no retest fees, ever'. No retest window stated

Notable: Bought Boscloner, a maker of RFID badge-cloning hardware, in July 2021 Publishes security research and CVE disclosures by its testers

Sources (25): raxis.com, raxis.com, prnewswire.com, raxis.com, raxis.com, raxis.com, raxis.com, raxis.com, raxis.com, raxis.com, raxis.com, raxis.com · checked 2026-11-08

Services: web app, API, cloud

Reports for: SOC 2, ISO 27001

Retests, as published: Retests are self-serve, with no scheduling call. The vendor says they complete in under an hour; an automated validator agent re-runs the original attack, and report findings are marked open, remediated or 'retest-verified fixed' (platform and SOC 2 pages). No retest limit is stated.

Notable: Raised $40M led by Khosla Ventures, with S32, Anthropic and Menlo Ventures' Anthology Fund, Conviction and Elad Gil (March 2026 press release; Fortune) Co-founded in 2023 by Ari Herbert-Voss (OpenAI's first security research hire) and Vlad Ionescu (former Meta offensive security red team lead) (Fortune)

Sources (11): runsybil.com, fortune.com, runsybil.com, runsybil.com, runsybil.com, runsybil.com, trust.runsybil.com, runsybil.com, cdn.prod.website-files.com, cdn.prod.website-files.com, runsybil.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, SOC 2, HIPAA, ISO 27001, DORA, GDPR, NIST CSF, HITRUST, FFIEC, GLBA, NYDFS 23 NYCRR 500, NERC CIP

Retests, as published: Application pentest FAQ lists retesting 'to confirm that remediation efforts are effective and complete' among deliverables; the external pentest methodology lists 'Remediation Review' (re-scanning and testing after client remediation) as an optional scope addition. No retest window or price published.

Notable: Maintains the open-source adversary emulation framework Sliver (github.com/BishopFox/sliver) Released AIMap, an open-source tool for discovering and testing exposed AI infrastructure, in April 2026 (github.com/BishopFox/aimap)

Sources (28): bishopfox.com, bishopfox.com, prnewswire.com, bishopfox.com, carrickcapitalpartners.com, securityweek.com, bishopfox.com, bishopfox.com, bishopfox.com, bishopfox.com, bishopfox.com, bishopfox.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing

Reports for: SOC 2, PCI DSS 11.4, ISO 27001, HIPAA, HITRUST, GDPR, NIST

Retests, as published: Every pentest includes a free manual retest by the assigned pentester plus unlimited automated retesting of individual findings via the platform at no additional cost (services page); pricing page: Standard package 1 free manual re-test, Extended 2, Extensive custom. No time window stated.

Notable: Raised a $3M seed round led by TIIN Capital (Netherlands) in March 2022. Publishes an annual Penetration Testing Intelligence Report.

Sources (10): breachlock.com, breachlock.com, prweb.com, breachlock.com, breachlock.com, breachlock.com, breachlock.com, marketplace.crest.org, downloads.breachlock.com, breachlock.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, AI/LLM testing

Reports for: SOC 2, ISO 27001, GDPR, NIST CSF 2.0, NIST 800-53, FISMA, DORA, PCI DSS 11.4

Retests, as published: Unlimited retests at no extra cost during the remediation period, which typically lasts 30 or 90 calendar days depending on pentest type; after that, retests remain possible while the platform service is active, with a customer-set fee (minimum $50 USD) paid to the pentester (docs, updated 24 Mar 2026).

Notable: Pentest product line is now H1 Agentic Pentest (AI agents plus human pentesters, web apps and APIs) and H1 Pentest (human-led, all other asset types). Acquired PullRequest (code review) in April 2022.

Sources (10): hackerone.com, securityweek.com, hackerone.com, docs.hackerone.com, hackerone.com, fedramp.gov, hackerone.com, hackerone.com, hackerone.com, marketplace.crest.org · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: AIUC-1, OCP S.A.F.E., ISO/SAE 21434, ISO 24089, UNECE R155, UNECE R156

Retests, as published: AI security engagements: after fixes, IOActive reruns the same test harness and measures the change in attack success (AI services page). No retest terms published for other pentests

Notable: Runs embedded-device and silicon hacking labs in Seattle and Madrid Its researcher Barnaby Jack demonstrated remote exploitation of a pacemaker in October 2012

Sources (13): ioactive.com, ioactive.com, ioactive.com, ioactive.com, ioactive.com, ioactive.com, ioactive.com, ioactive.com, pcisecuritystandards.org, ioactive.com, ioactive.com, ioactive.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, DORA, TIBER-EU

Retests, as published: Threat-led pentest page says Kroll validates remediation through retesting; count, window and cost are not published

Notable: Formerly Duff & Phelps (founded 1932), which acquired Kroll in 2018 and announced on Feb 24, 2021 that it would unify under the Kroll name Listed by the PCI SSC as both a QSA and a PCI Forensic Investigator (as Kroll Associates, Inc., previously Kroll Cyber Security)

Sources (20): kroll.com, kroll.com, kroll.com, kroll.com, kroll.com, stonepoint.com, prnewswire.com, kroll.com, kroll.com, kroll.com, kroll.com, kroll.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, SOC 2, HIPAA, ISO 27001, GDPR, CMS, FedRAMP

Retests, as published: No retest terms published for standard engagements. The Continuous Penetration Testing service page lists 'retesting post remediation' as one use of that subscription.

Notable: Sold its Escode software-escrow business to funds managed by TDR Capital; completed 29 May 2026 (net cash proceeds £262.8m), leaving NCC as a cyber-security-only business Ended its strategic review on 11 June 2026, deciding to remain listed. The review began in July 2025 and had considered a sale of the company.

Sources (27): nccgroup.com, nccgroup.com, investegate.co.uk, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com, nccgroup.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: SOC 2, PCI DSS 11.4, HIPAA, DORA

Retests, as published: PTaaS customers get a year of access to The NetSPI Platform after a point-in-time test and 'can also schedule remediation testing to validate your efforts' (PTaaS data sheet); whether retesting is included in the price, and any limits, are not stated.

Notable: Acquired Silent Break Security (Dec 2020), nVisium (Jan 2023) and Hubble Technology (Jun 2024). Merged with Synack; the deal was announced on 2 Sep 2026 and closed on 5 Oct 2026, with KKR supporting the combined company.

Sources (14): netspi.com, netspi.com, synack.com, netspi.com, netspi.com, netspi.com, netspi.com, netspi.com, netspi.com, netspi.com, netspi.com, netspi.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, SOC 2, ISO 27001

Retests, as published: Infrastructure pentest FAQ: 'Retesting is included so your team can confirm closure'. General FAQ: retest time and timing are agreed before the engagement. The Packetlabs Portal offers retest requests.

Notable: Founded in 2011 by Richard Rogerson Offices in Toronto (HQ), San Francisco and Sydney

Sources (20): contact.packetlabs.net, contact.packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net, packetlabs.net · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Reports for: PCI DSS 11.4, HIPAA, ISO 27001, SOC 2, GDPR, NIS

Retests, as published: One remote remediation validation (RV) of high- and critical-severity findings only; RV must be requested by email within 30 days of the final report, and remediation plus RV must be completed within 90 days of test completion (Sophos service catalog and Penetration Testing Service Description, rev. 5 Dec 2025)

Notable: Sophos completed its acquisition of Secureworks (about $859M, all cash) on February 3, 2025; secureworks.com now redirects to sophos.com Sophos relaunched the former Secureworks testing practice as Sophos Advisory Services in October 2025, staffed by testers who came over from Secureworks

Sources (24): sophos.com, sec.gov, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com, docs.sophos.com · checked 2026-11-08

Services: web app, API, network external, network internal, AI/LLM testing

Reports for: SOC 2, ISO 27001, PCI DSS 11.4, HIPAA

Retests, as published: After a fix is pushed, Terra's agents automatically re-test to confirm the exposure is closed, with 'No separate re-engagement' (web app page). Automatic re-test is also stated for external/internal network and AI red teaming (service pages). No limit stated.

Notable: Raised a $30M Series A led by Felicis in September 2025, bringing total funding to $38M (press release; SecurityWeek) Delivers agentic pentesting with a 'human-on-the-loop': certified pentesters validate and sign off findings before they are reported (platform page)

Sources (14): securityweek.com, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security, terra.security · checked 2026-11-08

Services: web app, network external, network internal, cloud, red team, social engineering, AI/LLM testing

Reports for: PCI DSS 11.4, HIPAA, SOC 2

Retests, as published: Pentest process includes 'Validation Testing: After you've addressed identified vulnerabilities, we retest to confirm they've been successfully mitigated' (service page). No retest window or price published.

Notable: Maintains the open-source Social-Engineer Toolkit (SET) (github.com/trustedsec/social-engineer-toolkit) Trimarc Security, an Active Directory security firm, began operating under the TrustedSec banner in March 2025; Trimarc founder Sean Metcalf joined TrustedSec

Sources (20): trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com, trustedsec.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, OT/ICS

Reports for: ISO 27001, HIPAA, CMMC, DORA, NIS2, NIST, Essential Eight

Retests, as published: 'Findings Validation: Validate test findings with retesting services at no additional cost' (LevelBlue penetration testing page)

Notable: trustwave.com now redirects to levelblue.com, and SpiderLabs operates as LevelBlue SpiderLabs LevelBlue completed its acquisition of Trustwave on August 19, 2025, and of Cybereason in November 2025

Sources (21): cyber.levelblue.com, marketplace.fedramp.gov, raw.githubusercontent.com, bloomberg.com, levelblue.com, levelblue.com, levelblue.com, levelblue.com, levelblue.com, levelblue.com, levelblue.com, levelblue.com · checked 2026-11-08

Services: web app, API

Reports for: SOC 2, ISO 27001

Retests, as published: 'Deploy the fix, trigger a re-test, free and unlimited, and XBOW confirms it closed' (homepage).

Notable: Reached #1 on HackerOne's US leaderboard in June 2025, the first autonomous system to do so; XBOW says its security team reviewed submissions before they were sent, per HackerOne's policy on automated tools (XBOW blog) Raised a $120M Series C led by DFJ Growth and Northzone at a valuation above $1B in March 2026, plus $35M more from strategic investors in May 2026 (press releases)

Sources (12): xbow.com, xbow.com, xbow.com, xbow.com, trust.xbow.com, xbow.com, xbow.com, xbow.com, xbow.com, xbow.com, xbow.com, xbow.com · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing

Retests, as published: Service guide lists 'Remediation Validation (optional)' after testing and says the report methodology is written so the client can retest after fixes; the ANTISOC continuous-testing subscription has testers available to retest identified findings on request. Whether retests cost extra is not stated.

Notable: Launched the Wild West Hackin' Fest conference in Deadwood, SD in 2017 (later also held in Reno, San Diego and Denver) Antisyphon Training, Active Countermeasures, Wild West Hackin' Fest and REKCAH! Publishing are listed as its 'Tribe of Companies'

Sources (12): blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, blackhillsinfosec.com, pcisecuritystandards.org · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing

Reports for: PCI DSS 11.4, HIPAA, FedRAMP

Notable: Launched DivisionHex, an offensive and defensive security services unit, in August 2025 In November 2026 ShorePoint bought a portfolio of federal contracts from subsidiary Coalfire Federal, which continues to operate independently

Sources (21): assets.coalfire.com, assets.coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com, coalfire.com · checked 2026-11-08

Services: web app, mobile, network external, network internal, cloud, red team, social engineering, AI/LLM testing, OT/ICS

Notable: Google completed its acquisition of Mandiant, Inc. (NASDAQ: MNDT) on September 12, 2022; Mandiant joined Google Cloud and kept the Mandiant brand Publishes the annual M-Trends threat report (M-Trends 2026 is current)

Sources (11): sec.gov, googlecloudpresscorner.com, sec.gov, cloud.google.com, services.google.com, cloud.google.com, cloud.google.com, cloud.google.com, cloud.google.com, cloud.google.com, marketplace.crest.org · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, red team, social engineering, AI/LLM testing

Retests, as published: Penetration testing includes reported findings, recommended remediations and 'options for add-on retesting' (service brief page, May 2025)

Notable: Sold its advisory, consulting and transformation (ACT) project-based services business to Vobis Ventures (closed June 1, 2026); it operates as Optiv Consulting, Optiv's exclusive services partner Closed an amendment and extension of its credit facilities in May 2026, moving maturities to 2028 (ABL, first lien) and 2029 (second lien)

Sources (18): vobisarc.com, bankinfosecurity.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com, optiv.com · checked 2026-11-08

Services: web app, mobile, network external, network internal, red team, social engineering

Reports for: PCI DSS 11.4

Notable: Maintains the open-source Metasploit Framework; its pentesters contribute to it Signed a Nomination and Support Agreement with activist investor JANA Partners in March 2026 (JANA capped at 19.9%); no sale or take-private announced as of its Nov 4, 2026 10-Q

Sources (10): sec.gov, sec.gov, sec.gov, rapid7.com, rapid7.com, pcisecuritystandards.org, rapid7.com, rapid7.com, github.com, sec.gov · checked 2026-11-08

Services: web app, API, mobile, network external, network internal, cloud, red team, social engineering

Reports for: PCI DSS 11.4, HIPAA, SOC 2

Pricing, as published: FAQ: penetration tests 'generally start around the $10,000 range' (USD) and 'can grow into six figures for large, in-depth projects'; discounts offered for multi-year contracts.

Retests, as published: Remediation testing on client request (web app) or 'as an additional service' (network): Rhino re-tests after patching and updates the previous assessment report. No window or price published.

Notable: Maintains Pacu, an open-source AWS exploitation framework (github.com/RhinoSecurityLabs/pacu) Maintains CloudGoat, a 'vulnerable by design' AWS deployment tool (github.com/RhinoSecurityLabs/cloudgoat)

Sources (15): rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, rhinosecuritylabs.com, github.com, github.com, rhinosecuritylabs.com, rhinosecuritylabs.com · checked 2026-11-08