Best Network Penetration Testing Companies (2026): External, Internal and Active Directory

Exploitation of vulnerabilities is now the most common way into a breach: Verizon's 2026 Data Breach Investigations Report puts it at 31% of initial access in this year's dataset, with credential abuse, the previous leader, down to 13%. What happens after the first foothold is an identity problem. Microsoft says that in more than 78% of the human-operated cyberattacks it has seen, the attackers breached a domain controller, and that in more than 35% of cases a domain controller was the device spreading ransomware at scale (Microsoft Security blog, 9 April 2025). A network penetration test measures both halves, the perimeter an attacker gets in through and the internal network and Active Directory they move across, and the firm that runs it decides whether the result is a proven attack path or a scanner export with a logo on it.

Stingrai's own engagement data shows how different the two halves are. In the State of Penetration Testing 2026 dataset, 55 penetration tests run between October 2024 and August 2026, internal network tests with findings returned a median of 11 findings per test with 92% rated High or Critical, against a median of 1 finding and 48% for external network tests. A clean external report says very little about what an attacker can do once inside.

Where Stingrai fits: Stingrai is a CREST-accredited penetration testing company, founded in Toronto in 2021. Network engagements are human-led by two named penetration testers from a team holding OSCE³, OSEP, CRTO, CREST CRT and CISSP certifications, and every report is reviewed by the team lead and an engagement partner. One engagement can cover the external perimeter, the internal network, Active Directory attack paths, segmentation and Wi-Fi, with findings posted to the PTaaS portal as they are confirmed, retesting included and an attestation letter with every human-led network engagement, as a one-time annual test or a continuous program. Network, Active Directory and wireless work is scoped and quoted per engagement as a fixed price; there is no package price, and Stingrai's network penetration testing page gives a typical range of US$5,000 to US$40,000 and above for a network penetration test. Snipe, Stingrai's autonomous AI agent, tests web applications and associated APIs and is not used for network testing.

Quick answer: who are the best network penetration testing companies in 2026?

The best network penetration testing companies in 2026 are Stingrai, Schellman, Raxis, NetSPI, NCC Group, TrustedSec, GuidePoint Security, Sprocket Security, Bishop Fox, Black Hills Information Security and Rapid7. Stingrai, which publishes this guide, lists itself first: named, certified penetration testers test the perimeter, the internal network, Active Directory, segmentation and Wi-Fi in one engagement, with retesting and an attestation letter included, one-time or continuous. Schellman and Raxis follow because they put the most in writing about a scoped engagement: Schellman publishes minimum prices, an included retest and a kickoff call that introduces the assigned testers, and Raxis a shipped test device, the same engineer from scoping to retest and an included retest. Sprocket Security sells continuous testing by subscription and is the better fit for a team that wants testing all year.

This page compares providers across the whole network scope. If the purchase is only internal and Active Directory testing, use the internal network and Active Directory ranking. For scope, delivery models, timelines and cost in depth, the network penetration testing guide is the companion to this ranking, and Stingrai's own offer is on the internal and external network penetration testing service page.

What a network penetration test must cover

A quote that says "network penetration test" can mean a two-day perimeter check or a four-week exercise that ends at domain administrator. Fix the scope before comparing prices. There are five areas, and each one has its own starting position and its own evidence.

External perimeter

NIST's SP 800-115, the technical guide to security testing, defines the external half: "External security testing is conducted from outside the organization's security perimeter," a view of the environment "usually as seen from the Internet." PCI DSS v4.0.1 uses the same boundary: external penetration testing "means testing the exposed external perimeter of trusted networks, and critical systems connected to or accessible to public network infrastructures."

In practice the scope is every internet-facing host and service the organization owns, including the ones nobody remembers: VPN and remote access gateways, firewalls and other edge appliances, mail and DNS, exposed management interfaces, cloud-hosted perimeter assets and login portals. Testers check whether exposed software can be exploited, whether a password attack against remote access succeeds, and whether what they find leads inward. The external penetration testing guide covers the scope line by line, and the top 10 network security vulnerabilities lists what attackers exploited on the perimeter this year.

Internal network

For the internal half, SP 800-115 says assessors "work from the internal network and assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses," and notes that testers "are often granted some level of access to the network, normally as general users." PCI DSS defines internal penetration testing as "testing from both inside the CDE and into the CDE from trusted and untrusted internal networks."

The internal scope is the estate behind the firewall: workstations, servers, network devices and their management planes, file shares, internal applications and the protocols that carry credentials between them. A good internal test starts from a stated position, usually an ordinary domain account or a device plugged into a user network, and reports how far that position reaches. The internal penetration testing guide and the internal versus external comparison go deeper.

Active Directory

In a Windows estate the internal test becomes an identity test within hours, which is why the Microsoft figures above matter for scoping. Active Directory coverage should be written into the statement of work by name: service accounts whose passwords can be recovered offline, permissions and delegation that let a low-privileged account change a privileged one, certificate services, Group Policy, trusts and the Tier 0 boundary. Ask whether paths are proven hop by hop or only listed as configuration observations. The Active Directory penetration testing guide sets out the scope layers, and Kerberoasting explained covers one of the first checks any internal test runs.

Segmentation

Segmentation testing proves that a network the organization calls isolated really is. PCI DSS v4.0.1 requires it wherever segmentation is used to isolate the cardholder data environment (Requirement 11.4.5), and its guidance gives the reason: "Many attacks have involved the attacker moving laterally from what an entity deemed an isolated network into the CDE." The evidence is a source-to-destination matrix: every out-of-scope segment tested, the method used from each, and the result against the written policy. The same test applies to any zone that matters, such as backup, hypervisor management, plant networks or a guest network.

Wireless, as an add-on

Wireless is usually priced separately because it needs a radio within range of each site. Scope it when corporate Wi-Fi authenticates against the directory, when guest and corporate networks share infrastructure, or when a rule or customer asks for it. Testers check for weak pre-shared keys, clients that will join a fake access point, and whether a guest network can reach internal systems. The WiFi penetration testing guide and the evil twin attack explainer cover method and fixes.

What Stingrai's data says network tests find

The first-party numbers explain why internal and external testing should be bought together and budgeted differently. In Stingrai's dataset, the eight internal network tests with findings produced 408 findings, a median of 11 per test, and 92% of them were High or Critical. The six external network tests with findings produced 23, a median of 1 per test, with 48% High or Critical. Outdated or unpatched software made up 56.9% of internal network findings, followed by misconfiguration and hardening at 11.8%.

Two buying consequences follow. First, most of the severe findings sit inside, so an external-only purchase leaves the larger risk unmeasured. Second, an internal test that returns a long list of missing patches has done only the first part of the job: the value is in showing which of those weaknesses chain into control of the domain, and that depends on the people doing the testing.

What the rules ask of a network test

Two rules name both halves of a network test outright. The PCI DSS guide and the NYDFS guide cover them in full; the operative text is short.

PCI DSS guidance also settles an argument that comes up in every procurement: "Scanning for vulnerabilities alone is not a penetration test," and "Penetration testing is a highly manual process." A proposal built on scanner output does not meet the standard's own description of the work.

How network penetration testing providers differ: ten things to check

Most providers publish the same promises. These ten points are where they differ in ways a procurement or security team can verify before signing.

1. Published scope for each half of the test

Read the provider's own external, internal and wireless pages. A firm that publishes what its internal test covers, by name, can be held to it; a single generic penetration testing page leaves the scope to the statement of work. Either can deliver good work, but the second needs a tighter contract.

2. Active Directory and segmentation depth

Ask how many testing days go to the identity layer and whether paths are proven or listed. Several firms sell a separate Active Directory configuration review alongside the internal test; that is a different product from a tester walking a path from an ordinary account to domain administrator. For PCI scopes, ask to see a redacted segmentation result.

3. Firm-level accreditation

Individual certifications describe testers; accreditation describes the firm. The CREST Marketplace lists accredited firms with the accreditations each holds and the legal entity that holds them, so check the entity that will sign your contract. PCI DSS guidance treats credentials as an indicator, not proof: considerations when choosing a tester include "Specific penetration testing certifications, which may be an indication of the tester's skill level and competence" and prior experience, including "the type and scope of prior engagements."

4. Named testers, and who retests

Ask for the names and certifications of the people who will test before you sign, whether they are employees or subcontractors, and whether the same people will run the retest. A network test depends on judgment about what to chain and what to leave alone in production, and that judgment belongs to individuals. Many firms publish consultant biographies; what matters in a contract is whether the people assigned to your engagement are named.

5. Manual depth versus autonomous tooling

Autonomous network testing tools are useful for baselining many similar networks quickly, and some providers now sell tiers built on them. PCI DSS still describes penetration testing as "a highly manual process," so ask what share of the engagement is manual, what the tool is, and which findings a person confirmed. A hybrid tier is a reasonable purchase when it is priced and reported as one.

6. How testers reach the internal network

Internal testing used to mean consultants on site. Several providers now ship a device or deploy a virtual machine that connects back to their testers, which removes travel from multi-site work. The access model changes what can be tested, so settle it at scoping. The comparison below is our own summary of the three models.

Whichever model is used, segmentation testing needs a position on each segment being tested, and wireless testing needs a radio within range.

7. Retest terms

PCI DSS 11.4.4 requires testing to be repeated to verify corrections, so the retest is part of the purchase. Check that it is included, how long the retest window stays open, and whether it re-walks each proven path or only re-scans.

8. Reporting and delivery platform

A network report should contain an executive summary, scope and coverage, findings with reproduction evidence and affected hosts, an attack path narrative, segmentation results where tested, and dated retest results. Ask whether findings arrive during the test through a portal, whether they can be pushed into your ticketing system, and whether you can talk to the testers while they work. Ask for a redacted sample report before signing.

9. One-time and continuous options

An annual test meets most rules. Estates that change every month, or that carry PCI DSS obligations to retest after significant change, often add testing between annual engagements. Check that the provider can do both and that continuous does not mean scanning. The continuous penetration testing guide explains the difference.

10. Pricing transparency and independence

Few providers publish network prices, because host counts, sites and Active Directory size drive the effort; the ones that do publish minimums are noted below. Ask for a fixed price against a written scope with the retest included. PCI DSS also requires organizational independence of the tester, so if the provider is also your assessor, your managed service provider or the reseller of the tools being tested, get the separation in writing.

How we ranked them

Eleven firms were assessed against the ten points above, using only what each firm publishes on its own site and what the CREST Marketplace lists. Every provider page was read on 13 November 2026, and CREST Marketplace listings and searches were run the same day.

The at-a-glance table lists what each firm states in writing on six checkable points: a CREST Marketplace listing, published network testing pages, whether the firm says the testers assigned to an engagement are named, a stated internal access model, stated retest terms and published network pricing. It draws on service pages, linked methodology documents and process articles. The remaining points (Active Directory and segmentation depth, manual depth, reporting, and one-time and continuous options) are described in each entry.

The order is Stingrai's editorial judgement of fit for a mid-market or enterprise buyer commissioning a scoped external and internal network penetration test with Active Directory in scope. It is not a points total, and it does not follow the table line by line. Stingrai publishes this guide and lists itself first. Some firms, including Sprocket Security and Schellman, state as many of the six points in writing as Stingrai does, and on price Schellman publishes minimums and Sprocket Security package prices where Stingrai publishes a typical range, so weigh the table for yourself. Each entry has a line on which buyer the firm fits.

1. Published network testing scope on the firm's own site: external, internal and wireless pages.

2. Active Directory and segmentation named in the internal scope.

3. Firm-level accreditation on the CREST Marketplace.

4. Named testers: whether the firm says the people assigned to your engagement are named.

5. Manual depth and how any autonomous tooling is described.

6. Internal access model stated: on-site, shipped device or remote.

7. Retest terms stated in writing.

8. Reporting and delivery platform.

9. One-time and continuous options.

10. Pricing transparency.

The 11 companies at a glance

"Not stated" means the firm's own pages read for this ranking, including service pages, linked methodology documents and process articles, do not say. "No listing found" means a search of the CREST Marketplace on 13 November 2026 returned no entry for the firm. Several firms publish consultant biographies; the "Assigned testers named" column records only whether a firm says the testers assigned to an engagement are named. Ask for each point in writing.

1. Stingrai

Stingrai is a CREST-accredited penetration testing company, accredited for both Penetration Testing and AI-Enabled Penetration Testing, offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters, with OSCE³, OSWE, OSEP and CREST CRT certifications across the team. Founded in Toronto, Canada in 2021, it is trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA, with engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

What a security or IT lead can check. The firm-level accreditation is on the CREST Marketplace supplier page for Stingrai Inc, separate from the CREST CRT certifications individual testers hold. Stingrai's network testing page says every network engagement is human-led by two named penetration testers from a team holding OSCE³, OSEP, CRTO, CREST CRT and CISSP certifications, and that every report is reviewed by the team lead, who has 16 years in penetration testing, red teaming and exploit development, and an engagement partner. Stingrai's researchers have published 18 CVEs, and the firm is rated 5.0 out of 5 across 20 reviews on Clutch.

How the network is tested. External testing starts black-box from the public internet with no credentials and covers internet-facing hosts and forgotten assets, VPN, remote access and edge appliances, mail, DNS and exposed management interfaces. Internal testing usually starts from an assumed-breach position, a standard domain account or a network drop, on-site or through remote access, and covers credential relay and name resolution poisoning, vulnerable internal services, and lateral movement between hosts and VLANs. The Active Directory assessment starts from an ordinary domain user and reports every path proved, with the object and attribute behind each hop, across Kerberoasting and AS-REP roasting, delegation and ACL abuse, certificate services, Group Policy, trusts and Tier 0 exposure. Segmentation testing proves that out-of-scope networks cannot reach protected zones, including the PCI cardholder data environment. The Wi-Fi security assessment runs on-site where scoped, or remotely through a pre-configured device shipped to each location. Exploitation is controlled and non-destructive, the work follows PTES and NIST SP 800-115 with paths described in MITRE ATT&CK terms, and every artifact is removed when testing ends. StingAD, the team's open-source Active Directory assessment toolkit, supports the identity work.

Evidence and delivery. Findings post to the PTaaS portal as they are confirmed, each with reproduction evidence, affected hosts, severity and remediation guidance, with direct chat to the assigned penetration testers and Jira, Slack and GitHub integration. The report is a redactable PDF with an executive summary, scope and coverage, an attack path narrative showing how access moved from the first foothold toward domain administrator, and segmentation results where tested. Retesting of fixed findings is included in every engagement, on-call remediation support is available while fixes are made, and an attestation letter stating scope and testing dates is issued with every human-led network engagement. Stingrai runs both one-time annual engagements timed to a PCI DSS or audit cycle and continuous programs.

Where Snipe fits. Snipe, Stingrai's autonomous AI penetration testing agent, tests web applications and associated APIs. It does not test networks: external, internal, Active Directory, segmentation and wireless work is done by penetration testers. Where an internal web application is in scope, a Hybrid engagement has Snipe and penetration testers testing together throughout.

Pricing: Stingrai's network penetration testing page says a network penetration test typically costs US$5,000 to US$40,000 and above. That is a typical range across external and internal network testing, not a package price: network, Active Directory and wireless engagements are scoped and quoted per engagement as a fixed price through get a quote, with pricing returned within 24 hours and the retest included. The published packages on the pricing page cover one web application and associated APIs.

Fit for this buyer: Stingrai publishes this guide and lists itself first. One named team covers the perimeter, the internal network, Active Directory, segmentation and Wi-Fi in a single scoped engagement, with the retest and an attestation letter included. On price it publishes a typical range, so a fixed price needs scoping, and some firms, including Sprocket Security and Schellman, state as many of the six points in writing. Strength: one team of named, certified penetration testers across the perimeter, the internal network, Active Directory, segmentation and Wi-Fi, with accreditation, ratings and tester credentials that can be checked in public sources, and retesting and an attestation letter included. Limitation: multi-site on-site work needs scheduling lead time, and the published network figure is a typical range, so a fixed price needs a scoped quote. Best for: CREST-accredited, fully human-led network penetration testing by world-class security researchers and bug bounty hunters, for mid-market and enterprise organizations in the US and Canada that need external, internal and Active Directory testing with evidence for PCI DSS, NYDFS or audit programs, one-time or continuous.

2. Schellman

Schellman gives a Tampa, Florida address and is among the most specific firms here about method, duration and price. Its internal network page describes two attack scenarios: a "Rogue Device Plugged Into Your Corporate Network," for which "We will provide you with a Schellman-controlled device for you to plug into your network," and a "Low-Privileged Employee," where testers "attempt to escalate privileges, pivot through your network, and compromise the entire domain," using Active Directory attacks among other techniques. The same page states a minimum price, "no less than $14,500 for an internal network penetration test," and durations from one week for small environments to four or more weeks for large ones. Its external network page gives the same US$14,500 minimum, and the wireless page gives US$13,000, with a shipped device, a laptop or an on-site tester. A free sample report is offered, and its penetration testing page says "all penetration testers have background checks performed." The CREST accreditation, for Penetration Testing with two years of membership, sits with Schellman Compliance LLC, one of the two entities that practice under the Schellman brand. Two articles linked from its service pages add the terms. What to expect from its penetration test team (last updated August 2025) says a retest is included, "a request to retest against all originally identified findings," that "none of your pen testers will be subcontracted," and that Schellman conducted "over 200 penetration tests" in the year before that update. Its project process article (last updated January 2025) gives a retest window of 30 to 45 days after the report, an optional one-page summary letter to share with customers, and a kickoff call about two weeks before testing "to introduce the pen testers assigned to the project."

Fit for this buyer: Schellman suits a buyer commissioning a scoped test who wants the terms settled before the first call: the method, the minimum price, the retest window and when the assigned testers are introduced are all in writing. Strength: published minimum prices, durations, an included retest with a stated window, a sample report and a stated remote access method for internal and wireless testing. Limitation: Schellman also runs audit and certification practices under the same brand, so if it is your assessor too, agree in writing how the testing team is separated from the assessment team. Best for: buyers who want to see the price floor, the method and a sample report before the first call.

3. Raxis

Raxis lists 2870 Peachtree Road in Atlanta and describes "Manual penetration testing by senior U.S. engineers since 2011." Its internal network page covers Active Directory attack paths, lateral movement and escalation, credential attacks and network segmentation, including whether PCI cardholder data environments "are truly isolated." It is plain about remote delivery: "We ship you a Transporter, a small device that plugs into your network and connects securely back to our engineers," with one device per site. The page also commits on staffing and retesting: "The pentester on your scope call is the one breaking in, and the one retesting your fix," with an included retest "at no extra cost" and an attestation letter. External and wireless tests are published on the same pattern, and each can be bought as a point-in-time test or as penetration testing as a service, with findings in its Raxis One portal. Its external page says "Prices start around $3,500 and can range into the six figures for a very large scope"; internal and wireless prices are not published. A search of the CREST Marketplace on 13 November 2026 returned no entry for Raxis.

Fit for this buyer: Raxis suits a mid-market buyer with several sites: its scoped internal test names Active Directory attack paths and segmentation, and the access device, the tester and the included retest are stated in writing. Strength: a stated remote internal access model, the same engineer from scoping to retest, and an included retest and attestation letter. Limitation: no CREST Marketplace listing found, so buyers whose customers or regulators ask for CREST accreditation should confirm it with the firm. Best for: mid-market organizations with several sites that want manual internal testing without travel.

4. NetSPI

NetSPI is headquartered in Minneapolis and publishes the most complete set of network testing pages in this ranking. Its network penetration testing page covers internal, external, wireless, mainframe and virtual desktop testing. The internal network page lists segmentation testing for PCI DSS compliance, offline password auditing of AD accounts, system and domain-level privilege escalation and Active Directory vulnerabilities, built on NIST SP 800-53, PCI DSS, OWASP Top 10 and MITRE ATT&CK. The external network page says its testing "enumerates your exposures, identifies critical vulnerabilities, and exploits them," and the wireless page covers enterprise SSIDs, guest networks and IoT segments, including rogue access point and evil twin scenarios. Continuous internal and external testing are offered, with findings delivered through a centralized platform, and the site describes "350+ pentesters" who are "Employed, not outsourced." CREST lists Penetration Testing and Threat Led Penetration Testing with 10 years of membership. NetSPI and Synack announced a definitive agreement to merge on 2 September 2026, and NetSPI's site says the merger "officially closed in October 2026." The same page says testing cadence, scope, platform access and points of contact stay the same for existing engagements, and describes "350+ NetSPI in-house pentesters and 1,500+ vetted Synack Red Team researchers" as "two different delivery models rather than one larger pool." Its PTaaS page lists remediation testing without setting out the terms. Whether the testers assigned to an engagement are named in advance, the internal access model and pricing are not stated.

Fit for this buyer: NetSPI suits an enterprise that runs many scoped network tests a year: its pages name PCI segmentation testing and Active Directory password auditing in the internal scope, and the same platform carries one-time and continuous work. Strength: published scope for every part of a network test, including PCI segmentation and AD password auditing, one-time or continuous, on one platform with an in-house bench. Limitation: Active Directory coverage sits inside a broader internal test, so ask how many days go to the identity layer, and, with the Synack merger closed in October 2026, ask which delivery model will staff your test and write staff continuity and pricing into the contract. Best for: enterprises running many network tests a year that want one platform for external, internal and wireless work.

5. NCC Group

NCC Group lists its global headquarters in Manchester, England, a North American regional headquarters in Chicago and an office in Waterloo, Ontario. Its network penetration testing page addresses "external or internal vulnerabilities" and sells four tiers: autonomous vulnerability discovery, autonomous penetration testing, hybrid penetration testing and manual penetration testing, the last described as "Best for organizations with a more mature cyber security program needing a white-glove approach." The autonomous and hybrid tiers run on its partner Horizon3.ai's NodeZero platform. A published fleet case study shows the hybrid model at scale: a global transportation operator where "Each vessel operated its own Active Directory environment," tested by combining NodeZero for a consistent baseline with manual testing of bespoke systems. CREST lists the broadest accreditation set in this ranking, including Penetration Testing and Threat Led Penetration Testing, with 19 years of membership. A December 2022 article by its North America Technical Director sets out how internal tests are reached remotely: an "Onsite Network Implant" device, which the article says NCC Group has used since 2016, or its Firebase platform, in place of travel. Its process article describes returning to retest after fixes as frequent practice, without stating terms. Whether the testers assigned to an engagement are named in advance and pricing are not stated.

Fit for this buyer: NCC Group suits an organization with many sites or isolated networks: the tiered model gives a baseline everywhere, the manual tier adds depth, and its remote access method is published. Strength: a tiered model that covers many separate networks consistently, backed by the widest CREST accreditation set here and offices in Chicago and Waterloo. Limitation: two of the four tiers are autonomous and a third is a hybrid built on the same platform, so name the manual tier and the Active Directory scope in the statement of work, and confirm which legal entity contracts for North American work. Best for: organizations with many sites, subsidiaries or isolated networks that need a baseline everywhere and manual depth where it matters.

6. TrustedSec

TrustedSec operates from 3485 Southwestern Boulevard in Fairlawn, Ohio. Its penetration testing page describes a process that runs from discovery and scoping through exploitation to validation testing: "After you've addressed identified vulnerabilities, we retest to confirm they've been successfully mitigated." The network evidence sits beside it. Its Active Directory Security Assessment is delivered by Microsoft Certified Masters and consultants who "identify critical misconfigurations and privilege escalation paths, mapping them to real-world attacker techniques documented in the MITRE ATT&CK framework," and was "Recently enhanced through TrustedSec's acquisition of Trimarc Security." A published case study describes external and internal penetration tests of a company a retailer was about to acquire, which found critical vulnerabilities an earlier assessment had missed. TrustedSec is also a PCI Qualified Security Assessor Company, and its PCI page offers PCI penetration testing of the cardholder environment. CREST lists Penetration Testing and Cyber Advisory with two years of membership. A March 2020 article by its chief executive says "we have moved completely to full remote testing" through its TrustedSec Attack Platform, "Available in both a VM form and as a physical tool"; the statement dates from 2020, so confirm the current model at scoping. TrustedSec publishes its consultants' biographies on its team page; whether the testers assigned to an engagement are named in advance is not stated. Its enterprise guide publishes price ranges for a web application test and a red team engagement, not for network testing.

Fit for this buyer: TrustedSec suits a buyer who wants a scoped internal test paired with a specialist Active Directory assessment, and who is ready to set the network scope in the statement of work because there is no dedicated network page. Strength: retesting stated in writing, specialist Active Directory depth and published acquisition testing work. Limitation: there is no dedicated network testing page, so external, internal and segmentation scope has to be set in the statement of work; if TrustedSec is also your PCI assessor, agree how testers are separated from assessors. Best for: organizations that want an internal test paired with a specialist Active Directory assessment, or testing of an acquisition target before close.

7. GuidePoint Security

GuidePoint Security lists its headquarters at 1900 Reston Metro Plaza in Reston, Virginia. Its penetration testing page offers testing of "internal or external networks, applications, cloud, ICS, security awareness or facilities," says that "During traditional pen testing, we use automated tools to augment our consultants," and adds purple team and red team assessments. A separate penetration testing as a service offering "leverages machine learning and AI to focus on continuous controls validation" and "can be paired with an expert penetration tester to audit and validate the results." A separate wireless security assessment page describes analysis of wireless network traffic, "Validation of safeguards and procedures through penetration testing" and "a heat map showing your signal footprint," and a separate Active Directory security assessment audits the directory's services, settings and accounts. CREST lists Penetration Testing with three years of membership and a US SOC 2 Type 2 report. Whether the testers assigned to an engagement are named in advance, the internal access model, retest terms for network tests and pricing are not stated. Its enterprise penetration testing page says only that its cloud penetration test "Assesses and validates remediation".

Fit for this buyer: GuidePoint Security suits a US enterprise that already buys from it and wants network testing beside red and purple team work; its pages say less than the firms above about how a scoped network test is delivered. Strength: network testing from a large US security partner with red and purple teams and a SOC 2 Type 2 report on its CREST listing. Limitation: external and internal network scope is described in a sentence, not a published methodology, and its platform offering is built on automated testing, so specify the manual engagement in the statement of work. Best for: US enterprises that already buy from GuidePoint and want network testing beside red and purple team work.

8. Sprocket Security

Sprocket Security lists 821 E Washington Ave in Madison, Wisconsin and sells network testing as a continuous subscription; no page read offers a one-time scoped network test. Its internal testing page explains the access model, "A physical or virtual dropbox is deployed inside your environment," and names the attacks its testers run, including "kerberoasting, ADCS abuse, protocol abuse." Its pricing page is among the most open in this ranking: a Starter package at US$15,000 for continuous testing on up to 20 external hosts, internal network penetration testing as a US$13,000 add-on, and "unlimited retesting is included at no additional cost" (figures as published on 13 November 2026). The page does not print the billing period beside those figures, so confirm it. Sprocket describes "a subscription-based pricing model, giving you continuous testing throughout the year instead of paying per test engagement." CREST lists Penetration Testing with one year of membership. Its why Sprocket page says "a named penetration tester of our own chains exploits, validates impact, and signs off before anything reaches you" and describes "Our own testers who stay on your account." Its PCI DSS page says "Sprocket includes segmentation testing as a defined scope element for CDE environments."

Fit for this buyer: Sprocket Security sells network testing only as a continuous subscription, so it is the better fit for a team that wants testing all year than for a buyer commissioning a single scoped test. Its terms on access, retests, testers and entry prices are all in writing. Strength: published entry prices, unlimited retests, a named tester who signs off findings and a stated remote access model for continuous internal testing. Limitation: the offer is a continuous subscription, not a scoped one-time engagement, so a buyer who wants a single dated external and internal test should confirm how the subscription delivers it; Sprocket's PCI DSS page says segmentation testing is a defined scope element, and its home page offers attestation letters on demand. Best for: mid-market teams that want continuous external testing with an internal add-on at a known starting price.

9. Bishop Fox

Bishop Fox lists its global headquarters in Tempe, Arizona and describes itself as remote first. Its network penetration testing page splits the work into external and internal services. The internal page offers "zero, partial, or full knowledge security assessments" and a four-step process of network discovery, network service enumeration, vulnerability identification and vulnerability exploitation, and asks the question an internal test exists to answer: "do you know how far an onsite visitor could get if they plugged their laptop into the local network?" The external page adds the option of post-exploitation activity to show internal pathways at risk. CREST lists Penetration Testing with four years of membership and ISO 27001. Its published internal methodology (PDF dated January 2026) says internal tests "often include network and active directory enumeration, vulnerability scanning, local and active directory privilege escalation, lateral movement," that the client provides "Network access (VPN, physical access, etc.)" and that "Optional remediation testing" is available. Whether the testers assigned to an engagement are named in advance and pricing are not stated.

Fit for this buyer: Bishop Fox publishes full external and internal methodologies, including Active Directory enumeration and privilege escalation. Segmentation and wireless scope, prices and the naming of assigned testers are not on the pages read, and remediation testing is optional. Strength: separate, detailed external and internal services with a choice of knowledge levels and a documented internal process. Limitation: segmentation and wireless testing are not named on the pages read, and remediation testing is optional, so write all three into the scope. Best for: organizations that want to choose between zero, partial and full knowledge internal testing from a firm with two decades in offensive security.

10. Black Hills Information Security

Black Hills Information Security gives its address as 890 Lazelle Street in Sturgis, South Dakota. It is unusual in publishing its own engagement data: its 2025 findings report covers 853 tests over 15 months, with external network tests the most common service at 305 reports and internal network tests next at 200, and lists "SMB Signing Not Required" as a high finding in 138 reports and weak certificate services configurations as a critical finding in 52. Its penetration testing page says its testers manually confirm findings and report "as we go," with meetings from the rules of engagement call through mid-engagement updates, and John Strand's line on the services page sets the tone: "Testing should be cooperative, not adversarial." Its service guide (PDF dated December 2025) describes an assumed compromise test in which "BHIS receives credentials and access to a client system to test for privilege escalation, lateral movement, and data exposure," and lists "Remediation Validation (optional)." A search of the CREST Marketplace on 13 November 2026 returned no entry for the firm. It publishes its consultants' names and biographies; whether the testers assigned to an engagement are named in advance and pricing are not stated.

Fit for this buyer: Black Hills Information Security publishes its findings data and a service guide. Network scope by segment, prices and an included retest are not on the pages read, and no CREST Marketplace listing was found. Strength: a network-heavy practice that publishes what its tests find and explains its work as it goes. Limitation: no CREST Marketplace listing found, remediation validation is optional and no prices are published. Best for: security teams that want to learn from the testers during the engagement and value a firm that shows its data.

11. Rapid7

Rapid7 lists its global headquarters at 120 Causeway Street in Boston. Its penetration testing services page offers point-in-time network penetration testing, "external or internal," and wireless network penetration testing built on OSSTMM and PTES, and says testers "provide direct contributions to Rapid7's Metasploit Project" and spend "up to 20% of bench time focused on attacker research and skill development." A service brief still linked from that page, dated December 2019, says the team then conducted over 1,000 tests per year and described its methodology as "85% manual, 15% automated." For buyers who want testing between annual engagements, its continuous red team service has a Vector Command Advanced tier that "supports compliance with internal penetration and segmentation testing" and lists an annual internal penetration test. A search of the CREST Marketplace on 13 November 2026 returned no entry for Rapid7, and whether the testers assigned to an engagement are named in advance, the internal access model, retest terms and pricing are not stated.

Fit for this buyer: Rapid7's network scope is two lines on a general services page, its published practice figures date from 2019 and no CREST Marketplace listing was found. Of the firms compared, it states the least on the six points in the table. Strength: network and wireless tests from testers who contribute to Metasploit, a stated manual emphasis (2019 brief) and an annual internal test available inside a continuous red team tier. Limitation: no CREST Marketplace listing found, and if you run Rapid7's own detection or vulnerability products, agree how the test stays independent of the tools it is testing. Best for: organizations that want point-in-time external and internal tests from a US provider whose testers contribute to Metasploit, or an annual internal test inside a continuous red team subscription.

Firms considered and not ranked

Kroll's penetration testing page lists network penetration testing, external and internal, among its services (Internet Archive capture of 8 November 2026) without setting out the network scope; its CREST listing shows Penetration Testing, Incident Response and Security Operations Centre accreditations with eight years of membership. Coalfire's offensive security pages describe red teaming, social engineering and threat-informed penetration testing for PCI, HIPAA and FedRAMP programs without setting out network scope. Optiv's attack and penetration page says its penetration testing services "serve 64% of the Fortune 500" and links a targeted network penetration test brief, but describes network scope only in passing. SpecterOps, Mandiant and CrowdStrike are compared in the internal network and Active Directory ranking, where their identity work belongs. Horizon3.ai's NodeZero, the autonomous testing platform behind NCC Group's autonomous and hybrid tiers, is a product, not a testing firm; NCC Group pairs it with consultants. Finally, the managed service provider that runs your network should not be the firm that tests it.

How much does a network penetration test cost in 2026?

Network penetration testing is priced against scope. Stingrai's network penetration testing page says a network penetration test typically costs US$5,000 to US$40,000 and above, and that PCI DSS engagements that bundle internal, external and segmentation testing commonly land at US$12,000 to US$25,000. That is a typical range across external and internal network testing, not a package price: network, Active Directory and wireless engagements are scoped per engagement and quoted as a fixed price with the retest included, returned within 24 hours of a quote request. The published packages on the pricing page cover one web application and associated APIs only.

Six things set the number of testing days, and with it the price:

• Live hosts and IP ranges. The count of live internal and external addresses, not the size of the address space.

• Subnets, VLANs and sites. Each segment, site or data center adds discovery and pivoting time.

• Active Directory footprint. Domains, forests and trusts, and how deep the attack path testing goes.

• Starting positions. External only, internal from an assumed-breach account or device, or both.

• Segmentation testing. Each pair of segments to be proven isolated is a test of its own.

• Approach and delivery. Black, grey or white box, and remote or on-site testing.

A quote request gets a firm price back when it includes the external ranges and domains with an estimate of live hosts, the number of internal live hosts, subnets and sites, the number of domains and forests, the starting positions to be priced, whether segmentation and wireless are in scope and at how many sites, the access model, and any audit date the report has to meet.

Few firms publish network prices. Four of the ranked firms publish a figure, as read on their own pages on 13 November 2026. Stingrai's is a typical range across network scopes; Schellman's are minimums, Raxis's is a starting price and Sprocket Security's are package and add-on prices.

Field time is not calendar time. Stingrai's published timelines put an external-only test of a single entity with fewer than 50 live hosts at 3 to 5 tester days across one to two weeks, external plus internal testing of a single site and domain at one to two tester weeks across two to four weeks, and a PCI scope with segmentation at three to six weeks. Book ahead of any audit or board date the report has to meet. The penetration testing cost guide breaks the drivers down, and the cost calculator gives a starting figure.

Buyer checklist: ten questions for a network penetration testing RFP

Send these in writing and compare the answers side by side. The RFP question bank adds scored questions, and the statement of work template turns the answers into clauses.

1. Who exactly will test, can we see their names and certifications before we sign, are they employees, and will the same people run the retest?

2. Which legal entity holds your accreditation, and is it the entity that signs our contract? Check it on the CREST Marketplace.

3. What is in the external scope, and how do you find internet-facing assets we did not list?

4. Where does the internal test start? Price an ordinary domain account, a device on a user network and any untrusted segment as separate starting positions.

5. How do your testers reach our internal network: on site, through a device you ship, or through our remote access? Where does the device sit, what leaves through its tunnel, and how is it wiped?

6. How many days go to Active Directory, and are attack paths proven hop by hop or listed as configuration observations?

7. How will you test segmentation, from which segments, and what does one result look like?

8. What share of the test is manual, which autonomous tools do you use, and which findings does a person confirm?

9. Is retesting included, how long is the retest window, and does the retest re-walk each proven path?

10. What do we receive and when? Ask for a redacted sample report, findings during the test, an attack path narrative, and a letter an auditor, insurer or customer will accept.

Frequently Asked Questions

Who are the best network penetration testing companies in 2026?

The best network penetration testing companies in 2026 are Stingrai, Schellman, Raxis, NetSPI, NCC Group, TrustedSec, GuidePoint Security, Sprocket Security, Bishop Fox, Black Hills Information Security and Rapid7. Stingrai, which publishes this guide, lists itself first: a CREST-accredited penetration testing company whose network engagements are human-led by two named penetration testers from a team holding OSCE³, OSEP, CRTO, CREST CRT and CISSP certifications, covering the external perimeter, the internal network, Active Directory, segmentation and Wi-Fi, with retesting and an attestation letter included, one-time or continuous. The order is Stingrai's editorial judgement of fit for a buyer commissioning a scoped test; Schellman and Raxis follow because they put the most in writing about a scoped engagement, and some firms, including Sprocket Security and Schellman, state as many checkable points in writing as Stingrai does.

What should a network penetration test cover?

Five areas, each with its own starting position: the external perimeter from the public internet, the internal network from a standard account or a device on a user network, Active Directory from an ordinary domain user, segmentation from each out-of-scope segment, and wireless as an add-on from within radio range of each site. PCI DSS v4.0.1 Requirement 11.4.1 expects a methodology that includes testing from both inside and outside the network, testing to validate segmentation controls and network-layer penetration tests.

How do I choose a network penetration testing company?

Check ten things before signing: published scope for external and internal testing, Active Directory and segmentation depth, firm-level accreditation on the CREST Marketplace, whether the testers assigned to your engagement are named and who retests, how much of the work is manual, how testers reach the internal network, retest terms, reporting and delivery platform, one-time and continuous options, and pricing transparency with independence from your assessor and managed service provider. Ask for a redacted sample report and a fixed price against a written scope.

What is the difference between external and internal network penetration testing?

External testing starts from the public internet with no credentials and measures what an outside attacker can reach and exploit: exposed services, VPN and edge appliances, mail, DNS and management interfaces. Internal testing starts inside the network, usually from a standard domain account or a device on a user network, and measures how far one foothold spreads. In Stingrai's own data, among tests with findings, internal network tests returned a median of 11 findings with 92% rated High or Critical, against a median of 1 finding for external tests.

Can an internal network penetration test be done remotely?

Yes. Several providers ship a small device or deploy a virtual machine that sits on the internal network and connects back to their testers, and others test through the client's own remote access. The access model changes what can be tested: segmentation testing needs a position on each segment being tested, wireless testing needs a radio within range of the site, and a routed VPN is not the same position as a device on a user network. Settle the model, where the device sits and how it is wiped at scoping.

Does PCI DSS require external, internal and segmentation penetration testing?

Yes. PCI DSS v4.0.1 Requirement 11.4.2 requires internal penetration testing and 11.4.3 requires external penetration testing, each at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified tester with organizational independence. Where segmentation is used to isolate the cardholder data environment, 11.4.5 requires penetration tests on the segmentation controls at least once every 12 months and after changes, and 11.4.6 shortens that to every six months for service providers. Requirement 11.4.4 requires testing to be repeated to verify corrections.

Is Active Directory testing part of a network penetration test?

It should be, wherever the internal scope is domain-joined, but providers differ on depth. Some include Active Directory attack paths in the internal test; others sell a separate Active Directory configuration review. Write the identity scope into the statement of work by name, including service accounts, permissions and delegation, certificate services, Group Policy and trusts, and ask whether paths from an ordinary account to control of the directory are proven hop by hop or only listed.

How much does a network penetration test cost in 2026?

Network penetration testing is priced against scope. Stingrai's network penetration testing page says a network penetration test typically costs US$5,000 to US$40,000 and above, and that PCI DSS engagements that bundle internal, external and segmentation testing commonly land at US$12,000 to US$25,000. That is a typical range across external and internal network testing, not a package price: network, Active Directory and wireless engagements are scoped per engagement and quoted as a fixed price with the retest included. The price follows the number of live hosts, subnets and sites, the size of Active Directory, the starting positions, segmentation testing and whether testing is remote or on-site. Among the other ranked firms, as read on 13 November 2026, Schellman publishes minimums of US$14,500 for an internal or an external network test, Raxis says external test prices start around US$3,500, and Sprocket Security publishes a US$15,000 Starter package for continuous external testing.

Does a network penetration test include wireless testing?

Usually as an add-on. Wireless testing needs a radio within range of each site, so it is scoped per location and per network name. Add it when corporate Wi-Fi authenticates against the directory, when guest and corporate networks share infrastructure, or when a rule or customer asks for it. Stingrai runs Wi-Fi security assessments on-site where scoped, or remotely through a pre-configured device shipped to each location.

Related reading

• Network Penetration Testing: What It Is, Types, Process and Cost (2026)

• Best Internal Network and Active Directory Penetration Testing Companies (2026)

• External Penetration Testing (2026): What an External Pen Test Covers, Scope and Cost

• Internal Penetration Testing (2026): Scope, Delivery, Cost Drivers and Requirements

• Internal vs External Penetration Testing: Differences, Scope and Cost (2026)

• Active Directory Penetration Testing Services (2026): Scope, Attack Paths and Cost

• WiFi Penetration Testing (2026): Wireless Security Assessment Scope, Cost and Methodology

• Top 10 Network Security Vulnerabilities to Watch in 2026

• Kerberoasting Explained: How the Attack Works, Detection and Fixes (2026)

• Password Spraying: How the Attack Works, Detection and Defense (2026)

• PCI DSS Penetration Testing: Requirement 11.4 Explained (2026)

• Best Enterprise Penetration Testing Companies (2026)

• Best Penetration Testing Companies for Mid-Market Companies (2026)

• Best Adversary Simulation and Red Teaming Companies in 2026: 12 Providers Compared

• The State of Penetration Testing 2026: An Analysis of 1,206 Verified Findings

Ready to scope a network penetration test?

The breach that ends in a ransom note rarely starts at a domain controller. It starts at an unpatched gateway, a password that worked on the VPN, or a segment that was never as isolated as the diagram claimed, and it runs through the internal network to the directory. Stingrai is a CREST-accredited penetration testing company whose two named penetration testers test that whole route: the external perimeter, the internal network, Active Directory, segmentation and Wi-Fi, with retesting and an attestation letter included, as a one-time annual engagement or a continuous program. Explore internal and external network penetration testing and the Active Directory security assessment, book a discovery call, or get a quote for your ranges, sites and domains, with pricing returned within 24 hours.