Best HITRUST Penetration Testing Companies (2026): What the Assessment Accepts and Who to Hire

On 24 September 2026, HITRUST released version 11.9.0 of the HITRUST CSF. Its published baseline change FAQ shows that the release rewrote requirement 07.10m1Organizational.3, the scanning requirement that carries HITRUST's annual minimum: systems are now scanned "at a frequency based on the organization's formally documented assessment of risk (annually at minimum)". The release also tied remediation to "formally documented, risk-tiered remediation timeframes" and set the e1 baseline at 44 requirement statements (HITRUST's e1 page still says 43). No public HITRUST page sets a penetration testing frequency for the e1, i1 or r2 baselines (the one exception, for assessments that include the Security for AI systems factor, is below); the full requirement library sits behind a download form and in MyCSF, as our HITRUST penetration testing requirements guide explains. What HITRUST does publish decides who may run your test and how its report counts.

This ranking is for health systems, payers, health IT vendors and business associates pursuing a HITRUST e1, i1 or r2. On 13 October 2026, HITRUST's Find an External Assessor page listed 111 organizations: 102 External Assessors and 9 Readiness Licensees. Assessor firms that also test and independent testing firms are both ranked below, with each firm's status read from HITRUST's directory.

Quick answer. The best HITRUST penetration testing companies in 2026 are Stingrai, Coalfire, NetSPI, Clearwater, Meditology Services, Schellman, Tevora, A-LIGN, Optiv and NCC Group. Stingrai ranks first as an independent testing firm: CREST-accredited and headquartered in Toronto, with named penetration testers who test the applications, APIs, networks, Active Directory and cloud in your assessment scope, retest, and deliver a report your External Assessor can use as direct testing evidence, as a one-time annual test or a continuous program. Eight of the others are HITRUST External Assessors with their own testing teams; NetSPI is an independent testing firm. With no public HITRUST frequency to follow, time an annual test about six months before fieldwork so fixes clear the 90-day incubation period.

What HITRUST publishes about penetration testing in 2026

The Assessment Handbook version 1.2, whose new criteria apply to assessments submitted since 15 April 2026 under HAA 2026-001, names penetration testing only twice. The v11.9.0 advisory and its baseline FAQ do not mention it; the release's Summary of Changes does, because v11.9.0 edited the AI Security requirement below, adding goal override to its threat examples. That requirement, also printed in v11.4-era wording on HITRUST's AI Security specification page, holds the only public penetration testing cadence. Each source, quoted, with its verb:

From 31 December 2026, new e1 and i1 assessments must be created on v11.9.0 (HAA 2026-006); an r2 need not use the latest version. The AI requirement, filed under 07 Vulnerability Management and control reference 06.h Technical Compliance Checking, also applies before new models or significantly modified supporting infrastructure deploy, and it covers the AI system only: relevant to a health system deploying an AI scribe or a vendor shipping an LLM feature.

External Assessor or penetration testing firm: who does what

An External Assessor validates. HITRUST approves External Assessors "via an application process" (3.2.2), requires each to "employ at least 5 CCSFPs and 2 CHQPs" (3.2.3), and its directory calls them "the only entities authorized to perform the validated assessments that are submitted to HITRUST for certification." Every requirement statement "must be validated by an External Assessor" (11.1.3); HITRUST then runs quality assurance and issues the report.

A penetration testing firm finds and reports. Its report is direct testing evidence under 13.2.3, and how that evidence scores is the assessor's call. Two common configurations, both permitted:

1. Your assessor's firm tests (3.3.6): one contract, with a separate team required under 3.3.5 if its people built or ran your controls in the last 12 months.

2. An independent testing firm tests and your assessor validates: the three-party split our requirements guide recommends, which carries the fewest independence questions into a customer security review.

Check assessor claims on HITRUST's directory, which states that "HITRUST does not recommend specific EA Organizations for engagements."

What the External Assessor needs from your report

The Handbook requires the assessor to document "the date when each evidence artifact was generated" (11.3.12), to link evidence "individually to each of the related requirement statements" (11.3.11) and to upload all supporting evidence to MyCSF (11.3.7), where HITRUST's QA can review it. A report that serves those rules has:

1. A scope statement that matches the assessment scope; for an r2, scope the test after the scoping questionnaire generates your requirement statements.

2. The test window, report date and retest dates.

3. Method and coverage: test types, roles and credentials used, and exclusions.

4. Findings with severity rationale, affected assets and reproduction evidence.

5. Control references, with the statement of work saying who tags them: the tester, your team or the assessor.

6. A retest record per finding, which evidences remediation against 0709's risk-tiered timeframes and dates each fix for the 90-day clock under 11.2.8.

7. Named testers and an independence statement.

8. Permission to share the report with the assessor and HITRUST.

What health systems, payers and health IT vendors need from a testing vendor

• The whole assessment scope. A health system's r2 can span several hospitals, an Active Directory forest and device networks; a payer's, portals, claims APIs and cloud data platforms. One vendor across it gives the assessor one method, one severity scale and one retest record.

• Named testers and independence on paper, including, if your assessor's firm tests, confirmation that its testers did not implement or operate your controls in the prior 12 months (3.3.5).

• Dated retests, because v11.9 remediation turns on "risk-tiered remediation timeframes" and 11.2.8 restarts the clock for a remediated control.

• A model that fits the calendar. An r2 runs two years with an interim due within 90 days before the first anniversary (15.4.10), and 15.4.24 now lets an e1 or i1 for the same scope replace it where nothing significant has changed. A one-time annual test timed ahead of fieldwork suits most health systems and payers; vendors that ship weekly add continuous testing. Agree data handling terms, including a business associate agreement where counsel requires one, before testing systems that hold PHI.

How this ranking was built

This ranking is Stingrai's, not HITRUST's. Every vendor fact comes from the vendor's own site, HITRUST's directory or the CREST Marketplace, checked on 13 October 2026.

1. Penetration testing sold as a named service on the firm's own pages.

2. HITRUST position verified: External Assessor status read from HITRUST's directory, or an independent testing firm that is not on it.

3. Healthcare depth on the firm's own pages: healthcare-only focus, medical device testing or healthcare clients.

4. Tester signals: named certifications, team size and, where claimed, CREST accreditation on the Marketplace.

5. Delivery to US and Canadian buyers.

At a glance: the best HITRUST penetration testing companies

1. Stingrai (top rated independent testing firm for HITRUST programs)

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

In a HITRUST program, Stingrai is the testing firm in the three-party split: its penetration testers find and report, your team fixes, and the External Assessor you choose validates, receiving the report as direct testing evidence under 13.2.3. The CREST accreditation is held by Stingrai Inc, the entity that signs the contract (Marketplace profile), one of a handful of CREST-accredited firms headquartered in Canada, with a London, UK office and delivery across the US and Canada.

Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs, bug bounty Hall of Fame listings at Apple, Google, Facebook, Yahoo, the US Department of Defense, the US Federal Reserve, PaySafe and Zynga, and a founding member of Uber's offensive security team. Stingrai is rated 5.0 out of 5 on Clutch (20 reviews) and 4.9 out of 5 on G2.

• Health systems: external perimeter, remote access and vendor connections; internal networks and Active Directory, tracing paths toward EHR and clinical systems; clinical device network segmentation; Wi-Fi; and phishing campaigns.

• Payers: member, provider and broker portals tested role by role for broken authorization and IDOR on member and claim identifiers (web applications and APIs), eligibility and claims APIs, mobile apps and the cloud accounts behind them.

• Health IT vendors and business associates: tenant isolation across every role, FHIR and other REST or GraphQL APIs, AWS, Azure and Google Cloud identities, and AI and LLM features when the AI Security Certification is in scope.

Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept, and pushed to Jira or Slack. The redactable PDF report carries a methodology and coverage statement and reproduction evidence per finding, retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your HITRUST, HIPAA and SOC 2 programs.

Snipe, Stingrai's autonomous AI agent, covers web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity reports and Stingrai's testers' methodology, it hunts IDOR and broken authorization, weaknesses that HITRUST's v11.9 secure coding requirement covers under "access control", as well as business logic flaws, and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together throughout, with the testers directing its focus.

Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). Other scopes are quoted through get a quote. Best for: health systems, payers and health IT vendors that want an independent, CREST-accredited testing firm on the testing side of a HITRUST split, one-time or continuous.

2. Coalfire

Coalfire's contact page gives a Chicago mailing address, its 2026 releases describe it as "headquartered in Chicago, Ill.", and its Dakin Fund page says Rick Dakin "co-founded a cybersecurity company, Coalfire, in 2001". It is an External Assessor in HITRUST's directory, and its HITRUST page cites "more than 35 certified HITRUST CSF practitioners". Testing sits with Coalfire DivisionHex, which runs "From red teaming and social engineering to threat-informed penetration testing" (offensive security, pen testing). Its CREST Marketplace entry, Coalfire Systems, lists Penetration Testing with a United Kingdom head office, so confirm which entity delivers your test.

Best for: enterprises that want HITRUST assessment and offensive testing from one firm, with written confirmation that its testers did not implement or operate your controls in the prior 12 months (3.3.5).

3. NetSPI

NetSPI lists Minneapolis as its headquarters and Toronto among its offices (contact), and its home page dates it to 2001, with "350+ experts, and 50+ pentesting services". It is not in HITRUST's directory, so, like Stingrai, it is an independent testing option. Its Marketplace entry lists Penetration Testing and Threat Led Penetration Testing after 10 years and cites work for "four of the five largest healthcare companies". NetSPI and Synack "have officially closed their merger" (merger page), with existing engagements unchanged.

Best for: large health systems and payers that want an independent testing firm with a large in-house team and a PTaaS platform.

4. Clearwater

Clearwater is based in Nashville; its company overview says it was "founded by healthcare security expert Bob Chaput" in 2009, acquired CynergisTek and TECH LOCK in 2022 and was "named 2026 Best in KLAS for Security and Privacy Consulting Services". It is an External Assessor in HITRUST's directory. Its technical testing page promises "comprehensive manual testing" across internal and external tests, "Assume Breach Internal Penetration Testing (Cloud and On-Premise)", web, mobile and API testing, wireless, and a "Medical Device Lifecycle Security Assessment".

Best for: health systems and digital health companies that want healthcare-only testing, including medical devices, from a firm that also runs HITRUST assessments.

5. Meditology Services

Meditology lists its headquarters in Atlanta (contact) and describes consulting "exclusively for healthcare organizations". It is an External Assessor in HITRUST's directory, and its HITRUST page says its Managing Partner, Cliff Baker, "served as the lead architect for HITRUST CSF". Its network penetration testing page covers internal, external, wireless, physical, scenario-based and red team testing, "IoT and Medical Device Security Testing" and "Penetration Testing as a Service"; its associates' certifications include OSCP and CISSP.

Best for: providers and payers that want a healthcare-only firm with deep HITRUST history for testing and assessment.

6. Schellman

Schellman lists a Tampa, Florida address and says it "began as a SOC audit firm 20+ years ago". It is an External Assessor in HITRUST's directory, and its HITRUST page is plain about roles: "While Schellman does not issue the report, involvement with the Client does not end until the final report has been posted by HITRUST." On its penetration testing page, "all penetration testers have background checks performed" and "a Penetration Tester will perform your assessment, hands-on-keyboard", across application, network, cloud, red team and Active Directory work. The CREST accreditation sits with Schellman Compliance LLC, the brand's non-attest entity.

Best for: organizations that combine HITRUST with SOC 2, PCI DSS or FedRAMP and want CREST-accredited testing in the same firm.

7. Tevora

An August 2026 Tevora release describes the firm as "Founded in 2003" and "Based in Irvine, CA". It is an External Assessor in HITRUST's directory, and its HITRUST page notes that its Healthcare Practice Manager "is a former member of the HITRUST External Assessor Council". Its CREST page states "Tevora is CREST-accredited for our expert Pen Testing services", confirmed by its Marketplace entry, Tevora Business Solutions Inc. Its penetration testing page adds device testing including medical devices, social engineering and AI application testing.

Best for: CISOs at mid-market and enterprise organizations who want HITRUST assessment and CREST-accredited testing from a consultancy built around the CISO.

8. A-LIGN

A-LIGN gives its headquarters as Tampa (contact). Its HITRUST page says it "is a HITRUST-authorized External Assessor Organization that has completed more than 1,400 HITRUST assessments", and HITRUST's directory lists it. Its penetration testing page cites "OSCP/OSCE/OSEE-certified testers, 4,600+ completed engagements", maps findings "to MITRE ATT&CK tactics and techniques", and addresses independence directly: testing is "handled by two separate, independent teams" from the audit.

Best for: organizations that run HITRUST, SOC 2 and penetration testing through one audit firm that keeps its testing and audit teams separate.

9. Optiv

Optiv lists its corporate headquarters in Leawood, Kansas (contact) and says it is "Backed by KKR" (about). A 27 October 2016 release announced that it "received HITRUST CSF Assessor status", and HITRUST's directory still lists it as an External Assessor. A 2 October 2025 release announced CREST accreditation, and its Marketplace entry, Optiv Services LLC, lists Penetration Testing. Its attack and penetration page says "Our penetration testing services serve 64% of the Fortune 500".

Best for: large enterprises that already use Optiv and want CREST-accredited testing and HITRUST assessment from the same partner.

10. NCC Group

NCC Group says it was "Founded in 1999" (about), with its global headquarters in Manchester, UK, a regional headquarters in Chicago and an office in Waterloo, Ontario (offices). It is an External Assessor in HITRUST's directory, and its HITRUST guide refers to "External Assessors like NCC Group". Its Marketplace entry holds ten CREST accreditations after 19 years, including Penetration Testing and Threat Led Penetration Testing, and its penetration testing page runs "from traditional penetration testing engagements to Continuous Penetration Testing".

Best for: multinational healthcare and life sciences groups that want a HITRUST External Assessor with CREST threat-led testing credentials in North America and the UK.

Also considered

Four more External Assessors in HITRUST's directory sell penetration testing: Prescient Security in Nashville, whose Marketplace entry lists Penetration Testing after 9 years; Intraprise Health in Reston, Virginia, "the first 100% healthcare-focused HITRUST assessor" by its own description; risk3sixty, accredited by CREST for Penetration Testing; and BARR Advisory, which offers manual web application and network testing.

What a HITRUST penetration test costs

HITRUST publishes no testing prices, and the External Assessor's fee and the MyCSF subscription are separate costs; our requirements guide derives scope-by-scope ranges from published day rates. Stingrai's Autonomous Pentest is US$3,000 per assessment and its Hybrid Pentest is US$6,800 per assessment, each covering one web application and associated APIs, or US$650 and US$1,275 per month on a 12-month plan (pricing); other scopes are quoted. For benchmarks, see the penetration testing cost guide and the pentest cost calculator.

RFP questions for a HITRUST penetration test

• [ ] Name the assessment (e1, i1 or r2, plus AI Security if in scope) and attach the r2 scoping output or in-scope system list.

• [ ] Ask whether the vendor is a HITRUST External Assessor, check the directory, and decide whether testing and validation should come from different firms.

• [ ] If the vendor is also your assessor, get confirmation that its testers did not implement or operate your controls in the prior 12 months (3.3.5).

• [ ] Ask for named testers, their certifications, and the CREST Marketplace profile if accreditation is claimed.

• [ ] Require a scope statement, test dates, method and coverage, and per-finding reproduction evidence.

• [ ] Agree who maps findings to HITRUST control references.

• [ ] Include dated retests, timed to clear the 90-day incubation period before fieldwork.

• [ ] Confirm you may upload the report to MyCSF and share it with HITRUST.

• [ ] For AI systems, ask for AI red teaming or penetration testing covering poisoning, model inversion and goal override.

The penetration testing RFP template turns these into a document vendors can answer.

Frequently Asked Questions

Who are the best penetration testing companies for a HITRUST assessment in 2026?

The best HITRUST penetration testing companies in 2026 are Stingrai, Coalfire, NetSPI, Clearwater, Meditology Services, Schellman, Tevora, A-LIGN, Optiv and NCC Group. For a health IT vendor or business associate pursuing an r2 with a multi-tenant web application, Stingrai is the strongest fit: an independent, CREST-accredited testing firm whose named penetration testers test every role and API, retest, and deliver a report the External Assessor can use as direct testing evidence, one-time or continuous.

Does HITRUST require a penetration test?

No public HITRUST page sets a penetration testing requirement or frequency for the e1, i1 or r2; the full CSF requirement library sits behind a download form and in MyCSF. The Assessment Handbook version 1.2 names penetration testing twice: criterion 3.3.6 lets assessor personnel perform it, and criterion 13.2.3 treats the report as direct testing evidence. The public cadence is for scanning, "annually at minimum". The exception is the AI Security Certification's requirement 07.06hAISecOrganizational.1, which asks for security assessments of the AI system, such as AI red teaming or penetration testing, at least annually.

Can our HITRUST External Assessor also perform our penetration test?

Yes, within limits. Criterion 3.3.6 permits assessor personnel to perform penetration testing, excluding remediation that involves implementing or operating a control, and criterion 3.3.5 requires a separate team if the firm's personnel implemented or operated the assessed controls in the prior 12 months. Many organizations still use an independent testing firm so the evidence and the validation come from different firms.

What is the difference between a HITRUST External Assessor and a penetration testing firm?

An External Assessor is an organization HITRUST has approved through an application process, with at least five CCSFPs and two CHQPs, and only External Assessors can perform the validated assessments submitted to HITRUST for certification. A penetration testing firm performs the test and writes the report the assessor examines as direct testing evidence. Some firms are both; check assessor claims on HITRUST's directory.

When should we schedule the penetration test before HITRUST fieldwork?

About six months before fieldwork. Criterion 11.2.8 requires controls, including remediated ones, to operate for 90 days before they can be tested as implemented, and the assessor's testing runs in a 90-day window that ends when management signs the representation letter (11.2.5). Test, remediate, retest, then freeze technical change.

Does the HITRUST AI Security Certification require penetration testing?

It requires security assessments of the AI system and names penetration testing as an example. Requirement 07.06hAISecOrganizational.1 calls for security assessments "(e.g., AI red teaming, penetration testing)" that consider AI-specific threats such as poisoning, model inversion and, since CSF v11.9.0, goal override, before new models deploy and "regularly (at least annually) thereafter".

How much does a penetration test for HITRUST cost?

HITRUST publishes no testing prices, and the External Assessor's fee and the MyCSF subscription are separate. Stingrai's Autonomous Pentest is US$3,000 per assessment and its Hybrid Pentest is US$6,800 per assessment, each covering one web application and associated APIs; other scopes are quoted.

Related reading

• HITRUST Penetration Testing Requirements: r2 vs i1 vs e1, Scope, Frequency

• HIPAA Penetration Testing Requirements (2026)

• Best Penetration Testing Companies for HIPAA and Healthcare (2026)

• Best Healthcare Penetration Testing Companies (2026)

• Best Healthtech Penetration Testing Companies (2026)

• Pentest Evidence Auditors Accept: SOC 2, ISO 27001, PCI DSS and CMMC

References

1. HITRUST, The HITRUST Assessment Handbook, Version 1.2. https://hitrustalliance.net/hubfs/Website/PDF%20Downloads/Final%20-%20HITRUST%20Assessment%20Handbook%20v1.2.pdf

2. HITRUST, HAA 2026-001: Assessment Handbook v1.2 Release, 13 January 2026. https://hitrustalliance.net/advisories/haa-2026-001

3. HITRUST, HAA 2026-005: CSF Version 11.9.0 Release, 24 September 2026. https://hitrustalliance.net/advisories/haa-2026-005-csf-version-11.9.0-release

4. HITRUST, HITRUST CSF v11.9 e1 and i1 Baseline Change FAQ. https://hitrustalliance.net/hubfs/CSF/CSF%20v11.9/HITRUST-CSF-v11.9-e1-i1-Baseline-Change-FAQ.pdf

5. HITRUST, v11.9.0 Summary of Changes: Difference Comparison for CSF v11.8.0 to v11.9.0, pages 78 to 79. https://hitrustalliance.net/hubfs/CSF/CSF%20v11.9/CSF%20Comparison%20Between%20v11.8.0%20to%20v11.9.0.pdf

6. HITRUST, HAA 2026-006: CSF v11.8 Creation Deadline for e1 and i1 Assessments, 24 September 2026. https://hitrustalliance.net/advisories/haa-2026-006-csf-v11.8-creation-deadline-for-e1-and-i1-assessments

7. HITRUST, HITRUST AI Security Assessment and Certification Specification. https://hitrustalliance.net/help/ai-sec-assessment

8. HITRUST, Find an External Assessor or Readiness Licensee, read 13 October 2026. https://hitrustalliance.net/find-an-external-assessor

9. HITRUST, HITRUST e1 Assessment. https://hitrustalliance.net/assessments-and-certifications/e1

10. HITRUST, HITRUST CSF Assurance Program Requirements, Appendix A, October 2019 (CSF v9.3 control references). https://hitrustalliance.net/hubfs/CSF-Assurance-Program-Requirements.pdf

11. CREST Marketplace supplier profiles linked in each entry, opened 13 October 2026. https://marketplace.crest.org/

12. Vendor HITRUST, testing, about and contact pages linked in each entry, fetched 13 October 2026.

13. Stingrai, Pricing. https://www.stingrai.io/pricing

Talk to Stingrai

For the e1, i1 and r2 baselines no public HITRUST page sets a penetration testing cadence (AI systems under the AI Security add-on need an assessment at least annually), so the cadence comes from your risk assessment and the evidence standard from your External Assessor. Stingrai's part is the test: two named penetration testers across your assessment scope, every confirmed finding on the PTaaS platform the same day, dated retests, and an attestation letter with every human-led and hybrid report, as a one-time annual test timed ahead of fieldwork or a continuous program. Book a free scoping call, get a quote for a multi-entity scope, or read the published packages on the pricing page.