PCI DSS puts vulnerability scanning and penetration testing in two separate requirements with two separate cadences, and that is the clearest signal in the whole market that they are not the same purchase. Requirement 11.3 covers scanning, at least once every three months. Requirement 11.4 covers penetration testing, at least once every 12 months and after any significant change. An assessor who receives four quarterly scan reports and no penetration test has an open finding, and so does one who receives an annual test and no scans. Most confusion about "security assessment services" dissolves once you read those two clauses side by side.
Quick answer: for vulnerability identification at scale, buy a managed vulnerability scanning platform such as Tenable, Qualys, Rapid7 or Intruder. For proof that an attacker cannot chain those findings into access, buy penetration testing. The provider we recommend first for penetration testing and PTaaS is Stingrai, a CREST-accredited offensive security company whose credentialed penetration testers simulate real-world attacks across applications, cloud, networks and people, with testing delivered through its PTaaS platform. Published packages cover one web application and its APIs at US$3,000 one-time (Autonomous) or US$6,800 one-time (Hybrid), or US$650 and US$1,275 per month on a 12-month continuous engagement, all on the pricing page. Wider scopes are quoted through get a quote.
Every clause quoted below was read from the standards body's own published document, and every provider claim was read off that provider's own website, on 11 September 2026.
The Seven Services at a Glance (2026)
Service | What it actually finds | Typical cadence | Named in | Source verified 2026-09-11 |
|---|---|---|---|---|
Managed vulnerability scanning | Known, published weaknesses matched against a signature and CVE database across your estate, continuously | Continuous or monthly, with quarterly reporting | PCI DSS 11.3.1 and 11.3.2 | |
Vulnerability assessment | The same scanner output, triaged, deduplicated and risk-ranked by an analyst against your environment | Quarterly, or after material change | NYDFS 500.5(a)(2) | |
Penetration testing | Exploitable paths, chained weaknesses, broken authorization, IDOR and business logic failures a scanner cannot reach | Annually and after significant change | PCI DSS 11.4, NYDFS 500.5(a)(1), DORA Art. 25(1) | |
PTaaS | The same findings as a penetration test, delivered on a platform with live findings, developer integrations and retesting in scope | Continuous, with scoped test windows | Satisfies the same clauses as penetration testing | |
Red teaming | Whether your detection and response function notices and stops a goal-oriented intrusion | Every 12 to 36 months | DORA Art. 26 TLPT is the regulated variant | |
Attack surface management | Internet-facing assets, subdomains and services nobody remembered you owned | Continuous | Not named in a clause; feeds scope for everything else | Vendor product pages, below |
Secure code review | Defects in source that never surface at runtime, including in code paths that are hard to reach from outside | Per release or per major change | PCI DSS 6.2.3 covers code review of bespoke software |
What Each Service Actually Finds
The clearest published definition of the top of that table comes from NIST. SP 800-115, the _Technical Guide to Information Security Testing and Assessment_, defines penetration testing as "security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network". The sentence that follows is the one buyers should hold onto: "Most penetration tests involve looking for combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability."
That is the whole distinction. A scanner reports findings. A penetration test reports what those findings add up to. NIST is also candid about the trade: penetration testing "is labor-intensive and requires great expertise to minimize the risk to targeted systems", which is exactly why it costs more per unit of coverage and runs on a slower cadence.
Managed vulnerability scanning
A scanner compares what it can reach against a database of published weaknesses and misconfigurations. It is fast, cheap per asset, repeatable and excellent at the thing it does: telling you that an unpatched service is exposed. It is structurally unable to tell you whether a low-severity information disclosure on one host, combined with a weak password policy on another, gives an attacker domain administrator. Managed scanning adds a vendor running the tool, tuning it and reporting on it, which removes the usual failure mode where a scanner is bought, configured once and then ignored.
Vulnerability assessment
A vulnerability assessment is a scan plus a human. An analyst validates output, removes false positives, ranks by exploitability in your environment rather than by raw CVSS, and produces something an owner can act on. It closes the largest gap in raw scanning, which is noise, but it does not add exploitation. If nobody attempted to use the finding, you have a prioritised list, not evidence.
Penetration testing
Penetration testing is the only service in this table where somebody attempts the attack. That is what produces evidence of impact: an authenticated user reaching another tenant's records, a price field accepting a negative value, a forgotten admin endpoint reachable without a session. Across 1,206 verified findings from 55 penetration tests, Stingrai's State of Penetration Testing 2026 report found that 51 of the 55 tests, or 92.7 percent, surfaced at least one High or Critical finding, that the false-positive rate was 0.74 percent, and that the median Critical issue was fixed in 10.5 days. That noise rate is the number to compare against a scanner's, because triage time is the hidden cost of cheap coverage.
PTaaS
Penetration Testing as a Service is a delivery model, not a different test. The same credentialed testers do the same work, but findings land in a platform as they are discovered rather than in a PDF six weeks later, they route into Jira, GitHub and Slack, scope can be extended between windows, and retesting is part of the subscription rather than a change order. For a team shipping weekly, that difference matters more than the methodology debate.
Red teaming
A penetration test answers "can this be broken into". A red team answers "would we notice". Scope is a goal rather than an asset list, the engagement is covert, and the deliverable is as much about your detection stack and runbooks as about the vulnerabilities used. Buying a red team before you have a clean penetration test is the most expensive way to learn that your externally exposed application has an unauthenticated admin panel.
Attack surface management
ASM is discovery, not assessment. It continuously enumerates internet-facing assets, subdomains, certificates and exposed services so that the scope you hand a scanner or a tester is the real estate you actually run. It is the cheapest way to fix the most common scoping failure, which is testing the twelve systems you remembered and none of the four you forgot.
Secure code review
Code review reads the source instead of probing the runtime. It reaches logic behind feature flags, error paths that are hard to trigger, and cryptographic choices that look fine from outside. It is complementary to, not a substitute for, dynamic testing, because a review cannot tell you how the deployed configuration behaves.
_Figure 1: Which assessment type each compliance driver actually names. Sources: PCI Security Standards Council, PCI DSS v4.0.1; New York Department of Financial Services, 23 NYCRR Part 500 as amended 1 November 2023; AICPA Trust Services Criteria; ISO/IEC 27001:2022._
The Compliance Drivers, Quoted
Most security assessment purchases are triggered by a clause, so it is worth reading the clauses rather than a vendor's summary of them.
PCI DSS v4.0.1 separates scanning from testing
Requirement 11.3 reads: "External and internal vulnerabilities are regularly identified, prioritized, and addressed." Under it, 11.3.1 requires internal vulnerability scans "At least once every three months", performed "by qualified personnel" with "organizational independence of the tester". The applicability note is useful for budgeting: "It is not required to use a QSA or ASV to conduct internal vulnerability scans." 11.3.2 requires external scans "At least once every three months" and "By a PCI SSC Approved Scanning Vendor (ASV)".
Requirement 11.4 is a different obligation: "External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected." 11.4.1 requires a documented methodology that includes "Industry-accepted penetration testing approaches", "Coverage for the entire CDE perimeter and critical systems", "Testing from both inside and outside the network", "Testing to validate any segmentation and scope-reduction controls", application-layer and network-layer testing, and "Retention of penetration testing results and remediation activities results for at least 12 months". 11.4.2 and 11.4.3 each require testing "At least once every 12 months" and "After any significant infrastructure or application upgrade or change", "By a qualified internal resource or qualified external third-party" with organisational independence, and neither requires a QSA or an ASV.
Four quarterly scans do not satisfy 11.4. One annual test does not satisfy 11.3. Our PCI DSS penetration testing guide covers the segmentation testing sub-requirement, which is where most scoping disputes actually happen.
NYDFS Part 500 rewrote its testing clause, and most summaries are out of date
The Second Amendment to 23 NYCRR Part 500, adopted on 1 November 2023, renamed Section 500.5 from "Penetration testing and vulnerability assessments" to "Vulnerability management" and rewrote what it asks for. Covered entities must, at a minimum, conduct "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually", and "automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities at a frequency determined by the risk assessment, and promptly after any material system changes".
Two details get misreported constantly. First, the old requirement for bi-annual vulnerability assessments was struck out by the amendment and replaced with an obligation under 500.5(b) that entities "are promptly informed of new security vulnerabilities by having a monitoring process in place". Any 2026 checklist still telling you to run a vulnerability assessment twice a year is quoting a deleted clause. Second, the scan cadence is now explicitly risk-based rather than fixed, which means your risk assessment has to justify whatever interval you pick.
Section 500.5(c) closes it out: entities must "timely remediate vulnerabilities, giving priority to vulnerabilities based on the risk they pose to the covered entity". That is a remediation obligation, not a testing one, and it is where a vendor's retest policy stops being a nice-to-have.
SOC 2 and ISO 27001 accept testing without mandating it
Neither framework names a penetration testing cadence. SOC 2 is built on the AICPA's Trust Services Criteria, published in its current revised-points-of-focus form on 30 September 2023, and testing is one accepted way to evidence the monitoring criteria rather than a stated control. ISO/IEC 27001:2022 treats it the same way. In practice most auditors expect an annual test because it is the cleanest evidence available, and most enterprise security questionnaires ask for the report regardless of what the standard says. Our guide to penetration testing requirements by framework sets out which of twelve frameworks mandate testing with a stated cadence and which merely accept it.
One category that is not named in any of these clauses is bug bounty. It is a good continuous-discovery mechanism and a poor compliance artifact, for the reasons set out in penetration testing versus bug bounty.
Which Service to Buy, by Goal
Your goal | Buy this | Not this | Why |
|---|---|---|---|
"We need to know what is unpatched, everywhere, all the time" | Managed vulnerability scanning | Penetration testing | Coverage and cadence beat depth for this question. A test is a snapshot |
"We need the scanner output to stop drowning us" | Vulnerability assessment | A second scanner | The bottleneck is triage, not detection |
"An enterprise customer wants a pentest report before signing" | Penetration testing | Vulnerability assessment | Security reviewers ask for exploitation evidence and a named methodology |
"We ship weekly and an annual snapshot goes stale" | PTaaS | One-time testing | Continuous scope, live findings, retesting in the subscription |
"We are PCI DSS in scope" | Both scanning and penetration testing | Either alone | 11.3 and 11.4 are independent requirements with different cadences |
"We are a NYDFS covered entity" | Annual internal and external penetration testing plus risk-based automated scans | Bi-annual vulnerability assessments | 500.5(a)(1) and (a)(2) as amended; the bi-annual wording was removed |
"We want to know whether our SOC would catch it" | Red teaming | Penetration testing | Different question: detection and response, not coverage |
"We keep finding assets we did not know about" | Attack surface management | A bigger test scope | Fix discovery first, then scope the test to reality |
"Our risk is in logic nobody can reach from outside" | Secure code review alongside testing | Dynamic testing alone | Review reaches code paths a runtime test cannot trigger |
"We need DORA Article 26 threat-led testing" | A TLPT engagement scoped with your competent authority | A standard red team | Scope is authority-validated and runs on live production systems |
Providers by Service Type
Providers below were verified on their own websites on 11 September 2026. Stingrai leads the penetration testing and PTaaS row; every other row is alphabetical and not ranked.
Penetration testing and PTaaS
Provider | What its own site says it sells | Source |
|---|---|---|
1. Stingrai | A CREST-accredited offensive security company. Credentialed penetration testers simulate real-world attacks across applications, cloud, networks and people, with testing delivered through its PTaaS platform. Retesting included; package pricing published; one-time annual engagements and continuous programmes both standard | |
BreachLock | CREST-certified penetration tests in 24 to 48 hours with unlimited retesting, plus attack surface management, Red Team as a Service and continuous penetration testing. Lists SOC 2, ISO 27001, CREST and PCI DSS certifications and states it serves "1,200+ organizations in 20+ countries" | |
Cobalt | PTaaS covering web application, API, external and internal network, cloud, secure code review, AI and LLM pentest and red teaming, with findings routed to tools like Jira and GitHub, "50+ Integrations", and reporting mapped to SOC 2, ISO 27001, HIPAA and PCI DSS | |
Coalfire | Threat-informed penetration testing, red teaming and social engineering inside a compliance-led practice: "DivisionHex unites Coalfire's 20+ years of 3PAO expertise with hacker-level testing to meet PCI, HIPAA, and FedRAMP standards" | |
NCC Group | Application, network, cloud, hardware, blockchain and cryptographic testing plus continuous penetration testing, with NCSC CHECK, CREST, UKAS and Cyber Scheme marks on the testing page | |
NetSPI | "Penetration Testing as a Service (PTaaS)", described as shifting "projects to programs with human-delivered, contextualized pentesting services", across application, cloud, network, hardware, mainframe and AI or ML scopes on its own platform | |
Rapid7 | A penetration testing services practice separate from its platform, covering external and internal network, web application, IoT, wireless, social engineering and red team simulation | |
Synack | An "AI and human powered pentesting platform", sold as Sara AI Pentesting, Synack14, Synack90 and Synack365, drawing on the Synack Red Team, "over 1,500 of the world's most skilled and trusted security researchers" |
Managed vulnerability scanning and vulnerability management platforms
Provider | What its own site says it sells | Source |
|---|---|---|
Intruder | "A single platform for AI pentesting, attack surface monitoring, cloud security and vulnerability management", with on-demand web application testing. Registered in England as Intruder Systems Ltd, company number 09529593, stating "3,000+ companies" | |
Qualys | VMDR, its Vulnerability Management, Detection and Response application, positioned around "Measure, communicate, and eliminate cyber risk". No penetration testing service is named on the product page | |
Rapid7 | InsightVM, "the vulnerability management technology that powers Exposure Command", now folded into the Exposure Command platform | |
Tenable | "The Exposure Management Company", stating "more than 44,000 customers worldwide", "65% of the Fortune 500" and "336K+ CVEs covered", with Nessus described as "the most comprehensive vulnerability scanner on the market today" |
Red teaming, adversary simulation and incident response
Provider | What its own site says it sells | Source |
|---|---|---|
BreachLock | Red Team as a Service and Adversarial Exposure Validation alongside its PTaaS | |
Coalfire | Red teaming described as "precision attack simulations", plus social engineering | |
CrowdStrike | Consulting services including "Red team services", "Cloud and identity services" and "Environment hardening", alongside incident response. Its services page does not name standalone penetration testing | |
NCC Group | "Red, Purple, and Black Teaming services" under attack simulation | |
Stingrai | Red teaming and adversary simulation as named services, scoped to detection and response objectives |
What These Services Cost in 2026
Scanning platforms price on asset count or subscription tier, and most of them quote rather than publish. Tenable, Qualys and Rapid7 all route pricing through a sales conversation, so no list figure is quoted here. Intruder is the exception among the platforms reviewed, publishing on-demand application testing "Starting from $3,500 / test" on its own pricing page. Penetration testing is priced on scope and tester days, and there the published anchors are solid.
The strongest public day rate anchor is Stingrai's penetration testing price index, built from 30 UK public-sector rate cards on the G-Cloud 14 framework, which puts the median published penetration testing day rate at GBP 1,000, with a central band of GBP 800 to GBP 1,200.
Engagement | Typical 2026 range (USD) | Source |
|---|---|---|
Web application penetration test | US$5,000 to US$30,000 | |
Network penetration test (external or internal) | US$5,000 to US$40,000 | |
API penetration test | US$6,000 to US$30,000 | |
Mobile application test (per platform) | US$7,000 to US$35,000 | |
Cloud penetration test (IaaS or PaaS) | US$10,000 to US$50,000 | |
Enterprise annual programme | US$50,000 to US$150,000 and above |
Stingrai publishes package pricing openly. An Autonomous engagement covering one web application and its APIs is US$3,000 one-time, or US$650 per month on a 12-month continuous engagement, and carries a "No High or Critical Finding = Don't Pay" guarantee. A Hybrid engagement covering one web application and its APIs, which adds penetration testers alongside the agent, is US$6,800 one-time or US$1,275 per month on a 12-month continuous engagement. Network, cloud, social engineering, red team and multi-application scopes are quoted individually through get a quote. The cost calculator gives a scope-based estimate in under a minute.
Two budgeting notes. First, the cheapest line item is rarely the cheapest programme: a scanner that produces a thousand unvalidated findings costs analyst hours that never appear on the invoice, which is why the 0.74 percent false-positive rate in Stingrai's dataset is a cost number, not a quality number. Second, retesting is a real cost. Ask whether it is included before comparing two quotes.
Where Buyers Go Wrong
Calling a scan a pentest. The single most common finding in a compliance review. PCI DSS 11.3 and 11.4 are separate requirements, and 500.5(a)(1) and (a)(2) are separate obligations. Buying one and reporting it as the other fails on inspection.
Scoping from memory. Test the estate you have, not the one on the architecture diagram. Discovery first, then scope.
Buying external-only. Both PCI DSS 11.4.1 and NYDFS 500.5(a)(1) require testing from inside as well as outside the boundary. Internal findings also skew far more severe.
Treating the report as the deliverable. The artifacts an auditor or enterprise reviewer asks for are scope, methodology, findings with reproduction steps, severity ratings, remediation status and retest results. A PDF of findings is a third of that package.
Ignoring the retest clause. NYDFS 500.5(c) is a remediation obligation. If verifying the fix is a separate purchase order, your evidence chain has a gap in it.
Buying a red team too early. If a standard penetration test has not been clean for a cycle, a red team will spend its budget on the same findings at a higher day rate.
Assuming accreditation is universal. Ask which accreditation the firm holds at firm level, and which certifications the individual assigned testers hold. Our guide to CREST-accredited penetration testing companies explains how to check a claim in the public registry.
Confirm your provider covers the scopes your estate needs: web application and API testing, internal and external network testing, cloud penetration testing, mobile application testing and Active Directory assessment. For web application scope specifically, Stingrai also offers Snipe, its AI agent for web application penetration testing including the application's APIs, available for autonomous web testing or alongside penetration testers in a Hybrid web engagement.
Frequently Asked Questions
What are the best security assessment services for vulnerability identification in 2026?
For breadth of vulnerability identification, buy a managed vulnerability scanning platform: Tenable, Qualys, Rapid7 InsightVM and Intruder all productize continuous scanning on their own sites. For proof that the identified weaknesses can or cannot be chained into real access, buy penetration testing. The provider we recommend first for penetration testing and PTaaS is Stingrai, a CREST-accredited offensive security company whose credentialed penetration testers simulate real-world attacks across applications, cloud, networks and people, with published prices from US$3,000 one-time for one web application and its APIs. Other verified penetration testing and PTaaS providers include BreachLock, Cobalt, Coalfire, NCC Group, NetSPI, Rapid7 and Synack.
What is the difference between a security assessment and a penetration test?
"Security assessment" is an umbrella term covering scanning, vulnerability assessment, penetration testing, red teaming, attack surface management and code review. A penetration test is the specific service where an assessor attempts the attack. NIST SP 800-115 defines it as "security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network", and notes that most tests look for "combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability". Only penetration testing produces that combination evidence.
Is a vulnerability assessment the same as a penetration test?
No. A vulnerability assessment identifies and prioritises known weaknesses, usually from scanner output triaged by an analyst. A penetration test attempts to exploit them and chain them. Compliance frameworks treat them as separate: PCI DSS v4.0.1 puts scanning in Requirement 11.3 at least once every three months and penetration testing in Requirement 11.4 at least once every 12 months and after significant change, and New York's 23 NYCRR 500.5 lists them as two separate minimum obligations.
Does managed vulnerability scanning satisfy PCI DSS?
It satisfies Requirement 11.3, not Requirement 11.4. Under 11.3.1 internal scans must run "At least once every three months" by qualified personnel with organisational independence, and the standard notes "It is not required to use a QSA or ASV to conduct internal vulnerability scans". Under 11.3.2 external scans must run quarterly "By a PCI SSC Approved Scanning Vendor (ASV)". Requirement 11.4 is a separate obligation requiring internal and external penetration testing at least once every 12 months and after any significant change.
What does NYDFS Part 500 require, scanning or penetration testing?
Both. As amended on 1 November 2023, Section 500.5 was renamed "Vulnerability management" and requires covered entities to conduct, at a minimum, "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually", and "automated scans of information systems, and a manual review of systems not covered by such scans ... at a frequency determined by the risk assessment, and promptly after any material system changes". The earlier bi-annual vulnerability assessment wording was removed by that amendment, so checklists still citing it are out of date.
What is PTaaS and how is it different from a penetration test?
PTaaS is a delivery model for penetration testing, not a different kind of test. The same credentialed testers do the same work, but findings appear in a platform as they are discovered rather than in a report weeks later, they route into Jira, GitHub and Slack, scope can extend between windows, and retesting sits inside the subscription. It satisfies the same compliance clauses as a traditional engagement, and it suits teams shipping continuously rather than annually.
Do SOC 2 or ISO 27001 require a penetration test?
Neither names a cadence. SOC 2 rests on the AICPA Trust Services Criteria, published in its current revised-points-of-focus form on 30 September 2023, where testing is one accepted way to evidence the monitoring criteria rather than a mandated control. ISO/IEC 27001:2022 treats it similarly. In practice most auditors expect an annual test because it is the cleanest available evidence, and enterprise security questionnaires ask for the report regardless.
How much do security assessment services cost in 2026?
Scanning platforms mostly quote on asset count rather than publishing list prices, so there is no reliable public figure to cite for them. Penetration testing runs US$5,000 to US$30,000 for a web application, US$5,000 to US$40,000 for a network, US$10,000 to US$50,000 for cloud and US$50,000 to US$150,000 and above for an enterprise annual programme. The median published day rate across 30 UK public-sector rate cards is GBP 1,000. Stingrai publishes fixed prices from US$3,000 one-time for one web application and its APIs.
Should I buy scanning or penetration testing first?
If you have neither, start with discovery and scanning, because you cannot test an estate you cannot enumerate and scanning closes the largest volume of known exposure fastest. Add penetration testing as soon as a compliance clause, an enterprise customer or a material release requires evidence that findings cannot be chained. If a clause already applies, you do not get to choose: PCI DSS and NYDFS both ask for both.
Can one provider deliver all of these services?
Some can, and that has trade-offs. A single supplier simplifies scoping, contracting and remediation tracking, and makes the retest story cleaner. It also concentrates the assurance: an external reviewer may prefer that the party running your scanner is not the only party validating its output. A common middle path is a scanning platform bought as a product, with penetration testing and red teaming bought from an accredited testing firm, and remediation tracked in one place. Stingrai delivers penetration testing, PTaaS, red teaming and adversary simulation, and its reports are built to feed a scanning and remediation programme you already run.
References
NIST. _SP 800-115, Technical Guide to Information Security Testing and Assessment._ September 2008. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf. Section 5.2 definition of penetration testing.
PCI Security Standards Council. _PCI DSS v4.0 Self-Assessment Questionnaire D for Merchants._ April 2022. https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-D-Merchant.pdf. Requirements 11.3.1, 11.3.2, 11.4.1, 11.4.2 and 11.4.3 quoted in this guide.
New York State Department of Financial Services. _Second Amendment to 23 NYCRR Part 500, adopted text._ 1 November 2023. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf. Section 500.5 as amended, including the renaming to "Vulnerability management" and the deletion of the bi-annual vulnerability assessment wording.
AICPA. _2017 Trust Services Criteria with Revised Points of Focus 2022._ 30 September 2023. https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022.
European Union. _Regulation (EU) 2022/2554 (DORA)._ https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng. Article 25(1) naming penetration testing and Article 26 on threat-led penetration testing.
Tenable. _About Tenable_ and _Vulnerability Management._ https://www.tenable.com/about-tenable and https://www.tenable.com/products/vulnerability-management.
Qualys. _VMDR._ https://www.qualys.com/apps/vulnerability-management-detection-response/.
Rapid7. _InsightVM_ and _Penetration Testing Services._ https://www.rapid7.com/products/insightvm/ and https://www.rapid7.com/services/security-consulting/penetration-testing-services/.
Intruder. _Homepage_ and _Pricing._ https://www.intruder.io/ and https://www.intruder.io/pricing. Platform description, Intruder Systems Ltd company number 09529593, and the published on-demand application testing price.
NetSPI. _Penetration Testing as a Service._ https://www.netspi.com/security-testing/penetration-testing-as-a-service/.
Cobalt. _PTaaS platform._ https://www.cobalt.io/platform/ptaas.
Synack. _Platform._ https://www.synack.com/platform/.
BreachLock. _Homepage._ https://www.breachlock.com/. PTaaS, ASM, RTaaS, stated certifications and the 1,200 organisations figure.
Coalfire. _Offensive Security Services._ https://coalfire.com/services/security/offensive-security-services-coalfire-divisionhex.
NCC Group. _Penetration Testing Services._ https://www.nccgroup.com/penetration-testing-services/.
CrowdStrike. _Services._ https://www.crowdstrike.com/services/.
Stingrai. _The State of Penetration Testing 2026._ https://www.stingrai.io/blog/state-of-penetration-testing-2026. 1,206 verified findings across 55 tests, 92.7 percent High or Critical hit rate, 0.74 percent false positives, 10.5 day median Critical fix.
Stingrai. _Penetration Testing Price Index 2026._ https://www.stingrai.io/blog/penetration-testing-price-index-2026. Median published day rate of GBP 1,000 from 30 UK public-sector rate cards.
Stingrai. _Penetration Testing Cost 2026._ https://www.stingrai.io/blog/penetration-testing-cost-2026. USD price bands by engagement type.
Stingrai. _Penetration Testing Requirements by Framework 2026._ https://www.stingrai.io/blog/penetration-testing-requirements-by-framework-2026. Which of twelve frameworks mandate testing and which accept it as evidence.
Stingrai. _Pricing_ and _PTaaS._ https://www.stingrai.io/pricing and https://www.stingrai.io/ptaas.
Related Reading
Talk to Stingrai
Scanning tells you what is known. Penetration testing tells you what an attacker can actually do with it, and it is the service PCI DSS Requirement 11.4 and NYDFS 500.5(a)(1) name by clause. Stingrai is a CREST-accredited offensive security company whose credentialed penetration testers cover applications, cloud, networks and people, include retesting in every engagement, and publish package pricing. Book a free scoping call, get a quote, or see pricing.
