Penetration testing companies

Cybersecurity division of the Thales Group, with ANSSI, CREST, FedRAMP 3PAO, and NATO-cleared personnel. Defence, government, and critical infrastructure penetration testing worldwide.

CREST and CHECK-accredited European managed services provider delivering penetration testing with deep infrastructure and cloud hosting expertise.

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

The only organisation worldwide with a full suite of CREST accreditations. 250+ cybersecurity specialists operating in 55+ countries across pen testing, red teaming, and incident response.

Global cybersecurity consultancy with CREST, CHECK, and CBEST accreditation, renowned for deep technical research and penetration testing services.

London-based cybersecurity provider, now part of Kroll, delivering CREST-accredited penetration testing, managed detection and response, and incident response with a 550-strong cyber team.

Airbus group cybersecurity consultancy with ANSSI PASSI qualification. Aerospace, defence, and critical infrastructure penetration testing across Europe.

Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.

Tempe, Arizona-headquartered offensive security firm and Black Hat / DEF CON regulars, makers of the Cosmos continuous attack surface management platform.

Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.

Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.

Creators of OSCP, Kali Linux, and Exploit-DB, offering penetration testing services from the team that trains the world's ethical hackers.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Sydney-headquartered Australian cybersecurity firm founded in 1997, now part of Infosys. CREST-approved with OSCP, OSCE, and OSEE-certified testers.

Frankfurt-based European payment security specialist holding the full set of PCI credentials (QSA, PFI, ASV, P2PE). Manual-first penetration testing for fintechs, acquirers, and regulated enterprises.

CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.

UK compliance and cybersecurity consultancy, formerly IT Governance, offering CREST and NCSC CHECK penetration testing alongside governance, risk and compliance services.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Pioneer of Pentest as a Service, delivering fast, platform-based penetration testing with a vetted global community of security researchers.

Subscription-based offensive cybersecurity firm delivering continuous cyber attack services with CREST STAR and CBEST accreditations from its London headquarters.

Cardiff-based CREST and CHECK-accredited cyber security company delivering penetration testing, red teaming, and OT security assessments as part of the Chess Group.

Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.

Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.

Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.

CREST-accredited, platform-driven penetration testing vendor in Bristol offering AI-augmented testing with rapid self-service booking for over 400 global customers.

CREST-accredited Canadian pen testing firm with a 95% manual-first approach. All testers hold OSCP minimum certification. Zero false positive guarantee.

The UK's largest independent security testing firm, renowned for IoT/OT research, CBEST red teaming, and CHECK/CREST-accredited penetration testing across all sectors.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with external, internal, web application, wireless and PCI DSS penetration testing plus CMMC Level 1 and 2 readiness work.

Vienna-headquartered Austrian cybersecurity consultancy with a prolific Vulnerability Lab research program and deep expertise in IoT and embedded systems security across the DACH region.

Poland's longest-running independent pen testing firm with 50+ consultants. Specialises in application security, cloud testing, and red teaming.

Australian CREST-accredited cybersecurity consultancy formed from the 2021 Privasec, Naviro, AvertRo, and Theta merger. Risk-led offensive security with strong APRA and Essential Eight programme work.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

London-based cybersecurity firm offering unlimited, fixed-price penetration testing and red teaming services with ISO 27001 certification and a unique subscription model.

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

ISO 9001-certified Canadian pen testing firm conducting 500+ tests annually. Now part of TELUS, serving Fortune 1000 to SMBs.

Swiss cybersecurity firm with major Singapore operation. CREST accredited, CSA-licensed in Singapore. Manual exploitation focus with the proprietary MAD reporting platform.

CREST-accredited UK cyber security and data protection consultancy offering penetration testing, ISO consultancy, and managed SOC services from offices across the UK and Ireland.

Vulnerability intelligence-driven penetration testing firm providing contextual security assessments informed by threat actor exploitation data and ransomware tracking.

Ethical hacking team within Orange Cyberdefense with a 20+ year track record. Known for building industry-standard security tools and groundbreaking research.

Adversary-focused security firm created by former DoD red team operators. Creators of BloodHound. CREST-accredited for penetration testing, red teaming, and purple team assessments.

CHECK and CREST-accredited Birmingham-based cyber security consultancy with over 15 years of experience delivering penetration testing, red teaming, and OT security assessments for government and private sector clients.

Community-driven penetration testing firm known for free security education, open-source tools, Wild West Hackin' Fest, and practical offensive security services.

Toronto-based CREST-certified pen testing firm focused on Canadian financial services. OSCP and OSEP certified testers; OSFI, PCI DSS, and SOC 2 specialism.

Dubai-based cybersecurity firm providing pen testing and security consulting across the GCC with expertise in critical infrastructure.

CREST-accredited Birmingham-based cyber security consultancy delivering penetration testing, social engineering assessments, and Cyber Essentials certification for public and private sector clients.

Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.

Mexico-based cybersecurity firm delivering pen testing services across Latin America with international standards alignment.

Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.

Top 10-ranked US pen testing firm with proprietary Real Time Dynamic Testing methodology. Three-tier service model from standard to maximum-depth custom testing.

Australian senior-led boutique pen testing firm with consultants in Sydney, Melbourne, and Brisbane. CREST CRT, OSCP, and OSCE certified testers.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

Denver-based boutique pen testing firm with senior-only testers. Personalised engagements across penetration testing, red teaming, and vulnerability management.

US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments.

CREST-certified and PCI QSA penetration testing consultancy in London, delivering offensive security and compliance services across 25+ countries with research-driven expertise.

Cloud security penetration testing specialists known for the Pacu AWS exploitation framework and deep expertise across AWS, Azure, and GCP environments.

Award-winning Cheltenham-based cybersecurity consultancy with NCSC CHECK Green Light status and CREST approval, specialising in defence, government, and critical national infrastructure security.

Manchester-based independent cybersecurity consultancy with over 20 years of experience delivering CREST and CHECK-accredited penetration testing, red teaming, and compliance certification services.

UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.

Independent Italian offensive security firm specialising in web, mobile, network, and embedded security assessments with a strong research focus.

Toronto-based PTaaS provider delivering continuous penetration testing for Canadian fintech, SaaS, and OSFI-regulated organisations.

Award-winning CREST-certified managed cyber security and IT support provider with offices in Bristol, London, and Manchester, specialising in penetration testing and Microsoft security technologies.

Singapore CREST-accredited and CSA-licensed offensive security boutique. Manual, senior-led testing with strong MAS TRM and PDPA expertise.

Johannesburg-based infosec consultancy operating since 2002. One of Africa's oldest pen testing firms with deep technical expertise.

Italian cybersecurity group that absorbed Swascan, offering offensive security and vulnerability assessment through its Cyber Competence Center.

Australian CREST ANZ and CREST International accredited pen testing firm focused on enterprise-grade, manual-first offensive security. Sydney and Brisbane offices.

Dublin-based Irish CREST-accredited pen testing firm. Human-led testing with strong NIS 2 and DORA expertise for Irish and EU clients.

Edinburgh-based CREST-accredited IT and cybersecurity firm. Pen testing for Scottish public sector, financial services, and commercial clients.

Berlin-based web, browser, and cryptography auditors founded by Dr. Mario Heiderich, trusted by ExpressVPN, NordVPN, 1Password, and Bitwarden.

CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.

Dubai-based CREST and ISO certified pen testing specialist serving the GCC region with full VAPT services.

CREST-accredited information security and GRC consulting firm near Dallas. Pairs full-scope penetration testing with governance, risk, and compliance advisory and security training.

Boutique UK penetration testing consultancy in Milton Keynes specialising in manual, expert-led security assessments across web applications, APIs, cloud, and mobile platforms.

Israeli-headquartered global cybersecurity consultancy with a UK presence, specialising in penetration testing and TIBER-EU red team exercises for Fortune 500 companies.

CREST-accredited North East England penetration testing specialist founded in 2019, offering accessible and transparent security testing with free retests and a strong focus on social engineering.

CREST-accredited UK penetration testing consultancy based in Shropshire, delivering web application, API, infrastructure, cloud, mobile, and AI/LLM testing. A small specialist team, with a retest included in every engagement.

CREST-accredited Manchester-based cyber security firm delivering penetration testing, managed security services, and compliance consultancy across the UK, Europe, and the USA.

AgentRidge provides autonomous AI software for penetration testing on local machines.

AISafe Labs provides AI-powered penetration testing services for applications.

Gothenburg consultancy testing ECUs, vehicle buses, telematics and OTA pipelines, and advising on R155 and ISO 21434.

Employee-owned research firm testing embedded systems, including vehicle infotainment, telematics units and CAN networks.

Bureau Veritas Cybersecurity provides cybersecurity services covering people, processes, and technology.

Canima provides an AI-powered penetration testing platform.

CodeTechLab is a cybersecurity consulting and training firm based in Jaipur, India.

Decurity is a web3 security firm based in Dubai.

Elementrica is a cybersecurity company based in Kraków with an office in Oslo.

ERMProtect provides cybersecurity assessments, penetration testing, compliance audits, and digital forensics services.

Forefront IT Security Services presents itself as a virtual cyber security team for organisations in the United Kingdom.

Michigan security research firm offering penetration testing and training for vehicles and other transport systems.

Guardsi Cybersecurity is a Brazilian firm that has specialised in penetration testing and offensive security since 2015.

Heelr is a marketplace connecting organisations with verified cybersecurity professionals and providers.

Hexens audits smart contracts and provides offensive security for blockchain and Web3 projects.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

Intrudify sells an AI-driven penetration testing platform for web applications and APIs.

Laucked is a French cybersecurity firm based in Toulouse that provides penetration testing and continuous security monitoring for small and medium-sized businesses.

LDL Security is a Brazilian cybersecurity company that specialises in penetration testing, red team exercises and compliance.

Lorikeet Security provides penetration testing, incident response, and security leadership services.

nFlo is a Polish technology company based in Warsaw.

Polish website publishes cybersecurity news and offers security training and audits.

Pune security firm testing in-vehicle systems, telematics and EV charging, with a hands-on car hacking course.

Penetrify provides automated penetration testing for web applications.

Penumbral Labs helps manufacturers prepare connected products for EU Cyber Resilience Act compliance through testing and support.

Revelion provides an autonomous AI pentester that simulates attacks to validate exploitability across estates.

Reversec provides cybersecurity consulting services, including penetration testing and resilience development.

French security evaluation lab (ITSEF/CESTI) recognised by the PCI SSC for PTS device evaluation, plus EMVCo and Common Criteria.

Siemba provides autonomous and expert-led penetration testing for security teams.

Soken is a Web3 services firm based in London.

German security lab in Bonn, recognised by the PCI SSC for PTS device evaluation, plus German payment terminal schemes.

Provides penetration testing, PCI ASV scanning, and managed security services for compliance and threat detection.

CodeWall builds autonomous attack agents that test enterprise security from the outside.

HACK KAP provides manual penetration testing, dark-web intelligence, and hacking labs for businesses worldwide.

NSS Labs provides independent testing and validation of cybersecurity controls and AI systems.

Swiss testing and certification group offering security evaluations, penetration tests and ISO/SAE 21434 audits.

VidraSec provides penetration tests and security audits for businesses.

Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Global testing and certification firm, recognised by the PCI SSC for PTS POI and HSM evaluation, with labs in the UK and China.

Rapid7 provides AI-powered managed cybersecurity operations, including MDR, SIEM, and vulnerability management.

IBM is a technology company that sells software, infrastructure, and consulting services.

German testing and certification group whose security services include penetration tests, ISO/SAE 21434 certification and UN R155 audits.

GMV Innovating Solutions is a technology group that provides solutions, services and products across many sectors.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

Australia and New Zealand's largest pure-play cybersecurity firm with offices in every major ANZ capital. CREST ANZ accredited and IRAP-listed for Australian Government testing.

US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.

Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise.

The largest CPA-firm-based cybersecurity assessor in the US. Unique in holding FedRAMP 3PAO, PCI QSA, HITRUST, ISO 27001, and SOC attestation authority simultaneously.

Crowdsourced bug bounty pioneer founded in 2012 by Casey Ellis, offering managed programs and crowd-powered penetration testing from hundreds of thousands of ethical hackers.

Berlin-headquartered German cybersecurity consultancy with 30+ years of BSI IT-Grundschutz experience. Trusted by federal agencies, DAX corporations, and critical infrastructure operators.

CREST-accredited pan-European cybersecurity services provider delivering penetration testing and managed security from Dublin with a strong UK and Ireland presence.

World's largest ethical hacker platform with over one million researchers, offering bug bounties and structured penetration testing to the US DoD and Fortune 500.

InterIntra is an Australian managed IT and cyber security provider.

RedTeam Security is now part of DeepSeas, which offers penetration testing, red teaming and physical testing as its offensive security practice.

Alpha Code Technologies is a managed security services provider based in Jakarta, Indonesia.

Security evaluation lab that penetration tests automotive ECUs and reports findings for UN R155 and ISO/SAE 21434.

Provides cloud security, compliance and managed detection and response services to regulated industries.

Ettlingen consultancy pentesting vehicles, ADAS, gateways, infotainment and on-board chargers, plus R155 CSMS consulting.

BCIT is a cybersecurity and compliance consulting firm and training organisation based in France.

Detroit firm offering a vehicle security engineering platform alongside automotive penetration testing and defensive security services.

ColdBoot is a Budapest-based Hungarian IT company that serves small and medium-sized businesses and private individuals.

CybaVerse provides a unified cyber security operations platform called CybaOps.

CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures.

Israeli firm selling in-vehicle intrusion detection, vulnerability tools, compliance software and vehicle SOC services to carmakers.

DDactic maps attack surfaces and tests DDoS resilience for enterprise infrastructure.

DEFION Security is an independent security partner that has operated since 2005.

Cyber advisory and managed security services, including managed extended detection and response, cloud security, digital identity and threat intelligence, from a global professional services network.

Makes automated ECU and vehicle security test tools and hardware, and carries out automotive penetration testing.

Dragos provides cybersecurity for industrial control systems and operational technology environments.

Turin firm selling Weseth, a remote platform for automated security and penetration testing of vehicles and devices.

EC-Council is a cybersecurity certification and training body.

eSentire provides managed detection and response services to protect organisations from cyber threats.

Cybersecurity consulting and managed services covering security transformation, incident response, data protection and privacy, identity and privileged access, and operational technology security.

Korean supplier of ECU security software, security gateways, TARA, testing and R155 and 21434 consulting.

Engineering services group whose FEV.io arm runs TARA, ISO 21434 work, secure lab testing and vehicle pentests.

Finite State provides a product security platform for connected devices, automating SBOM generation, vulnerability analysis, and compliance evidence.

Foresite provides managed detection and response services using agentic AI for security operations.

Beijing firm selling TARA and test software, vehicle test hardware, penetration testing and R155 compliance advice.

Hackrate runs crowdsourced security testing and bug bounty programmes for companies.

HiddenLayer provides a security platform for AI applications, protecting against adversarial threats.

UK vehicle engineering and test centre offering threat modelling, CSMS support and security testing for vehicles.

Immunefi runs bug bounty programmes and security services for cryptocurrency and smart contract projects.

Infysec provides cyber security services, training, and research and development.

Intigriti runs a crowdsourced security platform connecting organisations with ethical hackers for bug bounties and testing.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

Lakera provides security software that protects enterprise AI applications from prompt attacks and data leakage.

Tokyo firm assessing vehicle ECUs and connected services, with automotive security consulting, PSIRT support and training.

Provides managed IT support, cybersecurity services and custom software to small businesses.

NINJIO provides cybersecurity awareness training and human risk management through personalised coaching and phishing simulations.

nuHarbor provides cybersecurity services and managed security operations to organisations across government, healthcare, finance and enterprise.

Nuvol Cybersecurity is a boutique cybersecurity firm founded in 2017 in Panama.

Offensive360 provides application security testing and risk management tools for enterprises.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Israeli automotive security firm selling in-vehicle intrusion detection, theft prevention, fleet monitoring, TARA and penetration testing.

Prescient Assurance provides SOC 2 audits and security compliance certifications for SaaS companies.

ProjectDiscovery builds open-source security tools and infrastructure for mapping, probing, crawling, and detecting vulnerabilities.

Paris research firm auditing ECUs, ADAS, in-vehicle networks and OTA updates, and selling software protection for ECU firmware.

RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams.

UK automotive consultancy that runs vehicle penetration tests, threat assessments and anti-theft testing for carmakers.

SCYTHE provides a platform for continuous adversarial exposure validation across IT, cloud, and OT environments.

Dutch security evaluation lab, part of SGS, recognised by the PCI SSC for PTS device evaluation and accredited for EMVCo and Common Criteria.

Sherlock provides security audits and bug bounties for onchain systems and Web3 protocols.

Simbian provides AI agents that automate security operations tasks such as alert triage and threat hunting.

Sygnia provides cyber incident response, readiness, and managed detection and response services to enterprises worldwide.

TestPros is an independent IT compliance firm that has been testing since 1988.

UnderDefense provides managed detection and response, incident response, and compliance automation services.

French test and approval body acting as a UN R155 technical service, with vehicle pentesting and TARA.

VicOne provides cybersecurity for vehicles and robots, protecting their digital systems from development to operation.

WYKYK is an offensive cybersecurity company.

Zerocopter provides security testing services including pentesting, bug bounty, and vulnerability disclosure.

Cybersecurity consulting and managed security services covering cyber strategy, resilience, zero trust protection and operational technology security, within a global IT services firm.

Spanish vehicle engineering and testing firm offering TARA, UN R155 and R156 gap analysis, and connectivity pentests.

Korean supplier of in-vehicle security software, V2X and Plug&Charge PKI, security testing tools and R155 consulting.

Indian consultancy helping vehicle makers gain UN R155, R156 and AIS-189 approval, with TARA tools and penetration testing.

Cybersecurity consulting and engineering for US government and industry, including threat hunting, zero trust, incident response and defence of critical infrastructure and weapon systems.

Resells security products and provides assessment, testing and advisory services with a data platform.

Indian engineering firm offering TARA, secure boot, HSM and SecOC integration, IDS work and ECU penetration testing.

HackenProof runs a bug bounty and crowdsourced audit platform for blockchain and crypto projects.

Indian firm offering vehicle and ECU penetration testing, R155 and 21434 consulting, plus a vehicle SOC.

ITSS provides managed cybersecurity services including detection, response, and penetration testing from Dubai.

Runtime protection agent and binary SBOM scanner for vehicle and device firmware, plus TARA and penetration testing.

Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud.

Optiv advises, deploys, and operates cybersecurity programs for organizations.

Exposure management platform with vulnerability management, external attack surface management, application security testing, pen testing as a service and digital risk protection.

Pentera provides an exposure validation platform that tests security controls against real attacks.

Jinan company providing connected-vehicle test tools, cyber ranges, vulnerability research and compliance services for carmakers.

Secvura reviews web and SaaS applications for security weaknesses and helps teams fix them.

YesWeHack runs a bug bounty platform connecting organisations with ethical hackers.