On 27 January 2026 the Cloud Security Alliance released version 4.1 of its CAIQ, the security questionnaire clients send to the consulting and professional services firms that hold their data, and its only penetration testing question, TVM-07.1, asks whether processes are "defined, implemented, and evaluated for the periodic performance of penetration testing by independent third parties" (CSA). Answering yes, with evidence, takes an independent penetration test.
This guide is for firms that buy a penetration test, not firms that sell one: management, IT, engineering and advisory consultancies, agencies and outsourcers of roughly 200 to 20,000 people that run client portals, file shares, data rooms and Microsoft 365 or Google Workspace tenants full of client material. Law firms and accounting firms face their own rules, covered in our law firm ranking and our accounting and CPA firm ranking. Sector rules also reach consultants through their clients, from HIPAA's business associate definition to DFARS flow-down clauses and OSFI's Guideline B-10.
Quick answer. The best penetration testing companies for consulting and professional services firms in 2026 are Stingrai, Sprocket Security, NCC Group, Cobalt, Schellman, TrustedSec, NetSPI, Coalfire, Pen Test Partners and Praetorian. Stingrai ranks first and is the only firm of the ten that met all seven criteria checked on each firm's own pages on 21 October 2026: two named penetration testers on every human-led engagement, a signed attestation letter that clients can file, retesting, ISO 27001 and SOC 2 evidence, social engineering, CMMC coverage and published work for a professional services client, as a one-time annual test or a continuous program. Sprocket Security, second, offers an attestation letter on demand and unlimited retests, and NCC Group, third, publishes a sector page for consultancies, law firms and accountancies.
Figure 1: What client questionnaires and rules say about penetration testing for consulting and professional services firms, read on 21 October 2026. Source: each owner's own text, linked in the sections below.
What drives a penetration test at a consulting or professional services firm
Few of these texts name a penetration test. Most require testing, evaluation or assurance, and a client's security reviewer turns that into a request for an independent test report. The chart above summarizes each one; the quotes below come from each owner's own publication.
Client security questionnaires: CAIQ and SIG
The CAIQ v4.1.0 workbook has 283 yes-or-no questions, and TVM-07.1 is the only one that names penetration testing; in CAIQ v4.0.3 the same question was TVM-06.1 (CSA bundle and change analysis). CSA's auditing guidelines for the matching control, TVM-07, check whether "the process for defining frequency of penetration testing is defined" and whether "the process for selection of independent third parties is defined, and evaluated". CSA maps TVM-07 to requirement 3.12.1 of NIST SP 800-171 rev. 2 with no gap, which matters for consultants that also hold defense work. Six related questions, from TVM-03.1 (vulnerability detection "at least monthly") to A&A-02.1 (independent assessments "at least annually"), are mapped to their evidence after the regulations below.
Shared Assessments' Standardized Information Gathering (SIG) questionnaire is the other common client questionnaire. Its pages sat behind a Microsoft Entra sign-in check when we looked on 21 October 2026, so we quote no SIG question; check the penetration testing items in your licensed copy.
ISO/IEC 27001:2022 Annex A (A.8.8 and A.8.29)
ISO/IEC 27001:2022 carries a reference set of 93 controls in 4 clauses, down from 114 in 14, mirroring ISO/IEC 27002:2022 (IAF MD 26). The two that penetration testing evidence maps to most directly are A.8.8, on managing technical vulnerabilities, and A.8.29, on security testing in development and acceptance. ENISA's mapping table for the NIS2 implementing rules ties "Security testing" to A.8.29, A.8.33 and A.8.34, and "Vulnerability handling and disclosure" to A.8.8 (ENISA mapping table v1.2).
ENISA's guidance for those same measures lists penetration test reports as evidence. For security testing it suggests a "List of reports from past security tests" covering "vulnerability assessments, penetration testing and code reviews", and for vulnerability handling it lists "Reports from third-party security assessments or penetration tests" (ENISA technical implementation guidance, sections 6.5.2 and 6.10.2). ISO sells the control text, and its preview pages sat behind a bot check when we looked, so we describe the controls rather than quote them; our ISO 27001 requirements guide covers what a certification audit asks for.
SOC 2: CC4.1 and CC7.1 in the 2022 points of focus
The AICPA's 2022 point of focus for CC4.1 says that, depending on the entity's objectives, "such risk and control evaluations may include first- and second-line monitoring and control testing, internal audit assessments, compliance assessments, resilience assessments, vulnerability scans, security assessment, penetration testing, and third-party assessments" (AICPA red-lined criteria, page 32). The criteria add that their use "does not require an assessment of whether each point of focus is addressed" (page 5).
CC7.1 asks the entity to use "detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities", and its point of focus names "infrastructure and software vulnerability scans", not penetration tests (pages 41 and 42). Two COSO points of focus under CC4.1 explain why the tester matters: "Uses Knowledgeable Personnel" and "Objectively Evaluates" (pages 31 and 32). Our SOC 2 guide covers timing inside the observation period.
Government consultants: DFARS 252.204-7012 and CMMC
Clause 252.204-7012 says "The Contractor shall provide adequate security on all covered contractor information systems", subjects them to NIST SP 800-171, defines rapid reporting as "within 72 hours of discovery of any cyber incident", and requires the clause in subcontracts "for which subcontract performance will involve covered defense information" (eCFR, 48 CFR 252.204-7012). A consultancy that receives covered defense information from a prime contractor inherits the clause.
CMMC Level 2 requirements are "identical to the requirements in NIST SP 800-171 R2", and in the CMMC rule's own text the only requirement that names penetration testing is Level 3's CA.L3-3.12.1e: "Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts" (eCFR, 32 CFR 170.14).
Phase 2, in which DoD intended to add Level 2 assessments by a third-party assessor (C3PAO) as a condition of award in applicable contracts, was due to begin one calendar year after Phase 1 (32 CFR 170.3). On 13 July 2026 the Department of War Chief Information Officer suspended "the November 2026 CMMC Phase 2 transition", and Class Deviation 2026-O0025 Revision 3 of 3 September 2026, still current on the DFARS deviations page updated 8 October 2026, permits "CMMC Level 1 (Self) or Level 2 (Self) assessments" and requires "baseline compliance with NIST SP 800-171 Rev 2 in accordance with the clause at DFARS 252.204-7012" (class deviation). See our CMMC ranking for defense suppliers.
Firms serving Canadian banks and insurers: OSFI B-10
OSFI's Third-Party Risk Management Guideline lists "use of independent professional consultants" among third-party arrangements. Its due diligence examples include the third party's capacity to "manage technology and cyber risks in accordance with the expectations outlined in OSFI's Guideline B-13" and the "Strength of the third party's information security programs". Under Principle 8 the institution "should also have the right to conduct or commission an independent audit of a third party", using methods such as "independent reports provided by third parties".
B-10 does not use the words penetration test. Guideline B-13 does, in section 3.1.2: institutions "should also regularly perform tests and exercises, to identify vulnerabilities or control gaps in its cyber security programs (e.g., penetration testing and red teaming)". Because B-10's due diligence measures a third party against B-13's expectations, a consultancy serving a bank or insurer may be asked for that kind of evidence (OSFI B-13 guide).
Healthcare clients: HIPAA business associates
Under 45 CFR 160.103, a business associate includes a person who provides "legal, actuarial, accounting, consulting, data aggregation ..., management, administrative, accreditation, or financial services" to a covered entity where the work involves protected health information. Section 164.302 applies the Security Rule to business associates, 164.308(a)(8) requires "a periodic technical and nontechnical evaluation" without naming a test, and 164.314 requires business associate contracts to bind the consultant to the rule and to incident reporting.
The January 2025 proposal would add "penetration testing of the covered entity's or business associate's relevant electronic information systems by a qualified person" at least once every 12 months, and would require covered entities to obtain written verification from each business associate "at least once every 12 months" (90 FR 898, at 1016 and 1019). On 21 October 2026 it was still a proposal, listed among long-term actions with final action dated 07/00/2027 (Unified Agenda). See our HIPAA requirements guide.
EU clients: GDPR Articles 28 and 32
A consultancy processing personal data on behalf of an EU client acts as its processor, and Article 28(3)(h) requires a processor to "allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller". Article 32(1)(d) requires "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures" (Regulation (EU) 2016/679; GDPR Article 32 guide).
What clients ask for, and the evidence that answers it
Figure 2: Seven CAIQ v4.1 questions a client security review sends, and the evidence that answers them (evidence column is Stingrai's guidance). Source: Cloud Security Alliance, CAIQ v4.1.0.
Read beside TVM-07.1, six other CAIQ v4.1 questions shape how a reviewer reads a test report. AIS-07.1 asks whether application vulnerabilities are "remediated following defined processes", TVM-09.1 whether remediation is "prioritized using a risk-based method", and TVM-11.1 whether remediation is tracked and reported with "stakeholder notification". A report with a stated severity method, a retest report and a letter confirming scope, dates and results answers most of them (how a pentest unblocks a security review).
What mid-market and enterprise consulting firms need from a vendor
Scope that follows client data. Client portals and extranets, file sharing and data rooms, Microsoft 365 or Google Workspace tenants, VPN and remote access, the internal network and Active Directory, cloud accounts, and the staff who handle client files and invoices.
A letter clients can file. A letter confirming scope, dates, method and retest results answers TVM-07.1 without sending the findings themselves.
Named, credentialed testers. CC4.1's "Uses Knowledgeable Personnel" point of focus and CSA's check on how "independent third parties" are selected both turn on who did the work.
Independence. A test from the firm that also audits your SOC 2 report or certifies your ISO 27001 system needs an independence check, and a vendor whose advisory arm competes for your clients deserves a conflict check.
A retest. TVM-11.1 asks how remediation is tracked and reported; a dated retest report is the proof.
Data handling. Test accounts instead of real client records, encrypted evidence storage, and confidentiality terms that cover your clients' information.
The contracting entity. CREST accreditation is held per legal entity; check the entity that signs on the CREST Marketplace (how to check).
How this ranking was built
We checked ten candidate firms on their own websites and on the CREST Marketplace on 21 October 2026: Stingrai and nine CREST-accredited testing firms with offices in the United States or Canada. We did not consider accounting and consulting networks that hold CREST accreditation but also sell management, financial or technology consulting, such as the Big Four, because many readers compete with their advisory practices for clients.
Four gates applied to every candidate, pass or fail, and all ten passed:
A named penetration testing service on the firm's own site.
A professional services or enterprise client page on the firm's own site: a sector page, a customer story or a client statement.
CREST Penetration Testing accreditation on the CREST Marketplace.
An office in the United States or Canada.
Seven criteria were then scored, each counted only when the firm's own pages state it:
Named testers: named testers assigned to each engagement.
Client letter: a letter for third parties, such as an attestation, summary or engagement summary letter.
Retest: a page for one of its testing services says fixed findings are retested or validated.
ISO 27001 or SOC 2: its pages connect its penetration testing to ISO 27001 or SOC 2 evidence.
People testing: phishing or social engineering testing is offered.
Government contracts: CMMC, NIST SP 800-171 or FedRAMP is named among the requirements its services support.
Professional services work: a sector page or customer story describes security work for a consultancy, agency, law, accounting, audit or engineering firm.
Firms are ordered first by the number of criteria met, then by longer CREST membership, then by the larger CREST-listed headcount band, then alphabetically. "No" means the pages we read do not say it, not that the firm does not do it.
Firm | Named testers | Client letter | Retest | ISO 27001 or SOC 2 | People testing | Government contracts | Professional services work | Met |
|---|---|---|---|---|---|---|---|---|
Stingrai | Yes | Yes | Yes | Yes | Yes | Yes | Yes | 7 |
Sprocket Security | No | Yes | Yes | Yes | Yes | Yes | Yes | 6 |
NCC Group | No | No | Yes | Yes | Yes | Yes | Yes | 5 |
Cobalt | No | Yes | Yes | Yes | Yes | No | Yes | 5 |
Schellman | No | No | Yes | No | Yes | Yes | Yes | 4 |
TrustedSec | No | No | Yes | Yes | Yes | Yes | No | 4 |
NetSPI | No | No | Yes | Yes | Yes | No | No | 3 |
Coalfire | No | No | No | No | Yes | Yes | Yes | 3 |
Pen Test Partners | No | No | Yes | No | Yes | No | No | 2 |
Praetorian | No | Yes | Yes | No | No | No | No | 2 |
Ties were settled on CREST membership: NCC Group (19 years) ahead of Cobalt (8), Schellman ahead of TrustedSec (2 years each, Schellman's larger headcount band first), NetSPI (10) ahead of Coalfire (7), and Pen Test Partners (17) ahead of Praetorian (2).
At a glance: penetration testing companies for consulting and professional services firms
Rank | Firm | Office on its own site | Criteria met | Best for |
|---|---|---|---|---|
1 | Stingrai | Toronto, Canada (head office); London, UK | 7 of 7 | Named testers, an attestation letter and published prices, one-time or continuous |
2 | Sprocket Security | Madison, Wisconsin, US | 6 of 7 | Continuous testing with letters on demand |
3 | NCC Group | Manchester, UK; Chicago; Waterloo, Ontario | 5 of 7 | A sector practice for professional services |
4 | Cobalt | Boston, US | 5 of 7 | Platform testing on credits with letters of attestation |
5 | Schellman | Tampa, Florida, US | 4 of 7 | Testing from an IT audit firm that sells no other consulting |
6 | TrustedSec | Fairlawn, Ohio, US | 4 of 7 | Consultant-led tests with a retest and SOC 2 focus |
7 | NetSPI | Minneapolis, US; Toronto | 3 of 7 | Programs for SOC 2 service organizations |
8 | Coalfire | Chicago, US | 3 of 7 | Testing beside FedRAMP and CMMC assessment work |
9 | Pen Test Partners | Buckingham, UK; New York | 2 of 7 | Physical and social engineering beside technical tests |
10 | Praetorian | Austin, Texas, US | 2 of 7 | An engagement summary letter for clients |
1. Stingrai (top rated for consulting and professional services firms)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified penetration testers, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a consultancy, the case is evidence its clients can check. Stingrai Inc, the company that signs the contract, holds CREST Penetration Testing accreditation (Marketplace profile) and is one of four of the 550 Marketplace suppliers with a Canadian head office as of 21 October 2026. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with every finding reviewed by the team lead and an engagement partner (PTaaS), and the team has 18 published CVEs. Its published case study with a Toronto forensic engineering company covered internal, network and web penetration tests in December 2025; the client's IT manager wrote that Stingrai "found vulnerabilities that even our team and vulnerability management systems missed".
Scope for a consulting or professional services firm
Client-facing applications: web application and API testing across every user role, for broken authorization, IDOR and business logic in client portals, document sharing and approval flows.
Infrastructure: the external and internal network, Active Directory, VPN and remote access, and cloud tenants.
People: phishing campaigns and social engineering aimed at the staff who handle client files, invoices and password resets.
Delivery and evidence
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance. Retesting is included, and every human-led and hybrid report ships with an attestation letter and a verified badge. The home page describes "a signed attestation letter confirming scope, methodology and retest results", meant to be shared "with auditors and customers": pentest evidence for your SOC 2, ISO 27001, HIPAA and PCI DSS programs and for your clients' security reviews.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity disclosure reports and Stingrai's penetration testers' methodology, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together throughout. Everything else is human-led.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). A full firm scope is quoted through Get a Quote. Best for: consultancies and agencies that want named, certified penetration testers at a CREST-accredited firm, a letter their clients can file, and a choice of one-time annual tests or continuous programs.
2. Sprocket Security
Sprocket Security lists its address in Madison, Wisconsin (contact) and sells continuous penetration testing, with single tests on request: "We offer all of our services ad hoc tailored just for you" (timeboxed services). Its compliance page says "Pull an attestation letter whenever you need one", its SOC 2 and ISO 27001 pages include unlimited retests, its web application testing covers "authentication, authorization, and business logic workflows" and lists CMMC among supported requirements, and it runs social engineering campaigns. A success story covers a marketing agency, which it calls "a dynamic and integrated marketing services platform". Best for: agencies and consultancies that want continuous testing and a letter on demand for each client review.
3. NCC Group
NCC Group, "Founded in 1999", names Manchester as its global headquarters and Chicago as its regional headquarters, with an office in Waterloo, Ontario (offices). Its legal and professional services page lists "penetration testing for law firms, audit agencies, consultancies, estate agencies, accountancies, and other professional services" and support for ISO 27001, FedRAMP and CMMC requirements. Its penetration testing page ties testing to ISO 27001, its continuous testing includes "retesting post remediation", and it runs social engineering simulations of phishing, vishing and smishing. CREST has listed it for 19 years. Best for: larger consultancies that want a firm with a professional services sector practice and offices in the US and Canada.
4. Cobalt
Cobalt lists its US headquarters, Cobalt Labs Inc., at One Boston Place in Boston (contact); its CREST entry, Cobalt Labs, gives a German head office, so confirm the contracting entity. Its platform generates reports "mapped to SOC 2, ISO 27001, HIPAA, and PCI-DSS" with "letters of attestation and executive summaries", its pricing page describes credits worth 8 hours of testing and "unlimited on-demand retesting", and its digital risk assessment page describes a social engineering test of employees. A customer story covers "a leading national audit, tax, consulting, and wealth management firm". Best for: firms with several client-facing applications that want release-paced tests bought on credits.
5. Schellman
Schellman lists its address in Tampa, Florida, calls itself "the only Top 50 CPA firm focused exclusively on IT Compliance and Cybersecurity" and says "there are no upsells of other consulting services or financial audits" (about). It is a FedRAMP 3PAO and a CMMC C3PAO, sells social engineering campaigns, and its secure code review ends with a retest. Its case studies include a consulting firm of over 10,000 staff that added SOC 2 to its SOC 1 examination and then built an ISO 27001 program, and a national law firm's ISO 27001 certification audit. If Schellman also audits your SOC 2 report or certifies your ISO 27001 system, confirm independence before it tests the same controls. Best for: firms that want testing from an IT audit specialist that does not compete in consulting.
6. TrustedSec
TrustedSec was "Founded by innovator David Kennedy in 2012", lists an address in Fairlawn, Ohio, and says it is "trusted by Fortune 500s, government entities, and hackers" (about). Its penetration testing names SOC 2 among the requirements it supports and includes "Validation Testing", a retest after fixes. It runs social engineering assessments, including email phishing, and as a "CMMC Registered Practitioner Organization" it helps government contractors with NIST SP 800-171. Best for: consultancies that want consultant-led testing with a retest in the base engagement.
7. NetSPI
NetSPI is headquartered in Minneapolis with an office in Toronto (contact), and its merger with Synack "officially closed in October 2026" (NetSPI; see our NetSPI alternatives guide). Its web application testing includes "Access control verification across user roles", it lists remediation testing on its PTaaS platform, and it runs social engineering tests by email, phone and on site. A customer story describes NetSPI as "an integral part of our annual process of going through the SOC 2 attestation". Best for: service organizations that renew a SOC 2 report every year.
8. Coalfire
Coalfire lists its address in Chicago (contact). Its DivisionHex offensive security practice runs "red teaming and social engineering to threat-informed penetration testing", aligned with "PCI, HIPAA, or FedRAMP", and its application security assessments cover "Bypassing authentication and authorization". Coalfire also sells CMMC services and SOC examinations through an affiliate. A case study describes a global technology consultancy that sought "more continuous and automated penetration testing". Best for: consultancies with FedRAMP or CMMC programs that want testing from an assessment firm.
9. Pen Test Partners
Pen Test Partners lists its UK office in Buckingham and a US office at 115 Broadway in New York (contact), and CREST has listed it for 17 years. Its CHECK penetration testing scope includes "Retesting and remediation validation", and its physical security testing includes social engineering. Its case studies describe NIS and CAA ASSURE work for aviation clients. Best for: firms with offices and data centres that want physical and social engineering tests next to technical ones.
10. Praetorian
Praetorian gives a mailing address in Austin, Texas (privacy policy) and cites "Decades of adversarial experience across the Fortune 500" (penetration testing). Its application penetration testing lists an "Engagement Summary Letter" among deliverables, and its team will "re-test, and verify vulnerabilities are closed", for "a single assessment or a continuous testing program". Best for: firms that need a summary letter for enterprise clients.
What a penetration test for a consulting firm costs
No rule sets a price. Cost follows the applications, users and roles, networks, offices, cloud tenants and people in scope, plus the retest. Published figures are few: Stingrai's fixed packages are the Autonomous Pentest at US$3,000 and the Hybrid Pentest at US$6,800 per assessment, each for one web application and associated APIs (pricing); Schellman says to expect "no less than $30,000" for an authenticated web application test and "no less than $14,500" for an internal network test or a social engineering campaign; and Cobalt sells credits, each "the equivalent of 8 hours of offensive security testing". Our cost calculator turns a scope into an estimate, and our cost guide explains how to compare quotes.
RFP questions for a consulting firm's penetration test
[ ] Which client-facing applications, file-sharing services and tenants are in scope, and is every user role tested?
[ ] Will you test the staff who handle client files, invoices and password resets?
[ ] Which legal entity signs, which holds the CREST accreditation, and who are the named testers?
[ ] Is a retest included, and will you issue a letter we can give clients that confirms scope, dates and results?
[ ] How will you handle our clients' data during the test, and where is evidence stored?
[ ] Does your firm, or an affiliate, audit our SOC 2 report, certify our ISO 27001 system or compete for our clients?
Our RFP template turns these into a document.
Frequently Asked Questions
Who are the best penetration testing companies for consulting and professional services firms in 2026?
The best penetration testing companies for consulting and professional services firms in 2026 are Stingrai, Sprocket Security, NCC Group, Cobalt, Schellman, TrustedSec, NetSPI, Coalfire, Pen Test Partners and Praetorian. Stingrai ranks first as the only firm that met all seven criteria checked on each firm's own pages on 21 October 2026, including two named penetration testers on every human-led engagement and a signed attestation letter that clients can file.
Which ISO 27001 controls does a penetration test support?
Mainly A.8.8, on managing technical vulnerabilities, and A.8.29, on security testing in development and acceptance. ENISA's mapping table ties security testing to A.8.29 and vulnerability handling to A.8.8, and its guidance lists reports from penetration tests among the examples of evidence for both.
Does SOC 2 require a penetration test?
No. The AICPA's 2022 point of focus for CC4.1 says evaluations "may include" penetration testing, CC7.1's point of focus names vulnerability scans, and the criteria do not require each point of focus to be assessed. Client questionnaires such as the CAIQ ask about penetration testing separately.
What does the CAIQ ask about penetration testing?
CAIQ v4.1, released on 27 January 2026, asks in TVM-07.1 whether processes are defined, implemented and evaluated for the periodic performance of penetration testing by independent third parties. It is the only one of its 283 questions that names penetration testing.
Do government consultants need penetration testing under DFARS or CMMC?
DFARS 252.204-7012 requires adequate security under NIST SP 800-171 and flows to subcontracts that involve covered defense information, but it does not name a test. In the CMMC rule, only Level 3 requirement CA.L3-3.12.1e requires penetration testing at least annually, and the November 2026 Phase 2 transition was suspended on 13 July 2026.
Are consultants that serve Canadian banks covered by OSFI B-10?
Yes, as third parties. OSFI's Guideline B-10 lists "use of independent professional consultants" among third-party arrangements and expects institutions to assess a third party's information security program and its capacity to manage technology and cyber risks under Guideline B-13, which names penetration testing and red teaming as examples of regular tests.
Is a consulting firm a HIPAA business associate?
It can be. The definition in 45 CFR 160.103 names consulting and management services when the work involves protected health information, and business associates must meet the Security Rule, including a periodic evaluation. A proposal to require penetration testing every 12 months was still a long-term action on 21 October 2026.
How much does a penetration test for a consulting firm cost?
No rule sets a price. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs, Schellman publishes a floor of US$30,000 for an authenticated web application test, and a full firm scope is quoted.
Related reading
Best Penetration Testing Companies for Accounting and CPA Firms (2026)
How a Penetration Test Unblocks an Enterprise Security Review
Best Penetration Testing Companies for MSPs and MSSPs (2026)
References
Cloud Security Alliance. Cloud Controls Matrix and CAIQ v4.1. 27 January 2026. https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1.
Shared Assessments. SIG Questionnaire. https://sharedassessments.org/sig/. Behind a sign-in check on 21 October 2026.
International Accreditation Forum. IAF MD 26:2023. https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf.
ENISA. Technical Implementation Guidance, version 1.0, and mapping table, version 1.2. 2025. https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf.
AICPA. 2017 Trust Services Criteria (With Revised Points of Focus, 2022), red-lined. https://assets.ctfassets.net/rb9cdnjh59cm/2sK6Ih6dzy6t7aU6RQvoeD/d97a2a14609e74a1af1ce9ab0b142b69/92317096_trust_services_criteria_red-lined_version.pdf.
eCFR. 48 CFR 252.204-7012 (MAY 2024). https://www.ecfr.gov/current/title-48/section-252.204-7012.
eCFR. 32 CFR 170.3 and 170.14, CMMC Program. https://www.ecfr.gov/current/title-32/section-170.14.
Department of War. Class Deviation 2026-O0025, Revision 3. 3 September 2026. https://www.acq.osd.mil/dpap/dars/classdev/DFARS_RFO/Part-240/2026-O0025_Rev3_TAB_A_Deviation_Memo.pdf.
OSFI. Guideline B-10, Third-Party Risk Management. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline.
OSFI. Guideline B-13, Technology and Cyber Risk Management. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-risk-management.
eCFR. 45 CFR 160.103, 164.302, 164.308 and 164.314. https://www.ecfr.gov/current/title-45/section-160.103.
HHS. HIPAA Security Rule proposed rule, 90 FR 898. 6 January 2025. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information.
Office of Information and Regulatory Affairs. 2026 Unified Agenda, RIN 0945-AA22. https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22.
European Union. Regulation (EU) 2016/679, Articles 28 and 32. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679.
CREST. CREST Marketplace directory and profiles, and each firm's own pages linked in its entry, read 21 October 2026. https://marketplace.crest.org/.
Talk to Stingrai
Bring your largest client's security questionnaire and your last report. Stingrai will scope your applications, network, cloud tenants and people, name the penetration testers, retest the fixes and close human-led and hybrid engagements with an attestation letter, as a one-time annual test or a continuous program. Get a quote or book a free discovery call.
