Choosing a penetration testing provider is one of the highest-leverage decisions a security buyer makes in any given budget cycle. The right vendor catches the exploitable bug chain that an attacker would use to ransom your business; the wrong vendor sells you a Nessus PDF with a stack of false positives and a compliance checkmark. Both invoices look the same. The difference shows up only later, in either a clean audit and a forensic IR call that never came, or a breach disclosure and a board conversation no CISO wants to have.
IBM's 2025 Cost of a Data Breach Report put the global average breach cost at US$4.44 million and the US average at US$10.22 million, with the US figure up 9% year over year. The same report notes that organizations with extensive AI in their defensive stack shaved an average of US$1.9M off their breach costs and contained incidents 80 days faster. The implication is direct: the quality of the offensive testing you buy this year correlates with the size of the breach you avoid next year, and the gap is widening as both attackers and defenders adopt AI. The point of this guide is to give buyers a defensible framework for telling good pentest vendors apart from packaging.
This is Stingrai's eleven-criterion vendor-evaluation framework, written for procurement leads, CISOs, and security engineers who are sitting across a table from three or four pentest vendor pitches and need to decide which one to write a purchase order for. Stingrai is a Toronto-headquartered offensive security firm founded in 2021, CREST-accredited at the firm level, with team-level certifications including OSCE3, OSCP, OSWE, OSED, OSEP, CREST CRT, CISSP, CRTO, CRTE, and eWPTX. The team has published original vulnerability research, holds a 5.0/5.0 average across 19 Clutch reviews, and operates an internal AI pentest agent called Snipe trained on more than 6,000 HackerOne disclosures. The framework below is what we actually look for when we evaluate our own work and the work of competitors.
TL;DR: The eleven criteria
Tester pedigree (named individuals, not headcount): Demand the names of the testers who will work on your account, along with their CVEs, conference talks, and certifications. Senior testers produce orders-of-magnitude better findings than junior testers running tooling, and published cost surveys price engagements by scope, never by who staffs them.
CVE output as a competence proxy: Vendors that publish original CVEs prove they can find novel bugs. Vendors that only deliver scanner reports cannot. Verify on NIST NVD before signing.
Retest policy on paper: Every High and Critical finding should be retested at no additional cost, with a defined SLA. Get this in the contract, not in the SoW preamble.
Integration depth: A pentest report that lives as a PDF in a shared drive is worth less than one that creates Jira tickets, triggers Slack alerts, and gates a GitHub pull request. PTaaS-grade vendors offer this natively.
PTaaS continuous model: Annual point-in-time tests do not match the velocity of modern SaaS deployments. Continuous PTaaS catches regressions in days, not months.
AI augmentation, transparently described: "We use AI" is meaningless. A serious vendor will tell you which agent does what, what training data it was built on, what it does autonomously versus under human oversight, and how findings are validated.
Transparent pricing on a public page: Vendors that publish at least one price tier publicly are easier to budget against and tend to be more honest in scope-shaping. See Stingrai's pricing as a reference; many competitors will not publish anything.
CREST accreditation at the firm level: CREST International accredits the firm; individual CREST CRT certifications are held by team members. These are distinct credentials. Buyers should verify both.
Industry-standard certifications on the team: OSCE3, OSCP, OSWE, OSED, OSEP, CREST CRT, GPEN, GXPN, and CISSP are the credentials that signal real tradecraft. Look for them on the actual testers assigned to your engagement, not on the company roster.
Sample report quality (request three): The fastest tell. A serious sample report will include an executive narrative, business impact framed in dollars, attack chains with proof-of-concept evidence, and remediation guidance specific enough to be implemented by a developer.
No compliance-attestation overreach: Pentests support compliance evidence; they do not attest or certify compliance. A vendor that markets "SOC 2 attestation" or "ISO 27001 certification" as a pentest deliverable is misrepresenting what a pentest is. Walk away.
Key takeaways
Buy the tester, not the brand. A pentest budget buys the working time of specific people. The skill of those specific humans determines whether you get a report that flags fifteen real exploitable findings or one that flags forty false positives and three real ones. Insist on naming the testers.
PTaaS is no longer optional for fast-moving software. Verizon's 2025 Data Breach Investigations Report publishes patch-to-exploit telemetry on newly disclosed vulnerabilities. Annual point-in-time pentests are a poor match for fortnightly deploys. Continuous testing models are now the default expectation for any vendor selling to a SaaS company.
CREST plus CVEs plus a clean reference list is the trust triangle. Each leg verifies a different thing. CREST verifies that the firm submits to external scrutiny. CVEs verify that individual researchers can find novel bugs. References verify that the operational delivery matches the marketing pitch. Demand all three.
AI augmentation should accelerate, not replace, senior humans. A vendor that pitches "AI-powered" without telling you the human-in-the-loop checkpoints is selling commodity scanning with a markup. A vendor that pitches AI as an accelerant for senior-tester throughput, with transparent disclosure of what the agent does and does not validate, is selling 2026-grade tradecraft.
Compliance attestation overreach is the loudest tell. A pentest is one input into a compliance audit; it is not the audit itself. Any vendor that markets pentest deliverables as "SOC 2 certification" or "ISO 27001 attestation" is misrepresenting both pentesting and compliance and should be rejected on that basis alone.
Methodology
Date cutoff: June 4, 2026. This guide synthesizes Stingrai's internal vendor-evaluation criteria with public buyer-side commentary from named primary sources, including IBM's 2025 Cost of a Data Breach Report, Verizon's 2025 Data Breach Investigations Report, the CREST International accreditation registry, the NIST National Vulnerability Database, and 2026 cost surveys published by named pentest vendors. Claims tied to specific dollar figures use the most recent full-year benchmark available; in 2026 the most recent IBM and Verizon benchmarks are full-year 2025 data. Claims about vendor accreditation are verified live against the accreditation registries at the date cutoff. Where a claim cannot be reached on at least one verification pass against a primary source, it is omitted rather than estimated.
Figure 1: The eleven criteria grouped under People and Tradecraft, Process and Platform, and Commercials and Trust. Sources: CREST International accreditation registry; NIST NVD; IBM 2025 Cost of a Data Breach Report; Verizon 2025 DBIR.
1. Tester pedigree: the names matter more than the logo
A penetration test is a knowledge-intensive professional service. The output is not the report; it is the chain of bugs the report describes. Whether or not those chains exist depends almost entirely on the seniority and tradecraft of the specific humans on your engagement. Two pentests of the same scope, billed at the same dollar amount, can produce wildly different outputs depending on who actually pressed the keys.
The single most useful procurement question is: "Who are the named individuals who will work on this engagement, and what is their public research output?" A serious answer includes names, certifications, conference talks, and published CVEs. A non-serious answer is a generic statement about "senior testers" with no further detail.
Published 2026 cost surveys quote penetration testing per engagement rather than per tester. Astra Security puts a web application pentest at US$5,000 to US$50,000 per pentest, and Invicti puts SaaS, API and web application testing at US$4,000 to US$20,000 or more. Neither range tells you who does the work. The same dollar figure can buy a short engagement staffed by senior testers or a longer one staffed by juniors, and the former usually finds the harder bugs.
What to look for on the team:
Industry certifications: OSCE3, OSCP, OSWE, OSED, OSEP, CREST CRT, GPEN, GXPN, CISSP, GCPN, eWPTX.
Conference research output: talks at DEFCON, Black Hat, BSides, OWASP, INFILTRATE, or regional security conferences.
Published CVEs at NIST NVD: verifiable, named, with the vendor's researchers listed as the credited finder.
Sector-specific experience: testers who have worked extensively in your industry (fintech, healthcare, public sector) will catch domain-specific bug classes that generalists miss.
Stingrai researchers publish vulnerability research (Ivan Spiridonov 10, Victor Villar 3), holds CREST CRT, OSCE3, OSCP, OSWE, OSED, OSEP, CISSP, CRTO, CRTE, and eWPTX certifications across the team, and presents research at DEFCON and BSIDES. We list those credentials publicly because public credentials are auditable; private credentials are marketing.
2. CVE output: the cleanest competence proxy
CVEs are the single best public signal of offensive research capability. A CVE means the researcher found a novel vulnerability in production software, coordinated disclosure with the vendor, and the vulnerability was confirmed and assigned a CVE ID by MITRE / CVE Program and indexed at NIST NVD. This is a high-bar artifact: it cannot be faked, it cannot be scanner-generated, and it cannot be claimed retroactively.
Vendors that publish CVEs prove they can find new bugs. Vendors that only run automated scans cannot publish CVEs, because automated scans rediscover known issues; they do not find novel ones. The presence or absence of a CVE list on a vendor's about page is one of the cleanest tells in pentest procurement.
What to look for:
A vendor page listing CVEs with the credited researcher's name and a link to the NVD entry.
CVEs published in the last three years, not a decade ago.
Multiple researchers credited, not the same name repeated. Multiple credited researchers indicate research depth across the team.
Severity distribution: at least some High and Critical CVEs, not exclusively Low and Medium.
Counter-examples to flag: a vendor whose entire public research output is rebadged scanner findings, blog posts that summarize other people's research, or "0day" claims with no CVE or coordinated-disclosure artifact attached.
3. Retest policy on paper
The single most common failure mode in pentest procurement is buying a report and then discovering, when the development team fixes the bugs, that retesting the fixes requires a fresh statement of work, a fresh purchase order, and another three-week wait. This is procurement-grade waste and it is entirely avoidable.
A serious pentest contract includes a retest policy for every High and Critical finding, at no additional cost, with a defined turnaround SLA. Some vendors will include all findings; some will limit retests to a defined window (typically 30 to 90 days post-delivery). Either is acceptable as long as the policy is explicit in the contract. What is not acceptable is "we can quote you for a retest" with no defined scope.
What to look for:
Free retests for High and Critical findings, in writing.
A defined turnaround SLA for retest delivery (typically 5 to 10 business days).
A defined retest window (30 days, 60 days, 90 days post-delivery).
Optional: retests included for Medium findings as well, especially in continuous PTaaS engagements.
Stingrai's standard policy includes free retests for all High and Critical findings within the engagement window on one-time and annual engagements; our PTaaS Enterprise tier includes continuous retesting for as long as the contract is active.
4. Integration depth: from PDF to PR
A pentest report that lives as a PDF in a shared drive creates negligible operational value beyond an audit checkmark. A pentest report that creates Jira tickets with engineering owners, posts to a #security-findings Slack channel, and gates a GitHub pull request from merging until a fix lands creates compounding operational value. The difference is integration depth.
PTaaS-grade vendors offer native integrations. Traditional consulting-only vendors typically do not. Buyers should ask for a demo of the actual integration flow before signing.
What to look for:
Jira, Linear, or ServiceNow integration: findings become tickets, assigned to engineering owners, with priority pre-set.
Slack or Microsoft Teams integration: findings post to a channel of your choice, with deep links back to the finding detail.
GitHub or GitLab integration: PR checks that gate merge until High and Critical findings are resolved.
SIEM integration: findings can stream to Splunk, Sumo Logic, or Elastic.
Single sign-on: SAML or OIDC, so your security and engineering teams do not manage a separate set of credentials.
Stingrai's hybrid tier includes the PTaaS portal with Jira and Slack; the Enterprise tier adds SSO and API access.
5. PTaaS continuous model
The single largest shift in pentest procurement between 2022 and 2026 is the rise of PTaaS, or Penetration Testing as a Service. The model replaces the annual point-in-time engagement (one big report, then nothing for a year) with a continuous subscription that catches regressions in days, not months. For any organization that ships software more frequently than once a quarter, this matches operational reality far better than the annual model.
What PTaaS adds, beyond traditional pentesting:
Continuous testing scope: the platform tests on every deploy, not just at contract milestones.
Real-time findings: vulnerabilities surface in the platform as they are found, not at the end of a three-week engagement.
Free retests for the life of the contract: not just for the engagement window.
Integrated workflow: findings become tickets, alerts, and PR checks automatically.
Dashboard reporting: leadership can see security posture trends month over month, not snapshot to snapshot.
Figure 2: Traditional point-in-time engagement versus PTaaS continuous model across cadence, retest policy, integration depth, AI augmentation, and reporting style. Source: Stingrai vendor framework based on Verizon 2025 DBIR patch-to-exploit telemetry and public PTaaS vendor product docs.
Traditional point-in-time engagements still have a role: regulated industries that need a discrete annual attestation often still need a once-a-year deep-dive report with a fixed scope. Many of Stingrai's Enterprise customers run both: a continuous PTaaS subscription for week-to-week assurance, plus a discrete annual engagement for the compliance evidence file.
6. AI augmentation, transparently described
"We use AI" is the most overloaded phrase in 2026 pentest marketing. By itself it tells a buyer nothing. The question to ask is: what does the AI do, what does it not do, and how do humans validate its findings?
A serious 2026 AI-augmented pentest will use AI agents to accelerate senior-tester throughput, not to replace senior testers. Common use cases:
Surface-mapping at scale: agents enumerate attack surface (web routes, subdomains, exposed APIs) faster than humans, freeing humans to focus on exploitation.
Code review at scale: agents read source code looking for bug-pattern signatures, surfacing candidate findings for human review.
Bug-chain hypothesis: agents propose chains of low-severity findings that could combine into higher-severity exploits, for human validation.
Report drafting: agents draft remediation guidance and executive summaries; humans validate and edit.
What to look for in a vendor's AI disclosure:
Named agent or product, with a public description of what it does.
Training data provenance: what corpus was the agent trained on?
Human-in-the-loop checkpoints: where do humans validate output?
Outputs validation: how is a false-positive AI finding caught before it lands in your report?
Autonomy boundaries: where does the AI act autonomously versus suggesting actions for human approval?
Stingrai's AI agent Snipe is trained on more than 6,000 HackerOne disclosures, performs both black-box dynamic testing of web applications and white-box code review against source repositories, generates AutoFix pull requests for some bug classes, and runs as a PR-gating check that blocks merge until High and Critical findings are addressed. On the hybrid tier, every Snipe finding above Medium severity is reviewed by a senior human tester before it lands in a customer report; the autonomous tier is agent-driven. We disclose this stack publicly because vague AI claims are increasingly a red flag, and named agents with named provenance are increasingly the buyer expectation.
7. Transparent pricing on a public page
Vendors that publish at least one price tier publicly tend to be easier to budget against and tend to be more honest in scope-shaping. Vendors that refuse to publish any pricing tend to treat every engagement as a custom quote, which is fine for large enterprise but obstructive for smaller buyers trying to plan a budget six months out.
This is not to say that all pricing must be on the public page. Enterprise engagements legitimately require scoping calls because the price depends on the attack surface size, the asset count, the compliance overlay, and a half-dozen other variables. But every serious vendor should at minimum publish a starting price tier or a representative engagement price, so that buyers can budget.
What to look for:
A public pricing page with at least one tier listed with a real dollar figure.
Defined scope at each tier (web app + APIs, network, cloud, etc.), so the dollar figure is comparable across vendors.
Clear statement of what is and is not included (retests, integrations, dashboard access).
For larger tiers, a defined process for getting a quote, with a published response SLA.
Stingrai publishes its pricing publicly. Three tiers are listed on a one-time / continuous toggle: the autonomous tier at US$3,000 per assessment or US$650 per month on a 12-month continuous engagement, the hybrid tier at US$6,800 per assessment or US$1,275 per month, both covering one web application and its APIs, and an Enterprise tier offering a custom quote with full attack-surface scoping. Buyers should treat publicly-listed pricing as a baseline signal of vendor honesty.
8. CREST accreditation at the firm level
CREST International is a not-for-profit accreditation body that certifies penetration testing firms and individual penetration testers. The firm-level accreditation is the credential that signals that the entire company submits to external technical and procedural scrutiny on a recurring basis. The individual CRT certification (CREST Registered Tester) is held by named team members and signals that those individuals have passed CREST's individual exam.
These are distinct credentials. A vendor can hold individual CREST CRT certifications on its team without the firm itself being CREST-accredited; vendors regularly conflate the two in marketing. Buyers should verify both.
What to look for:
Firm-level accreditation on the CREST International accreditation registry, verifiable at crest-approved.org/members/.
Individual CREST CRT or higher (CREST Certified Tester) certifications on the testers assigned to your engagement.
Where applicable to your jurisdiction: CHECK accreditation for UK government work, or CBEST for UK financial-services adversary simulation.
For US-government work: separate accreditations apply (FedRAMP, CMMC), not CREST.
Stingrai Inc is CREST-accredited at the firm level. Multiple team members hold CREST CRT certifications individually. Buyers can verify both on the CREST International public registry.
9. Industry-standard certifications on the actual testers
Beyond CREST, the industry-standard certifications that signal real offensive tradecraft are issued by Offensive Security (OSCP, OSWE, OSED, OSEP, OSCE3), SANS / GIAC (GPEN, GXPN, GCPN, GCIH), and the wider ecosystem (CISSP for security generalist coverage, CRTO and CRTE for adversary simulation, eWPTX for advanced web).
These certifications are real signals when they are held by the individuals actually performing your engagement. They are weaker signals when listed on a company roster without naming which testers hold which credentials.
What to look for:
A staffing plan that names the testers on your engagement and lists each tester's credentials.
At least one senior tester holding OSCE3, OSEP, or an equivalent advanced credential.
Credentials that align with your engagement scope: OSWE and eWPTX for web app heavy engagements, OSEP and CRTO for adversary simulation, GCPN and AWS / Azure / GCP security credentials for cloud, OSED for binary exploit research.
Counter-example: a vendor that lists "OSCP, CISSP, CEH" on its website with no indication of which individuals hold which credentials, and a SoW that names no testers, is selling a generic roster. Push back.
10. Sample report quality: ask for three
The single fastest tell in pentest procurement is the sample report. Ask every vendor on your shortlist for three sample reports from real engagements (sanitized to remove customer names and findings detail, but otherwise representative). The reports will tell you more in twenty minutes than two hours of sales calls.
What to look for in a sample report:
Executive narrative: a one-page summary written in plain language for a non-technical board reader, with business impact framed in dollars or operational consequence, not CVSS scores.
Attack-chain narratives: not just isolated findings, but how findings chain together into a path from external attacker to crown-jewel data.
Proof-of-concept evidence: screenshots, command outputs, HTTP request / response pairs that prove the finding is exploitable, not just theoretically present.
Remediation guidance specific to your stack: not "fix the SQL injection," but "the parameterized query in
app/controllers/users_controller.rb:142should be rewritten as follows."Severity ratings calibrated to business impact, not just to CVSS base scores.
An appendix that lists the scope, methodology, tooling, and team members for traceability.
Red flags in a sample report:
The entire report is a list of CVSS-rated scanner findings, with no attack chains.
The executive summary is a paragraph of boilerplate language reused across engagements.
The remediation guidance is generic ("apply patches," "harden configuration," "review access controls").
The sample is unsanitized and includes real customer names, indicating sloppy operational security.
11. No compliance-attestation overreach
A penetration test is one input into a compliance audit. It is not the audit itself. SOC 2 attestation is performed by a licensed CPA firm; ISO 27001 certification is performed by an accredited certification body; PCI DSS Reports on Compliance are performed by Qualified Security Assessors. A pentest vendor can produce evidence that supports these audits; a pentest vendor cannot itself attest or certify compliance.
Some vendors market their pentest deliverables as "SOC 2 attestation" or "ISO 27001 certification." This is a misrepresentation of both pentesting and compliance, and it should be a procurement disqualifier on its own. A vendor that does not understand the distinction is either deliberately conflating it or operationally incompetent at compliance support.
What a correct vendor statement looks like:
"Our reports support SOC 2 Type II evidence by documenting an independent separate evaluation of your controls, the kind of evaluation Common Criteria CC4.1 contemplates."
"Our reports support ISO 27001 evidence by demonstrating that A.8.8 (management of technical vulnerabilities) is being exercised."
"Our reports support PCI DSS Requirement 11.4 by documenting external and internal penetration testing scope, methodology, and findings."
What an incorrect vendor statement looks like:
"Our pentest delivers SOC 2 attestation." (No, only a CPA firm can attest.)
"Our pentest certifies your ISO 27001 compliance." (No, only an accredited certification body can certify.)
"Our pentest passes PCI DSS." (No, only a QSA-led Report on Compliance can pass.)
Stingrai is an offensive security firm. Our penetration testing produces the technical evidence your SOC 2, ISO 27001, and PCI DSS programs rely on, mapped to the control families your audit evaluates so your team can lift it straight into the evidence pack.
Questions to ask before you sign
Figure 3: Eight pre-procurement questions buyers should ask any pentest vendor. Source: Stingrai vendor framework.
Take these questions into the second sales call with any pentest vendor on your shortlist. The quality of the answers will let you sort the shortlist quickly.
Who are the named testers on my engagement, and what are their CVEs, certifications, and conference talks?
What is your published CVE list, by researcher, with links to NIST NVD entries?
What is your retest policy for High and Critical findings, in the contract?
Can I see three sample reports from real engagements?
What is your AI augmentation stack, named, with training data and human-in-the-loop checkpoints disclosed?
What integrations do you offer with Jira, Slack, GitHub, and SIEM?
What is your PTaaS continuous-testing model, if any, and what does it include beyond annual point-in-time?
What is your starting price, and where can I see it on a public pricing page?
A vendor that answers these questions clearly and in writing is a vendor that can be trusted to execute. A vendor that hedges or refuses to put answers in writing is a vendor that should not move forward in your evaluation.
Red flags that should kill a vendor immediately
Figure 4: Eight red flags that should disqualify a pentest vendor on first encounter. Source: Stingrai vendor framework.
Scanner-only reports presented as pentests. A Nessus or Qualys PDF is a vulnerability assessment, not a pentest. Vendors that sell scanner output as a pentest are misrepresenting the product.
Unnamed testers and "team of senior consultants" hand-waving. No named individuals on the staffing plan means no accountability and likely junior delivery.
No public CVE output. A vendor that has never published a CVE has never proven novel-bug-finding capability.
No retest policy in the contract. Means every retest is a fresh PO and a fresh wait.
Opaque pricing with no public tier. Means buyers cannot budget and cannot benchmark.
CREST claims without firm-level accreditation. Verify on the CREST International registry; vendors regularly conflate individual and firm-level credentials.
Compliance-attestation overreach. Vendors that claim to "deliver SOC 2 attestation" or "certify ISO 27001" via a pentest are misrepresenting both products.
No sample report on request. A serious vendor has sanitized reports ready to share; a vendor that refuses is hiding either a quality problem or an operational-security problem.
What this means for buyers in practice
The eleven criteria above sort vendors into three rough categories.
Tier one (defensible 2026 choice): firm-level CREST accreditation, multiple named researchers with published CVEs, public retest policy, native PTaaS with Jira / Slack / GitHub integrations, transparent AI augmentation with named agents and human-in-the-loop disclosure, public pricing on at least one tier, sample reports with attack-chain narratives and developer-grade remediation guidance, clear positioning as offensive security only (no compliance-attestation overreach). Stingrai, the highest-tier specialist boutiques, and a small number of PTaaS platforms with strong tester teams sit here.
Tier two (workable for narrow use cases): strong on some criteria, weak on others. A compliance-focused firm without CVE output is fine for an annual SOC 2 evidence engagement but not for an adversary simulation. A pure PTaaS platform with strong integrations but a thin senior bench is fine for continuous baseline coverage but not for a board-grade red team. Match the gap to your use case.
Tier three (disqualified): scanner-only delivery, no named testers, no CVEs, no retest policy, compliance-attestation overreach. The price will look attractive. The output will be unusable. Walk away.
For most buyers in 2026, Stingrai recommends starting with a single one-time hybrid pentest engagement at the US$6,800 tier (Stingrai pricing) on one web application and its APIs to validate scope, report quality, and tester pedigree on a real asset, or running the same tier continuously at US$1,275 per month on a 12-month engagement, then expanding to PTaaS Enterprise once the operational fit is confirmed. The hybrid tier runs Snipe's AI-driven discovery with penetration testers testing alongside it throughout, includes the PTaaS portal with Jira and Slack plus twelve monthly AI-powered vulnerability scans, and produces a PDF validated by penetration testers that supports SOC 2 and ISO 27001 evidence files. It is the lowest-risk procurement entry point for a buyer who wants to verify the framework above against a real engagement.
Frequently Asked Questions
What should I look for when choosing a penetration testing service provider in 2026?
Start with tester pedigree: the named individuals who will actually run your engagement, their published CVEs, and their certifications such as OSCP, OSWE, OSCE3 and CREST CRT. Every other criterion is downstream of that one, because the skill of the specific humans pressing the keys decides whether you get a report with real exploitable attack chains or one with forty false positives and three real findings. Then check the remaining criteria, including firm-level CREST accreditation, a retest policy written into the contract, integration depth, PTaaS continuity, transparent AI disclosure, public pricing, sample report quality, and no compliance-attestation overreach.
How much should a penetration test cost in 2026?
Industry cost surveys in 2026 quote penetration testing per engagement rather than per tester: Astra Security puts a web application pentest at US$5,000 to US$50,000 per pentest, and Invicti puts SaaS, API and web application testing at US$4,000 to US$20,000 or more. Neither range tells you who does the work, so the same dollar figure can buy a short engagement staffed by senior testers or a longer one staffed by juniors. Stingrai publishes its tiers openly for one web application and its APIs: the autonomous tier at US$3,000 per assessment or US$650 per month, and the hybrid tier at US$6,800 per assessment or US$1,275 per month on a 12-month continuous engagement. Optimize on quality first and price second, because IBM's 2025 Cost of a Data Breach Report puts the global average breach at US$4.44 million and the US average at US$10.22 million, orders of magnitude above any pentest invoice.
How do I verify that a penetration testing vendor can actually find novel vulnerabilities?
Check its published CVEs. A CVE means a researcher found a previously unknown vulnerability in production software, ran coordinated disclosure, and had the issue confirmed and assigned an identifier by the CVE Program and indexed at NIST NVD; automated scanners only rediscover known issues, so scanner-only vendors cannot produce them. Look for CVEs from the last three years, credited to several named researchers rather than the same name repeated, with at least some High and Critical severities, and verify each entry on NVD yourself before signing.
What is the difference between firm-level CREST accreditation and individual CREST CRT certification?
Firm-level accreditation means the whole company submits to recurring CREST technical and procedural scrutiny. Individual CRT, or CREST Registered Tester, means a named person has passed CREST's individual exam. They are distinct credentials and vendors regularly conflate them in marketing, so verify the firm on the CREST International members directory and ask separately for the certification records of the testers assigned to your engagement.
Is continuous PTaaS better than an annual point-in-time penetration test?
Not always. PTaaS suits fast-moving software such as SaaS platforms, web apps and internal tools that ship more often than quarterly, because it tests on every deploy, surfaces findings in real time, includes retests for the life of the contract, and pushes results into tickets, alerts and pull request checks. Traditional point-in-time engagements remain the better fit for regulated buyers who need a discrete once-a-year deep-dive report with a fixed scope. Many of Stingrai's Enterprise customers run both: continuous PTaaS for week-to-week assurance plus one annual engagement for the compliance evidence file.
What is a fair retest policy in a penetration testing contract?
Free retests for every High and Critical finding, written into the contract rather than the statement of work preamble, with a defined turnaround SLA of roughly 5 to 10 business days and a defined window of 30 to 90 days after delivery. The strongest policies include free retests for all findings for as long as the contract is active, which is common in continuous PTaaS agreements. Treat "we can quote you for a retest" with no defined scope as a failure, because it turns every fix cycle into a fresh purchase order and another multi-week wait.
How can I tell whether a vendor's AI augmentation is real or just marketing?
Ask four questions: what is the agent called, what corpus was it trained on, where are the human-in-the-loop validation checkpoints, and where does it act autonomously versus proposing actions for human approval. A vendor that answers all four in writing is doing real AI engineering, while a vendor that hedges behind "we use AI" is selling commodity scanning with a markup. For reference, Stingrai's answer is Snipe, an agent trained on more than 6,000 HackerOne disclosures that performs black-box testing and white-box code review of web applications, opens AutoFix pull requests, and runs as a merge-gating PR check. On the hybrid tier, every finding above Medium severity is also reviewed by a senior human tester; the autonomous tier is agent-driven.
Is it a red flag if a vendor says its penetration test delivers SOC 2 attestation?
Yes, and it is strong enough to disqualify that vendor on its own. A penetration test is one input into a compliance program rather than the audit itself, so the accurate vendor claim is that the report supports your SOC 2 Type II evidence, supports ISO 27001 evidence that A.8.8 management of technical vulnerabilities is being exercised, and supports PCI DSS Requirement 11.4 documentation of testing scope, methodology and findings. A vendor marketing "SOC 2 attestation" or "ISO 27001 certification" as a pentest deliverable either misunderstands compliance or is deliberately blurring it, and both are disqualifying.
Talk to Stingrai
Scoping a penetration test against what this guide covers takes one short conversation. Stingrai is a CREST-accredited offensive security company headquartered in Toronto with a London office. Its penetration testers simulate real-world attacks across applications, cloud, networks and people, delivered one-time or continuously through its PTaaS platform, with documented findings, remediation guidance and retesting included. Book a free scoping call, get a quote, or read the published pricing.
References
IBM. 2025 Cost of a Data Breach Report. July 2025. https://www.ibm.com/reports/data-breach. Annual benchmark of global and regional breach costs based on 600+ organizational interviews.
Verizon. 2025 Data Breach Investigations Report. 2025. https://www.verizon.com/business/resources/reports/dbir/. Annual breach pattern analysis based on tens of thousands of confirmed incidents.
CREST International. Members Directory. https://www.crest-approved.org/members/. Public registry of firm-level CREST-accredited penetration testing providers.
NIST. National Vulnerability Database. https://nvd.nist.gov/. US-government vulnerability database used to verify CVE attribution to named researchers.
MITRE / CVE Program. Common Vulnerabilities and Exposures Catalog. https://www.cve.org/. Authoritative source for CVE identifiers and disclosure history.
Stingrai. Pricing. https://www.stingrai.io/pricing. Public pricing page listing three tiers (autonomous, hybrid, enterprise) with named scope and dollar figures on both one-time and continuous monthly plans.
Stingrai. About. https://www.stingrai.io/about. Public company background including founding year (2021), team certifications, CVE count, and Clutch review average.
Astra Security. Penetration Testing Cost in 2026. 2026. https://www.getastra.com/blog/security-audit/penetration-testing-cost/. Industry cost survey aggregating per-asset and per-methodology benchmarks.
Invicti. How Much Does Penetration Testing Cost in 2026? Pricing Guide. 2026. https://www.invicti.com/blog/web-security/penetration-testing-pricing-guide. Vendor pricing guide with per-engagement cost ranges broken out by test type.
Ready to evaluate Stingrai against this framework?
Stingrai is a CREST-accredited offensive security company. Its penetration testers simulate real-world attacks across applications, cloud, networks, and people, with testing delivered through its PTaaS platform. We publish pricing publicly, name the testers on every human-led engagement, include free retests for High and Critical findings, and position ourselves as offensive security only.
Talk to Stingrai about scoping a hybrid pentest of one web application and its APIs at the published $6,800 tier (or US$1,275 per month on a 12-month continuous engagement, with autonomous coverage at US$3,000 per assessment or US$650 per month), or request a custom Enterprise PTaaS quote for continuous coverage across web, network, and adversary simulation.
