Bugcrowd publishes penetration testing prices and HackerOne does not. Bugcrowd's AWS Marketplace listing lists Standard Pen Test units at US$5,000 small, US$8,000 medium and US$15,000 large for web applications, US$5,000 for a cloud configuration test, and US$8,000 or US$13,000 for a mobile app on one or two platforms, all sold on a 12-month contract, with the listing stating plainly that "Pricing for Standard Pen Tests and Basic VDP plans are shown in Pricing Information below." HackerOne publishes no penetration testing figure anywhere: hackerone.com/pricing redirects to the platform overview, and the H1 Pentest page routes to a contact form.
That asymmetry is the first thing to know, and it is not the whole comparison. This is a direct head-to-head written from each company's own current pages, fetched and checked on 5 September 2026. Where a figure is not published, this post says "not published" rather than estimating it. It also sets out a third option at the end, because neither of these platforms is the only shape a penetration test can take.
Where Stingrai fits: Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. Stingrai is the third option compared here, and it is the in-house one. Its CREST accreditation sits at firm level rather than being a tester-level request on an upgrade tier. Every human-led engagement is staffed by a named two-person tester team, reviewed by the team lead and an engagement partner, so the same people return each cycle; their credentials also include OSED, OSCP and CRTO, the team has published 18 CVEs, and the senior bench includes a founding member of Uber's offensive security team and researchers in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve. Web and API testing is authenticated across every user role and aimed at broken authorization, IDOR and business logic; mobile, AI and LLM, cloud, network, Active Directory, social engineering and red team scopes are available from the same team, one-time or continuous. Published pricing is US$3,000 Autonomous and US$6,800 Hybrid for one web application and associated APIs (pricing); every other scope is quoted.
TL;DR: the decision in one table
If this is you | Pick | Why |
|---|---|---|
You need a number you can put in a purchase order this week | Bugcrowd | Standard Pen Test units are listed publicly on AWS Marketplace from US$5,000 |
You already run a HackerOne bug bounty and want testing on the same platform | HackerOne | H1 Pentest, H1 Bounty, H1 Response and H1 Code share one platform and one Hai layer |
Your remediation runs long and you want retesting to outlast the engagement | Bugcrowd | Web app, network and API tests include 12 months of retesting with one report update |
You want AI agents scaling reconnaissance across a large, changing attack surface | HackerOne | H1 Agentic Pentest is built for exactly that, with humans retaining oversight |
You need CREST-certified testers named in the scope | Bugcrowd | CREST certification is an explicit Plus-tier tester requirement you can request |
You want a fixed price with the scope written on the page before you talk to anyone | Stingrai | US$3,000 Autonomous and US$6,800 Hybrid, each covering one web application and associated APIs |
The bugs that matter are IDOR, business logic and broken authorization in one authenticated app | Stingrai | Snipe is built for those classes, and on a Hybrid engagement named penetration testers test at the same time and steer it |
You want fixes to arrive as pull requests and vulnerable code blocked at merge | Stingrai | AutoFix pull requests and pull request gating; neither platform publishes an equivalent |
You want the same testers on your application every cycle | Stingrai | A named two-person in-house tester team, reviewed by the team lead, rather than a community matched per engagement |
Quick comparison, with the source for every row
Every cell below traces to the URL in the final column. All rows last verified 5 September 2026.
Dimension | HackerOne | Bugcrowd | Stingrai | Source |
|---|---|---|---|---|
Founded, HQ | 2012, San Francisco | 2012 in Australia; "our headquarters are located in San Francisco, CA and Sydney, Australia", listed at 300 California Street, Suite 220 | 2021, Toronto with a London, UK office at 1 Coldbath Square, Farringdon | |
Pentest product | H1 Pentest and H1 Agentic Pentest | Pen Testing as a Service, Standard, Plus and Max tiers | Autonomous Pentest and Hybrid Pentest | |
Published pentest price | Not published. hackerone.com/pricing redirects to the platform page | US$5,000 small, US$8,000 medium, US$15,000 large web app; US$5,000 cloud config; US$8,000 or US$13,000 mobile, on a 12-month contract | US$3,000 Autonomous, US$6,800 Hybrid, or US$650 and US$1,275 per month | |
Where the price is published | Nowhere | AWS Marketplace, not bugcrowd.com; bugcrowd.com/pricing resolves to the researcher portal | The public pricing page | |
Scope covered by the published price | Not applicable | A unit by size band: small, medium or large web app, one cloud project, or a mobile app on one or two platforms | One web application and associated APIs | |
Who tests | A vetted, globally distributed community of testers matched to your asset type and technology stack | Curated tester teams assembled by CrowdMatch AI, rotated "whenever needed" | Employed certified penetration testers working concurrently with Snipe | |
Tester continuity | Stated as a benefit: results "without the need for tester rotation, ensuring deep familiarity with your systems" | CrowdMatch "rotates testers whenever needed" | The same employed team across engagements by default | |
Time to start | Not published | "Launch within 3 business days" on Standard; the platform promises launch "in less than 72 hours" | Scoped per engagement; Autonomous returns same-day results once launched | |
Retesting | "HackerOne provides retesting to confirm that the fixes have been correctly implemented"; term not published | "12 months of retesting (with 1 report update)" for web apps, networks and APIs on Standard, all asset types on Plus | Included in the engagement; automated retests on the Autonomous tier | |
AI layer | H1 Agentic Pentest, "A coordinated system of AI agents and human experts" | Savant Pathseeker, "agentic pentesting on the Bugcrowd Platform", in early access | Snipe, an autonomous web application pentest agent | |
What the AI is allowed to do | "agentic systems may assist with reconnaissance and repeatable validation under strict guardrails", with human testers retaining full oversight and reviewing every agent finding | Not published in detail; the platform describes combining "automated scanners" with "experienced human testers" | Black-box dynamic testing and white-box source review, hunting IDOR, business logic and broken authorization | |
CREST | CREST appears in the compliance logo set on the pentest page | "global CREST accreditation for pen testing"; CREST certification is a named Plus-tier tester requirement | CREST-accredited penetration testing service provider at firm level | |
Compliance framing | Report "Meet standards for SOC 2, ISO 27001, GDPR, and more"; compliance logos include AICPA SOC 2, ISO 27001, CREST, NIST CSF 2.0, FISMA, NIST 800-53, GDPR and DORA | "Meet compliance goals (PCI, HIPAA, GDPR, ISO 27001)" | Reports support SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, NIST SP 800-53 and 800-171, DORA and NIS2 programs | |
Source code review | H1 Code and H1 Code Security Audit are separate products; the pentest page lists Code Security Audit as a testing type | Not published as part of PTaaS | Included: Snipe reads application source alongside dynamic testing | |
Fix automation | H1 Remediation offers "Source code-informed fix plans, delivered straight to engineering" | Not published | AutoFix pull requests | |
Merge protection | Not published | Not published | Gating check on every pull request | |
Integrations | "Integrate pentest results into Jira, Slack, GitHub, or ServiceNow" | Prioritised findings flow "directly into existing DevSec tools and processes" | PTaaS portal with Jira, GitHub and Slack |
Pricing: one platform publishes, one does not, and the published one hides it in a marketplace
HackerOne publishes nothing. There is no pricing page. The URL hackerone.com/pricing resolves to the platform overview, and every route from the H1 Pentest page ends at a contact form with the note "Our team typically responds within 1 business day". For a buyer trying to size a budget line before opening a procurement cycle, that is a hard stop.
Bugcrowd publishes, on someone else's website. bugcrowd.com/pricing resolves to the Bugcrowd researcher portal rather than a customer pricing page, so the site itself looks equally opaque. The figures live on the AWS Marketplace listing, where Bugcrowd states: "Pricing for Standard Pen Tests is shown below; for customized testing, contact us about a Plus Pen Test." The listing explains the unit model directly: "You buy each dimension as a separate contract unit, not as a subscription with escalating tiers... Five standard pen test options scale by scope: web app complexity (small, medium, large), one cloud project, or a mobile app on one platform or two platforms." Vulnerability disclosure programmes are also priced there, at US$3,588 for VDP Basic 15 and US$11,988 for VDP Basic 75, while Managed Bug Bounty is "Contact us for pricing."
The listing also states what a Standard unit includes: "Each standard pen test launches within three business days and provides a platform-generated report and the PTaaS dashboard for real-time findings. It integrates with your development workflow. Web app, network, and API tests include 12 months of retesting with one report update."
What this means practically. If you are comparing quotes, Bugcrowd gives you a real anchor and HackerOne does not. If you are comparing what the money buys, note that Bugcrowd's Standard tier delivers a "Platform-generated report" while custom scoping and a custom report sit in the Plus tier, along with the ability to specify tester requirements covering "Geolocation/testing time restrictions, special skill sets, CREST certification, etc."
Staffing: two community models with different continuity promises
Both platforms activate a community rather than an employed bench, and they market opposite properties of that model.
HackerOne sells continuity. The H1 Pentest page describes connecting you to "a vetted pool" of testers and states the approach "delivers fresh insights and consistent, high-quality results without the need for tester rotation, ensuring deep familiarity with your systems", with testers "carefully matched to your asset type and technology stack".
Bugcrowd sells matching and rotation. Its platform's "CrowdMatch AI technology curates qualified, engaged teams for your precise requirements (and rotates testers whenever needed)". Bugcrowd frames the alternative as the problem: "Other pen test providers take a cookie-cutter approach to pen testing regardless of your specific assets, environment, or needs."
Neither claim is wrong. They are answers to different buyer anxieties. If your concern is that a new tester relearns your authorization model every year, HackerOne's framing speaks to you. If your concern is getting a specialist in an unusual technology on short notice, Bugcrowd's does.
Agentic testing: HackerOne draws the boundary in public
This is the section where the two platforms diverge most usefully for a buyer.
H1 Agentic Pentest is described as "built on the proven foundation of H1 Pentest" and taking "a fundamentally different approach from both traditional services and fully autonomous tools. A coordinated system of AI agents and human experts scales reconnaissance, setup, exploitation, and validation across large and changing attack surfaces while preserving judgment, accountability, and trust."
Then HackerOne adds a caveat most vendors would leave out, and it deserves quoting rather than paraphrasing: "For supported web application tests, agentic systems may assist with reconnaissance and repeatable validation under strict guardrails", and human testers "retain full oversight and review all agent findings for quality, accuracy, and relevance".
That is a precise and honest description of a deliberate product boundary. The agents do reconnaissance and repeatable validation on supported web application tests. People do the rest.
Bugcrowd's Savant Pathseeker is announced on the homepage as "agentic pentesting on the Bugcrowd Platform", with an "Apply for Early Access" call to action. Because it is in early access, Bugcrowd does not yet publish a comparable statement of what the agents are permitted to do inside a paid engagement. Ask for that in writing if agentic coverage is part of why you are buying.
Where Stingrai draws it. Snipe is Stingrai's autonomous agent for web application penetration testing, including the application's APIs, trained on more than 6,000 HackerOne Hacktivity disclosure reports and on Stingrai's own testers' methodology, and it hunts IDOR, broken authorization and business logic rather than assisting with recon. The Autonomous package is Snipe alone, with no penetration testers assigned; the Hybrid package pairs it with named penetration testers. On Hybrid, those testers work the same engagement at the same time, directing where Snipe focuses and extending the attack paths it opens, with both contributing findings across every severity. Snipe also generates AutoFix pull requests and can run as a gating check that blocks vulnerable code from merging. Neither HackerOne nor Bugcrowd publishes an equivalent to merge gating.
Compliance evidence: what the report is actually for
Both platforms position the pentest report as audit evidence, and both are used that way in practice.
HackerOne states that its final report lets you "Meet standards for SOC 2, ISO 27001, GDPR, and more with a report that proves security due diligence", and its pentest page carries a compliance strip covering AICPA SOC 2, ISO 27001, CREST, NIST CSF 2.0, FISMA, NIST 800-53, GDPR and DORA.
Bugcrowd states that PTaaS helps you "Meet compliance goals (PCI, HIPAA, GDPR, ISO 27001) and surpass them when needed", and it publishes "global CREST accreditation for pen testing" as a platform-level credential. Notably, CREST certification for the individual testers on your engagement is a Plus-tier request rather than a Standard-tier default, which is worth checking if your assessor asks who tested.
Stingrai's penetration testing supports SOC 2, ISO 27001, PCI DSS 4.0, HIPAA, NIST SP 800-53 and 800-171, DORA and NIS2 programs, whether you buy a single annual engagement or a continuous program, and Stingrai holds a firm-level CREST accreditation as a penetration testing service provider. For what an examiner actually asks for, see the pentest evidence auditors accept and will an auditor accept an AI pentest in 2026.
What our own engagement data says about the choice
Stingrai published its platform data in The State of Penetration Testing 2026, and three of those numbers bear directly on this decision. Across 55 penetration tests producing 1,206 verified findings, 92.7% of tests surfaced at least one High or Critical issue, which is the argument against treating any single test as a formality. The verified-finding false-positive rate was 0.74%, which is the number to benchmark any agentic product against when a vendor tells you validation is handled. And Critical findings closed at a median of 10.5 days, which is why retest terms and pull-request-level remediation are worth pricing rather than treating as an afterthought.
Public pricing side by side
HackerOne | Bugcrowd | Stingrai | |
|---|---|---|---|
Web application test, small | Not published | US$5,000 | US$3,000 Autonomous, US$6,800 Hybrid, one web application and associated APIs |
Web application test, medium | Not published | US$8,000 | Scoped through Get a Quote |
Web application test, large | Not published | US$15,000 | Scoped through Get a Quote |
Cloud configuration test | Not published | US$5,000 | Scoped through Get a Quote |
Mobile app, one platform | Not published | US$8,000 | Scoped through Get a Quote |
Mobile app, two platforms | Not published | US$13,000 | Scoped through Get a Quote |
Vulnerability disclosure programme | Not published | US$3,588 (Basic 15), US$11,988 (Basic 75) | Not offered |
Bug bounty | Not published | "Contact us for pricing" | Not offered |
Continuous programme, monthly | Not published | Not published | US$650 Autonomous, US$1,275 Hybrid |
Contract term on the published price | Not applicable | 12 months | One-time, or a 12-month engagement |
Retesting | Provided; term not published | 12 months with one report update, web app, network and API | Included |
Sources: Bugcrowd on AWS Marketplace, HackerOne and Stingrai pricing, all verified 5 September 2026. For engagement-level benchmarks beyond these three, see the 2026 penetration testing cost guide.
Best fit by company profile
HackerOne fits you if:
You already run a bug bounty or vulnerability disclosure programme on HackerOne and want testing, response, code security and AI red teaming orchestrated by the same platform layer.
Your attack surface is large and changing, and you want AI agents scaling reconnaissance across it with human testers retaining oversight.
Tester familiarity across cycles matters more to you than a published price.
You want a single vendor across bounty, pentest, code audit and AI red teaming rather than a specialist.
Bugcrowd fits you if:
You need a defensible number before a procurement conversation, and a US$5,000 to US$15,000 band by scope size is enough to build a budget on.
You want to buy through AWS Marketplace and draw down committed cloud spend.
Your remediation cycles run long and 12 months of retesting is a material line item.
You want CREST-certified testers or geographic and timing restrictions written into the scope, and you can buy the Plus tier to get them.
You want methodology-driven testing and bug bounty discovery from the same supplier, which is what the Max tier is for.
Stingrai fits you if:
The test has to be the audit artifact, and you want the price, the scope and the guarantee visible before you speak to anyone.
The bugs that would actually hurt you are authorization and business logic bugs inside one authenticated, multi-tenant application.
You want an AI agent and named penetration testers on the same engagement at the same time, with white-box source review inside the engagement rather than sold as a separate product.
You want remediation to arrive as a pull request, and vulnerable code blocked at merge rather than queued in a backlog.
You want the same named two-person tester team on your application every cycle, both annual one-time tests and continuous programmes from that team, and scope that can grow into mobile, cloud, Active Directory or red teaming without changing supplier.
None of the three is the answer if you need a US federal 3PAO or a FedRAMP-authorized assessment. That is a different purchase with different vendors.
Frequently Asked Questions
How much does a HackerOne pentest cost in 2026?
HackerOne does not publish a price. The URL hackerone.com/pricing redirects to the platform overview page, and the H1 Pentest product page routes to a contact form with the note "Our team typically responds within 1 business day". No dollar figure for H1 Pentest or H1 Agentic Pentest appears anywhere on hackerone.com. For published comparison points, Bugcrowd lists Standard Pen Test units from US$5,000 on AWS Marketplace, and Stingrai publishes US$3,000 for an Autonomous Pentest and US$6,800 for a Hybrid Pentest, each covering one web application and associated APIs.
How much does a Bugcrowd pentest cost in 2026?
Bugcrowd publishes Standard Pen Test unit prices on its AWS Marketplace listing: US$5,000 for a small web application, US$8,000 for medium, US$15,000 for large, US$5,000 for a cloud configuration test, and US$8,000 or US$13,000 for a mobile app on one or two platforms, all on a 12-month contract. Plus and Max tier pricing is not published; the listing says "for customized testing, contact us about a Plus Pen Test." Note that bugcrowd.com/pricing resolves to the researcher portal rather than a customer pricing page, so the marketplace listing is the place to look.
HackerOne vs Bugcrowd: which is better for penetration testing?
They optimise for different things. Bugcrowd gives you a published unit price, a three-business-day launch and 12 months of retesting with one report update, with CREST-certified testers available as a Plus-tier request. HackerOne gives you tester continuity across cycles, an agentic layer designed for large and changing attack surfaces, and one platform spanning pentest, bounty, disclosure, code audit and AI red teaming. Choose Bugcrowd for a fast, priced, repeatable unit of testing. Choose HackerOne if the pentest is one product inside a platform relationship you already have.
Does HackerOne use AI to run penetration tests?
Partly, and it publishes the boundary. H1 Agentic Pentest is described as "A coordinated system of AI agents and human experts" that "scales reconnaissance, setup, exploitation, and validation across large and changing attack surfaces". The page then states the limit directly: "For supported web application tests, agentic systems may assist with reconnaissance and repeatable validation under strict guardrails", and human testers "retain full oversight and review all agent findings for quality, accuracy, and relevance". So the agents assist on reconnaissance and repeatable validation for supported web application tests, and people keep oversight.
Does Bugcrowd have an agentic pentest product?
It has one in early access. Bugcrowd's homepage announces "Savant Pathseeker, agentic pentesting on the Bugcrowd Platform" with an "Apply for Early Access" call to action. Because it is in early access, Bugcrowd does not yet publish a detailed statement of what the agents are permitted to do inside a paid engagement, so ask for that in writing if agentic coverage is part of your reason for buying.
Do HackerOne and Bugcrowd include retesting?
Both provide it, and only Bugcrowd publishes a term. Bugcrowd states that "Web app, network, and API tests include 12 months of retesting with one report update" on the Standard tier, extended to all asset types on Plus. HackerOne states that "After vulnerabilities are identified and remediated, HackerOne provides retesting to confirm that the fixes have been correctly implemented", but does not publish a window. Stingrai includes retesting in both published tiers, with automated retests on the Autonomous tier.
Is Bugcrowd CREST accredited?
Bugcrowd states that its CrowdMatch approach brings "high-quality results that have earned us global CREST accreditation for pen testing". Separately, the ability to require "CREST certification" of the individual testers on your engagement is listed as a Plus-tier tester requirement rather than a Standard-tier default. HackerOne displays CREST in the compliance logo set on its pentest page. Verify any accreditation on the CREST Marketplace yourself, because accreditations renew on a cycle. Stingrai holds a firm-level CREST accreditation as a penetration testing service provider.
Which platform is better for SOC 2 or ISO 27001 evidence?
Both produce reports used as audit evidence, and both say so. HackerOne states its report helps you "Meet standards for SOC 2, ISO 27001, GDPR, and more". Bugcrowd states PTaaS helps you "Meet compliance goals (PCI, HIPAA, GDPR, ISO 27001)". What actually matters at audit is whether the report documents scope, methodology, severity ratings and retested findings against the exact control your assessor cites, and who performed the testing. Ask for a redacted sample report from either platform, and check whether CREST-certified testers are included at the tier you are buying.
What is the third option, and when does it beat both?
Stingrai. Stingrai Inc is a CREST-accredited penetration testing service provider founded in 2021 in Toronto, and it is in-house rather than crowdsourced: a named two-person tester team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP, reviewed by the team lead, with 18 published CVEs across the team and Hall of Fame placements at Apple, Google, the US Department of Defense and the US Federal Reserve. It runs web and API, mobile, AI and LLM, cloud, network, Active Directory, social engineering and red team engagements, one-time or continuous, with findings posted to its PTaaS portal as they are confirmed, live chat with the assigned testers, Jira and Slack push, retesting and an attestation letter with every human-led and hybrid report. It beats both when the interesting bugs live in authorization and business logic inside one authenticated application, when you want white-box source review inside the engagement rather than as a separate product, when you want fixes as AutoFix pull requests with a merge gate, and when you want the same team every cycle. For deeper one-to-one comparisons see HackerOne Pentest vs Stingrai 2026 and Bugcrowd alternatives 2026.
Related Reading
The pentest evidence auditors accept for SOC 2, ISO 27001, PCI and CMMC
DeepStrike Alternatives (2026): Penetration Testing Providers Compared
Best Security Compass Alternatives (2026): Penetration Testing and AppSec Firms Compared
Best Pentest People Alternatives (2026): UK PTaaS and Penetration Testing Firms Compared
Talk to Stingrai
If you are holding a quote from either platform and want to know what it does and does not cover on your most complex application, that is a short scoping conversation with a specific answer. Stingrai scopes against your real architecture: how many tenants, how many roles, where money moves, and what your auditor will ask for. Testing is then run by a named two-person tester team under Stingrai's firm-level CREST accreditation, with findings posted to the portal as they are confirmed, live chat to those testers, Jira and Slack push, retesting of fixes, and an attestation letter and verified badge with the report, on a one-time engagement or a continuous programme. Book a free scoping call, get a quote, or read the published pricing.
