Human-Led Penetration Testing Services (2026): Manual Testing for Regulated Industries

Five separate regulatory regimes now describe who is allowed to run a penetration test, and every one of them describes a person. New York's Department of Financial Services requires "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually", per 23 NYCRR 500.5(a)(1). PCI DSS v4.0 requires testing "By a qualified internal resource or qualified external third-party" with "Organizational independence of the tester", per requirements 11.4.2 and 11.4.3 in the PCI SSC SAQ D for Service Providers. DORA Article 27 lists five conditions a tester must satisfy before a European financial entity may contract them, per Regulation (EU) 2022/2554. That is the market for human-led penetration testing in one paragraph: it exists because the people who write the rules keep writing "qualified person" into them.

Quick answer: Human-led penetration testing is a manual engagement where credentialed penetration testers scope the target, plan the attack path, drive the tooling by hand, chain individual weaknesses into a demonstrated business impact, and produce evidence an examiner will accept. It is what regulated buyers in banking, insurance, healthcare, government supply chains and enterprise SaaS purchase, because the regulations name a qualified party rather than a product. Stingrai is a CREST-accredited offensive security company whose penetration testers simulate real-world attacks across applications, cloud, networks and people, with testing delivered through its PTaaS platform, offered as one-time engagements or continuous programs with retests included. Full-attack-surface human-led engagements are scoped and quoted through the Enterprise tier, and the published web application packages start at US$3,000 one-time. Every figure is on the Stingrai pricing page.

What "human-led" actually means

The phrase has been diluted by marketing, so it is worth fixing a definition a procurement team can test a proposal against. A human-led penetration test has four properties:

1. A person sets the objective. Before any tooling runs, a tester has read the architecture, understood which records are worth stealing and which transactions are worth manipulating, and written an attack plan against it. Scanners have no concept of what your data is worth.

2. A person drives the exploitation. Requests are crafted and replayed by hand, sessions are swapped between roles deliberately, and multi-step workflows are broken on purpose. Tooling accelerates this work; it does not decide what to attempt next.

3. A person chains the findings. Individually unremarkable issues become a breach when combined. A verbose error message plus a predictable identifier plus a missing server-side authorization check is a full tenant compromise, and only a tester holding all three in mind at once writes it up that way.

4. A person signs the evidence. The report names the tester, the methodology, the scope, the dates and the retest outcome, because that is what an examiner asks for.

Automated scanning, dynamic application security testing, breach and attack simulation and autonomous agents all produce useful output and are legitimate parts of a testing program. None satisfies those four properties on its own, which is why the frameworks keep naming a qualified party.

Stingrai runs both models deliberately. Mobile, network, cloud, Active Directory, wireless, social engineering, adversary simulation and red team engagements are human-led. Web applications additionally have an autonomous and a hybrid package, which is covered in the sibling post, hybrid web application penetration testing in 2026. The rest of this guide is about the human-led side, which is what regulated buyers usually mean when they ask for manual testing.

What manual testing finds that scanners and autonomous tools miss

OWASP is unusually direct about this. On business logic, the Web Security Testing Guide states that this class of flaw "cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester", that "Automation of business logic abuse cases is not possible and remains a manual art", and that "Automated tools find it hard to understand context, hence it's up to a person to perform these kinds of tests."

The prevalence data says the same from the other direction. In the OWASP Top 10:2025, broken access control holds first place, and OWASP records that "100% of the applications tested were found to have some form of broken access control", across 40 mapped CWEs, 1,839,701 occurrences and 32,654 CVEs. Access control is the category where correctness depends on intent: a tool sees that an endpoint returned 200, but only a person knows the account which received it belonged to a different tenant.

Stingrai's AI pentest benchmark results 2026 is deliberately not a case against automation. It reports that the best autonomous agent in the largest public head-to-head placed second overall on a live network and beat nine of ten working professionals, that agents carried higher false-positive rates than every human in the comparison, and that every headline result still passed through a person before submission. Breadth and speed are now cheap; judgement, chaining and evidence are still the scarce parts, and regulated buyers are buying the scarce parts.

Why regulated buyers specify human-led testing: the actual text

This is the section to send to a procurement or audit colleague. Each row quotes the instrument itself, with a link to the primary document.

Four notes that matter when you write this into a statement of work.

NYDFS wants inside and outside. The text is explicit that testing runs "from both inside and outside the information systems' boundaries", which rules out an external-only engagement as a complete answer. The Second Amendment added a separate automated scanning obligation at 500.5(a)(2) with a transitional period of "18 months from the effective date of the second amendment", which ran to 1 May 2025 per 23 NYCRR 500.22. Scanning is additive to the annual test, not a substitute. Our NYDFS requirements guide walks the full control.

PCI DSS wants a methodology, not a tool. Requirement 11.4.1 requires that "A penetration testing methodology is defined, documented, and implemented by the entity" and that it include "Industry-accepted penetration testing approaches", coverage of the entire cardholder data environment perimeter and critical systems, testing from inside and outside the network, validation of segmentation and scope-reduction controls, application-layer testing for the vulnerabilities in Requirement 6.2.4, network-layer testing across components that support network functions and operating systems, review of threats seen in the last 12 months, a documented approach to risk, and retention of results for at least 12 months. On independence, the PCI SSC's Penetration Testing Guidance explains the bar plainly: "Qualified internal resources or a qualified third party may perform the penetration test as long as they are organizationally independent. This means the penetration tester must be organizationally separate from the management of the target systems." Our PCI DSS penetration testing guide covers 11.4.1 through 11.4.7 in order.

FedRAMP is a recognition question before it is a testing question. The 2026 consolidated rules state that FedRAMP "only accepts independent assessments that have been performed by FedRAMP Recognized independent assessment services", the population formerly called 3PAOs. Recognition rests on accreditation: A2LA states that "3PAOs are required to be accredited by A2LA in order to be recognized by FedRAMP", assessed against ISO/IEC 17020 with FedRAMP-specific requirements in A2LA R311, per the A2LA FedRAMP program page. A federal authorization is a separate procurement from your commercial penetration test.

DORA covers the tester, the scope and the evidence at once. Article 26 requires threat-led penetration testing "at least every 3 years", performed "on live production systems supporting" critical or important functions, and requires entities using internal testers to "contract external testers every three tests". Article 27 sets the five tester conditions quoted above. DORA has applied since 17 January 2025 per Article 64. Our DORA threat-led penetration testing guide explains how TIBER-EU maps onto it.

HIPAA is still proposed, and should be planned for anyway. The Security Rule NPRM published at 90 FR 898 on 6 January 2025 would add an explicit penetration testing implementation specification performed "by a qualified person" at least every 12 months, and as of September 2026 it remains a proposed rule. Treating it as a floor now is cheap; retrofitting a testing program during an enforcement action is not. See our HIPAA requirements guide and, for several regimes at once, the requirements by framework matrix.

CREST accreditation of a firm versus certification of a person

Buyers conflate these constantly, and vendors are happy to let them. They are different artifacts with different scopes.

Company accreditation is an audit of the business. CREST states that it assesses "policies, processes and competencies that member companies have in place for delivery of their services", covering quality processes and procedures, standards compliance such as ISO 27001 and ISO 9001, professional indemnity insurance, contract management, information security processes, and complaint handling and conflict of interest policies, per why use a CREST supplier. Notably, CREST's accreditation standards page states that "There is no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation, instead individuals are assessed based on their skills and experience or any qualifications they may hold."

Individual certification is an examination of a person. CREST describes the combination as the point of the scheme: "By combining the accreditation of member companies with the certification and assessment of their employees, CREST has unique insight that enables us to signpost skilled and competent service providers back to the buying community."

Two practical consequences follow. First, "our testers hold CREST certifications" and "our company holds a CREST accreditation" are different claims, and a buyer who needs the second should ask for the second. Second, both are verifiable: every accredited member company is listed on the CREST Marketplace with its accreditations and regions, so a badge on a website is never the last word. Stingrai Inc appears there with a Penetration Testing accreditation across Canada, Europe and North America. Our CREST-accredited penetration testing companies guide explains what each specific accreditation covers.

The tester credentials that matter, and why

Certifications are a screening signal, not a guarantee. PCI SSC says so directly: "Appropriate penetration testing experience and qualifications cannot be met by certifications alone." Its own guidance then lists OSCP, CEH, the GIAC family, "CREST Penetration Testing Certifications" and CHECK as examples worth looking for. Here is what the credentials that show up in regulated engagements actually test.

Stingrai's team holds OSCE3, OSCP, OSWE, OSEP, OSED, CREST CRT, CISSP, CRTO, CRTE, GCPN and eWPTX, and the firm holds a CREST Penetration Testing accreditation in its own right. Read the two together the way CREST intends: the accreditation says the delivery process is audited, the certifications say the people at the keyboard have been examined.

What to ask beyond the letters: how many engagements has this specific tester run in your sector, will the same people return for the retest, who writes the report, and can you see a redacted sample before you sign. A sample penetration testing report tells you more about a provider than a certification list does.

What a regulated-industry engagement looks like end to end

A compliant engagement is a sequence of artifacts as much as a sequence of activities. Each stage below produces something an examiner may later ask to see.

1. Scoping. Inventory the in-scope systems, roles, tenants, data classes, segmentation boundaries and the change history since the last test. For PCI, this is where you define the cardholder data environment perimeter and the segmentation controls that 11.4.1 requires you to validate. For DORA, this is where critical or important functions are identified, and Article 26(2) requires that the result of that assessment "shall be validated by the competent authorities". Our penetration testing scope of work template is a working starting point.

2. Rules of engagement. Written authorization, testing windows, out-of-scope systems, data-handling rules, escalation contacts, safe words for social engineering and physical work, and a defined stop condition. DORA Article 26(5) puts the same obligation in regulatory language, requiring "effective risk management controls to mitigate the risks of any potential impact on data, damage to assets, and disruption to critical or important functions".

3. Testing and evidence capture. Reconnaissance, mapping, authenticated testing per role, exploitation, privilege escalation, lateral movement and chaining, with screenshots, requests and responses, proof-of-concept code, timestamps and account context logged as the work happens. Regulated engagements include an authenticated component across every role, because that is where authorization defects live.

4. Reporting. An executive summary written for a board or a regulator, a technical body with reproduction steps and remediation guidance, a severity rationale, and an appendix recording methodology, scope, dates and testers. PCI DSS 11.4.1 also requires "Retention of penetration testing results and remediation activities results for at least 12 months", so archive it properly.

5. Remediation support, retest and handoff. Fixes are verified by the people who found the issues, and the retest result goes into the same package alongside the attestation letter, ready for the auditor, the customer security team or the enterprise prospect running a vendor review. Stingrai includes retests in its engagements. Our guide to the pentest evidence auditors accept covers what each framework asks for.

What the data says about a properly run engagement

Stingrai published its own platform data in The State of Penetration Testing 2026, covering 1,206 verified findings across 55 penetration tests. 92.7% of those tests surfaced at least one High or Critical issue, which is the strongest available argument against treating the annual test as a formality. The verified-finding false-positive rate was 0.74%, and the median time to close a Critical was 10.5 days. Those three numbers are the ones to benchmark any proposal against: what proportion of your tests find something that matters, how much of the report is noise, and how fast the important things actually get fixed.

Financial services and fintech

Financial services buyers are usually satisfying more than one regime at once, and the overlap is where money is saved.

A New York-regulated entity needs the annual internal and external test at 500.5(a)(1). A card-handling entity needs the PCI DSS 11.4 program, including segmentation validation, which for service providers runs every six months. A European financial entity in scope for DORA needs threat-led testing at least every three years, on live production systems, from testers meeting the Article 27 conditions. A fintech selling into banks needs a SOC 2 report and will be asked for the penetration test behind it by every enterprise prospect.

The practical build for most fintechs: one annual human-led engagement covering the authenticated application, its APIs and the internal network segment behind it; PCI segmentation testing on its own cadence; social engineering against staff with production access; and continuous testing between annual cycles so the months in the middle are not dark. If you move money on behalf of customers, put authorization and business logic at the top of the scope, because that is where fraud lives. Verizon's 2026 Data Breach Investigations Report records that 31% of breaches start with software vulnerabilities, and IBM's Cost of a Data Breach Report 2026 puts the global average at US$4.99M, "a 12% increase over last year and a record high".

Sector reading: best fintech penetration testing companies and the NYDFS requirements guide.

Healthcare and healthtech

Healthcare buyers are working from a rule that is written but not yet final, and from contractual pressure that is very real today.

The proposed Security Rule would require penetration testing "by a qualified person" at least every 12 months, alongside vulnerability scanning at least every six months. Until it is finalized, most healthcare penetration testing is driven by business associate agreements, health system vendor reviews, insurance questionnaires and state law. The scope that keeps coming up: the patient-facing portal and its APIs, the integration layer where HL7 and FHIR traffic moves, role separation between clinical and administrative users, and the internal network where medical devices share segments with workstations.

Two scoping notes specific to this sector. Authorization testing is not optional, because the classic healthcare breach is one authenticated user reading another patient's record through a predictable identifier. And production testing needs a genuinely conservative rules-of-engagement document, because clinical systems are safety systems. A provider that will not discuss stop conditions in detail is the wrong provider for a hospital.

Sector reading: HIPAA penetration testing requirements and best healthcare penetration testing companies.

SaaS companies selling to regulated enterprises

If your customers are banks, insurers or hospitals, their regulators reach you through the contract. You inherit the obligation without being the regulated entity, which is why a SaaS security questionnaire now routinely asks for an annual third-party penetration test report, a retest record and the tester's qualifications.

The efficient pattern is one human-led engagement per year that is scoped to satisfy the strictest customer rather than the average one, kept current with continuous testing in between, and packaged so that the same evidence answers SOC 2, ISO 27001 and customer due diligence without rework. Timing matters for SOC 2 Type 2 specifically, because the test has to fall inside the observation window to be useful: see SOC 2 Type 2 penetration testing timing and the ISO 27001 penetration testing requirements guide.

Two clauses to get into your own customer contracts and your vendor contracts: a right-to-test clause with defined scope and notice, and a retest obligation with a deadline attached to severity. Both are easier to negotiate before an incident than after.

Sector reading: best SaaS penetration testing companies and web application penetration testing services.

Public sector and government supply chain

Government work splits into two very different purchases. The first is an accreditation-gated assessment, where only a recognized assessor can produce acceptable evidence: FedRAMP is the clearest example, and in the United Kingdom the equivalent gating for government and critical national infrastructure work runs through NCSC CHECK, which several providers below hold alongside their CREST accreditations. The second is a commercial penetration test bought by a public body or a supplier to one, where the requirement is competence and evidence rather than a specific scheme, and which looks like any other regulated engagement: scoped, authorized, manual, evidenced and retested.

The mistake to avoid is assuming those two purchases are interchangeable. If your roadmap includes a federal authorization, plan the assessor procurement separately and early.

Pricing and timelines

Prices move with scope, and the honest answer to "what does a penetration test cost" is a range plus the variables that move it. Stingrai publishes its web application package prices: US$3,000 for a one-time Autonomous Pentest or US$650 per month on a 12-month continuous plan, and US$6,800 for a one-time Hybrid Pentest or US$1,275 per month continuous, each covering one web application and its APIs, per the pricing page and the Snipe page. Fully human-led engagements across network, Active Directory, cloud, wireless, social engineering, adversary simulation and physical perimeter testing are scoped and quoted through the Enterprise tier, because those scopes vary too much to list a single number against.

For a defensible budget number before you talk to anyone, use the penetration testing cost calculator, then read the 2026 penetration testing cost guide for the market context. On duration, how long a penetration test takes breaks the calendar into scoping, testing, reporting and retest so you can work backwards from an audit date.

One scheduling rule worth internalizing: book backwards from the evidence deadline, not forwards from today. A SOC 2 Type 2 observation window, a PCI assessment date, a DORA test cycle and an enterprise customer review all have fixed dates, and reporting plus remediation plus retest is the part that runs long.

How to evaluate a provider

Ten questions that separate providers quickly, and the answers that should worry you.

1. Is the firm accredited, and where can I verify it? A good answer names the scheme and the listing. Verify it yourself on the CREST Marketplace rather than trusting the badge.

2. Who exactly will test, and what do they hold? Ask for the named testers and their certifications, not a company-wide list.

3. Will the same people run the retest? Continuity is where a lot of the value sits, and it is rarely promised unless asked.

4. What is your methodology, and can I see it mapped to my framework? PCI 11.4.1 requires the methodology to exist and to be documented; a provider who cannot show theirs is a poor fit for a PCI environment.

5. Can I see a redacted report? The report is the product. Judge it before you buy.

6. How do you test authorization across roles and tenants? A vague answer here predicts a shallow test, because this is the hard part.

7. What is your false-positive posture? Ask how findings are verified before they reach the report, and what proportion get withdrawn.

8. Is retesting included, and for how long? Get the window in writing.

9. How do you handle our data? Storage, retention, jurisdiction and destruction. DORA Article 27(3) makes this a regulatory question for European financial entities.

10. What happens if you break something? Stop conditions, escalation contacts, insurance. DORA Article 27(1)(e) requires professional indemnity insurance for TLPT testers; it is a reasonable question everywhere else too.

Red flags, in rough order of severity: a proposal that quotes a fixed price before scoping; a sample report that is a scanner export with a cover page; refusal to name testers or share certifications; no retest in the base price; findings delivered only in a portal with no exportable evidence package; a methodology section that cites no recognized standard; and any claim that a tool output alone satisfies a named regulation.

For a longer list you can drop straight into a procurement pack, use the penetration test and red team RFP question bank.

Ten human-led, CREST-accredited providers for regulated industries

Every company below was verified on the CREST Marketplace on 11 September 2026, and the accreditations and regions shown are the ones on each firm's own listing. Ranking reflects fit for regulated-industry human-led testing: accreditation scope, evidence quality, continuity of testers, and how much of the engagement is manual rather than tool-driven. Verify any accreditation yourself before an audit, because they renew on a cycle.

1. Stingrai

CREST accreditation: Penetration Testing. Regions: Canada, Europe, North America. Verify: marketplace.crest.org/stingrai.

Stingrai is a CREST-accredited offensive security company. Its penetration testers simulate real-world attacks across applications, cloud, networks, and people, with testing delivered through its PTaaS platform. Headquartered in Toronto, Canada with a London, UK office, founded in 2021, the team holds OSCE3, OSCP, OSWE, OSEP, OSED, CREST CRT, CISSP, CRTO, CRTE, GCPN and eWPTX, and has published 18 CVEs. Engagements are sold as one-time penetration tests or continuous programs, and retests are included in both. Mobile, network, cloud, Active Directory, wireless, social engineering, adversary simulation and red team work is human-led; web applications also have autonomous and hybrid packages for teams that want release-cadence coverage between annual engagements. Prices for the web application packages are published; full-attack-surface human-led scopes are quoted. Stingrai's penetration testing supports SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, NIST SP 800-53 and 800-171, DORA and NIS2 programs. Best for regulated SaaS, fintech and healthtech buyers who want examiner-ready evidence, named testers who return for the retest, and a published price they can put in a budget line.

2. NCC Group

CREST: Penetration Testing, Threat Led Penetration Testing, TLPT-FS, Cyber Threat Intelligence, Incident Response, Incident Exercising, Security Operations Centre, Vulnerability Assessment. Regions: UK, Europe, North America, Middle East, Asia and Pacific. Member: 19 years. Also listed: CBEST, STAR-FS, NCSC CHECK, CIR, CAA ASSURE, TIBER-EU, GBEST, ISO 27001, ISO 9001. Verify: marketplace.crest.org/ncc-group.

The broadest accreditation set of any firm here, and the obvious shortlist entry when the requirement is a regulator-recognized scheme rather than a commercial test. Best for large financial institutions running CBEST, TIBER-EU or GBEST exercises, and for organizations wanting testing, threat intelligence and incident response from one accredited supplier.

3. Pen Test Partners

CREST: Penetration Testing, Threat Led Penetration Testing, TLPT-FS, Application Security Testing, Mobile Application Security Testing, Incident Response, Vulnerability Assessment. Regions: UK, Europe, North America. Member: 16 years. Also listed: NCSC CHECK, CBEST, STAR-FS, GBEST, PCI DSS QSA, CAA ASSURE, ISO 27001, Cyber Essentials Plus. Verify: marketplace.crest.org/pen-test-partners.

A consultancy with unusually deep specialist practices, including aviation, maritime, automotive and industrial control systems, and a long public research record. Best for organizations with awkward technology that a generalist will under-test, and for UK entities needing CHECK and CBEST alongside commercial work.

4. LRQA, cyber services formerly known as Nettitude

CREST: Penetration Testing, Threat Led Penetration Testing, TLPT-FS, Cyber Threat Intelligence, Application and Mobile Application Security Testing, Incident Response, Security Operations Centre, Vulnerability Assessment. Regions: Europe, Asia and Pacific, Latin America and Caribbean, Middle East and others. Member: 17 years. Also listed: CBEST, PCI DSS QSA, NCSC CHECK, Singapore CSA penetration testing licence, ISO 27001, ISO 9001. Verify: marketplace.crest.org/lrqa.

Assurance-group scale with a full CREST accreditation set and licensing in multiple jurisdictions. Best for multinational regulated groups that need consistent testing and reporting across regions.

5. Prism Infosec

CREST: Penetration Testing, Threat Led Penetration Testing, TLPT-FS, Incident Response, Incident Exercising, Vulnerability Assessment. Regions: UK, Europe. Member: 10 years. Also listed: PCI DSS QSA, NCSC CHECK, NCSC Cyber Advisor, CAA ASSURE, ISO 27001, ISO 9001. Verify: marketplace.crest.org/prism-infosec.

A UK consultancy pairing CREST accreditations with PCI QSA status, a useful combination when the same programme needs both the test and the assessment relationship managed carefully for independence. Best for UK financial services and payment-handling organizations wanting a hands-on team rather than a large account structure.

6. JUMPSEC

CREST: Penetration Testing, AI-Enabled Penetration Testing, Threat Led Penetration Testing, Incident Response, Incident Exercising, Security Operations Centre, Vulnerability Assessment. Regions: UK, Europe. Member: 14 years. Also listed: CREST AI Charter, NCSC CHECK, CIR, CIE, CAA ASSURE, ISO 27001, ISO 9001. Verify: marketplace.crest.org/jumpsec.

One of the firms carrying CREST's AI-Enabled Penetration Testing accreditation alongside the traditional ones, which is a signal worth noting as more providers add agents to human engagements. Best for UK organizations wanting threat-led testing and incident capability from a mid-sized team.

7. NetSPI

CREST: Penetration Testing, Threat Led Penetration Testing. Regions: Europe, North America. Member: 10 years. Listing details: Minneapolis headquarters, 500 to 999 employees, offices in the United States, Canada, the United Kingdom and India. Verify: marketplace.crest.org/netspi.

Large-scale North American provider combining human testing with a delivery platform, and a common shortlist entry for enterprise programmes coordinating many tests across business units. Best for large enterprises consolidating a fragmented testing programme under one vendor.

8. Secure Ideas

CREST: Penetration Testing. Regions: North America, United States. Member: 2 years. Also listed: CREST AI Charter, CMMC Level 1. Verify: marketplace.crest.org/secure-ideas.

A smaller United States consultancy focused on security testing with a training arm, holding a CREST accreditation that is still uncommon among US-only firms. Best for United States mid-market organizations wanting a hands-on team with defence-supply-chain awareness.

9. Cobalt Labs

CREST: Penetration Testing. Region: Europe. Member: 8 years. Also listed: ISO 27001. Verify: marketplace.crest.org/cobalt-labs.

A platform model that provisions testers from a large community against scoped engagements, with credits as the commercial unit. Rated below the consultancies above for regulated work because tester continuity is buyer-requested rather than default. Best for portfolios of many small tests where speed to start matters more than the same team every cycle.

10. BreachLock

CREST: Penetration Testing. Regions: UK, Europe. Member: 5 years. Also listed: ISO 27001, Cyber Essentials, SOC 2 Type 2. Verify: marketplace.crest.org/breachlock.

A PTaaS platform combining automation with human testers, marketed around fast scoping and unlimited retesting inside the platform. Best for teams wanting a delivery portal and frequent retests, with the caveat that regulated buyers should confirm in writing which parts of a given engagement are manual.

Several large consultancies and audit firms also hold CREST accreditations and do substantial regulated work. They are outside this list only because it is limited to providers whose primary product is penetration testing. Whichever firm you shortlist, verify the accreditation, the region and the scope on the marketplace rather than trusting a badge.

Frequently Asked Questions

What is human-led penetration testing?

Human-led penetration testing is a manual engagement in which credentialed penetration testers scope the target, plan the attack path, drive the tooling by hand, chain weaknesses into a demonstrated impact and produce evidence an examiner will accept. Four things separate it from automated scanning and autonomous testing: a person sets the objective, a person drives the exploitation, a person chains the findings, and a person signs the evidence. OWASP puts the technical case plainly for one whole class of defect, stating that business logic flaws "cannot be detected by a vulnerability scanner and relies upon the skills and creativity of the penetration tester".

Do regulators actually require manual penetration testing?

They require a qualified party, which in practice means people. NYDFS requires testing "by a qualified internal or external party at least annually" at 23 NYCRR 500.5(a)(1). PCI DSS v4.0 requires testing "By a qualified internal resource or qualified external third-party" with organizational independence, at 11.4.2 and 11.4.3. DORA Article 27 sets five conditions on testers, including accreditation or a formal code of conduct and professional indemnity insurance. The proposed HIPAA Security Rule would require testing "by a qualified person". None of those phrases describes a product licence.

What does CREST accreditation of a company mean, and how is it different from CREST CRT?

Company accreditation is an audit of the business: CREST assesses "policies, processes and competencies that member companies have in place for delivery of their services", including quality processes, standards compliance, professional indemnity insurance, contract management and conflict of interest policies. CREST CRT is an examination of an individual, a 2.5-hour practical exam with CPSA as a prerequisite. CREST notes there is "no mandatory requirement for individuals to be CREST qualified for a company to achieve accreditation". Ask for whichever one your requirement names, and verify it on the CREST Marketplace.

How much does a human-led penetration test cost in 2026?

It depends on scope. Stingrai publishes US$3,000 for a one-time Autonomous Pentest and US$6,800 for a one-time Hybrid Pentest, each covering one web application and its APIs, with continuous options at US$650 and US$1,275 per month, on the pricing and Snipe pages. Fully human-led engagements across networks, cloud, Active Directory, wireless, social engineering and physical perimeter testing are quoted per scope. Estimate your range with the pentest cost calculator and read the cost guide before comparing proposals.

How often does a regulated organization need to test?

NYDFS says at least annually. PCI DSS says at least once every 12 months and after any significant infrastructure or application upgrade or change, with segmentation testing on its own cadence. The proposed HIPAA rule says at least once every 12 months or per your risk analysis, whichever is more frequent. DORA requires threat-led testing at least every three years on top of the regular programme. Most regulated organizations run one deep annual engagement plus continuous coverage in between, because release velocity does not pause between audits.

Can an AI or autonomous tool satisfy a penetration testing requirement?

Not on its own where the framework names a qualified person or an accredited assessor, and not where the report has to carry an attestation. Autonomous testing is genuinely useful for breadth, speed and regression coverage between engagements, and Stingrai sells it for web applications. For the audit artifact itself, buy the engagement whose stated output is the examiner-ready report signed by qualified testers. Our analysis of whether an auditor will accept an AI pentest walks through what assessors ask.

What is the difference between a penetration test and a red team engagement?

A penetration test aims for coverage of a defined scope: find as many real, exploitable issues as possible in the systems named in the statement of work. A red team engagement aims for an objective, such as reaching a specific dataset or payment function, and tests detection and response as much as technology. Regulated threat-led testing under DORA or CBEST sits closer to the red team end, and DORA requires it on live production systems. See red team versus penetration test.

What should a report contain for an auditor to accept it?

An executive summary, the scope and dates, the methodology mapped to a recognized standard, each finding with severity rationale and reproduction steps, remediation guidance, the retest result, and an appendix identifying the testers. PCI DSS 11.4.1 also requires retention of results and remediation records for at least 12 months. Look at a sample penetration testing report before you commission one, and read the pentest evidence auditors accept for framework detail.

Does the tester have to be external?

Not always. PCI DSS permits "a qualified internal resource or qualified external third-party" provided the tester is "organizationally separate from the management of the target systems". NYDFS permits "a qualified internal or external party". DORA permits internal testers under conditions, but requires entities to "contract external testers every three tests" and requires the threat intelligence provider to be external. FedRAMP is the strict case: assessments must come from a FedRAMP Recognized independent assessment service.

How long does a regulated engagement take end to end?

Plan on scoping the week before testing, a testing window measured in days to weeks depending on scope, reporting after that, remediation on your own timeline, and a retest to close. Stingrai's platform data shows a median of 10.5 days to close a Critical finding, with High findings taking longer, so the retest usually determines the end date. Work backwards from your audit deadline rather than forwards from today. See how long a penetration test takes.

Related Reading

• Hybrid web application penetration testing 2026: what it finds and what it costs

• NYDFS penetration testing requirements 2026

• HIPAA penetration testing requirements 2026

• Penetration testing requirements by framework 2026

• ISO 27001 penetration testing requirements 2026

• SOC 2 Type 2 penetration testing timing 2026

• Penetration testing cost guide 2026

• The State of Penetration Testing 2026

Talk to Stingrai

If a regulator, an auditor or an enterprise customer has asked you for a human-led penetration test, the fastest way to a defensible answer is a scoping conversation against your real architecture: how many applications and roles, where the regulated data sits, which frameworks are in play, and what date the evidence is due. Book a free scoping call, get a quote, or read the published pricing.

References

1. New York State Department of Financial Services. _23 NYCRR 500.5, Vulnerability management._ https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.5. Codified Part 500 text, including the annual penetration testing obligation at 500.5(a)(1).

2. New York State Department of Financial Services. _23 NYCRR 500.22, Transitional periods._ https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.22. Deadlines following the Second Amendment effective 1 November 2023.

3. PCI Security Standards Council. _PCI DSS v4.0 Self-Assessment Questionnaire D for Service Providers._ April 2022. https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Service-Provider.pdf. Verbatim text of Requirements 11.4.1 through 11.4.4.

4. PCI Security Standards Council. _Information Supplement: Penetration Testing Guidance, v1.1._ September 2017. https://listings.pcisecuritystandards.org/documents/Penetration-Testing-Guidance-v1_1.pdf. Organizational independence and how to assess tester qualifications.

5. FedRAMP. _Consolidated Rules for 2026: Assessors._ https://www.fedramp.gov/2026/assessors/. States that FedRAMP accepts only assessments from FedRAMP Recognized independent assessment services.

6. A2LA. _FedRAMP Third-Party Assessment Organizations (3PAO)._ https://a2la.org/accreditation/fedramp/. The accreditation requirement, the ISO/IEC 17020 basis and the R311 FedRAMP-specific requirements.

7. European Union. _Regulation (EU) 2022/2554 (DORA), Articles 26, 27 and 64._ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A32022R2554. TLPT frequency, production scope and the five tester conditions.

8. US Department of Health and Human Services. _HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information._ Proposed rule, 90 FR 898, 6 January 2025. https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information. Proposed 45 CFR 164.312(h)(2)(iii), penetration testing by a qualified person.

9. OWASP Foundation. _Web Security Testing Guide: Introduction to Business Logic._ https://owasp.org/www-project-web-security-testing-guide/stable/4-Web_Application_Security_Testing/10-Business_Logic_Testing/. Business logic flaws cannot be detected by a vulnerability scanner.

10. OWASP Foundation. _OWASP Top 10:2025, A01 Broken Access Control._ https://owasp.org/Top10/. Prevalence data: 40 mapped CWEs, 1,839,701 occurrences, 32,654 CVEs.

11. CREST. _Why use a CREST supplier._ https://www.crest-approved.org/approved-services/why-use-a-crest-supplier/. What company accreditation assesses and how it pairs with individual certification.

12. CREST. _Accreditation standards._ https://www.crest-approved.org/membership/accreditation-standards/. Individuals are assessed on skills and experience rather than a mandatory CREST qualification.

13. CREST. _CREST Marketplace._ https://marketplace.crest.org/. Public register of accredited member companies; every provider here was verified on 11 September 2026.

14. OffSec. _PEN-200 and the OSCP certification._ https://www.offsec.com/courses/pen-200/. Exam format, duration and mark allocation.

15. OffSec. _OSCE3 certification._ https://www.offsec.com/certificates/osce3/. Confirms OSCE3 comprises OSWE, OSEP and OSED.

16. CREST. _CREST Registered Penetration Tester (CRT)._ https://www.crest-approved.org/skills-certifications-careers/crest-registered-penetration-tester/. Exam format, duration, mark split and prerequisite.

17. Verizon. _2026 Data Breach Investigations Report._ https://www.verizon.com/business/resources/reports/dbir/. 31% of breaches start with software vulnerabilities.

18. IBM. _Cost of a Data Breach Report 2026._ https://www.ibm.com/reports/data-breach. Global average breach cost of US$4.99M, a record high.

19. Stingrai. _The State of Penetration Testing 2026._ https://www.stingrai.io/blog/state-of-penetration-testing-2026. 1,206 verified findings across 55 tests, 92.7% surfacing a High or Critical, 0.74% false-positive rate, median Critical fix 10.5 days.

20. Stingrai. _AI pentest benchmark results 2026._ https://www.stingrai.io/blog/ai-pentest-benchmark-results-2026. Public autonomous-agent benchmarks and their false-positive behaviour against human testers.