Penetration testing companies in the United States

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

Tempe, Arizona-headquartered offensive security firm and Black Hat / DEF CON regulars, makers of the Cosmos continuous attack surface management platform.

Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.

Creators of OSCP, Kali Linux, and Exploit-DB, offering penetration testing services from the team that trains the world's ethical hackers.

FedRAMP-authorized crowdsourced penetration testing platform combining the vetted SRT researcher community with AI-powered Hydra technology for continuous security testing.

Cloud-based Penetration Testing as a Service platform combining AI-driven automation with expert manual testing at accessible price points.

Pioneer of Pentest as a Service, delivering fast, platform-based penetration testing with a vetted global community of security researchers.

Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.

Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.

Offensive security firm founded by former DoD professionals. Combines deep offensive testing with the Chariot attack surface management platform and its Exploit validation engine.

US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with external, internal, web application, wireless and PCI DSS penetration testing plus CMMC Level 1 and 2 readiness work.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

Vulnerability intelligence-driven penetration testing firm providing contextual security assessments informed by threat actor exploitation data and ransomware tracking.

Adversary-focused security firm created by former DoD red team operators. Creators of BloodHound. CREST-accredited for penetration testing, red teaming, and purple team assessments.

Community-driven penetration testing firm known for free security education, open-source tools, Wild West Hackin' Fest, and practical offensive security services.

Top 10-ranked US pen testing firm with proprietary Real Time Dynamic Testing methodology. Three-tier service model from standard to maximum-depth custom testing.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

Denver-based boutique pen testing firm with senior-only testers. Personalised engagements across penetration testing, red teaming, and vulnerability management.

US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments.

Cloud security penetration testing specialists known for the Pacu AWS exploitation framework and deep expertise across AWS, Azure, and GCP environments.

CREST-accredited information security and GRC consulting firm near Dallas. Pairs full-scope penetration testing with governance, risk, and compliance advisory and security training.

Employee-owned research firm testing embedded systems, including vehicle infotainment, telematics units and CAN networks.

Canima provides an AI-powered penetration testing platform.

ERMProtect provides cybersecurity assessments, penetration testing, compliance audits, and digital forensics services.

Michigan security research firm offering penetration testing and training for vehicles and other transport systems.

Horizon3 runs autonomous attack testing to find and verify exploitable weaknesses in production environments.

Lorikeet Security provides penetration testing, incident response, and security leadership services.

Siemba provides autonomous and expert-led penetration testing for security teams.

Provides penetration testing, PCI ASV scanning, and managed security services for compliance and threat detection.

NSS Labs provides independent testing and validation of cybersecurity controls and AI systems.

Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Global testing and certification firm, recognised by the PCI SSC for PTS POI and HSM evaluation, with labs in the UK and China.

Rapid7 provides AI-powered managed cybersecurity operations, including MDR, SIEM, and vulnerability management.

IBM is a technology company that sells software, infrastructure, and consulting services.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.

Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise.

The largest CPA-firm-based cybersecurity assessor in the US. Unique in holding FedRAMP 3PAO, PCI QSA, HITRUST, ISO 27001, and SOC attestation authority simultaneously.

Crowdsourced bug bounty pioneer founded in 2012 by Casey Ellis, offering managed programs and crowd-powered penetration testing from hundreds of thousands of ethical hackers.

World's largest ethical hacker platform with over one million researchers, offering bug bounties and structured penetration testing to the US DoD and Fortune 500.

RedTeam Security is now part of DeepSeas, which offers penetration testing, red teaming and physical testing as its offensive security practice.

Provides cloud security, compliance and managed detection and response services to regulated industries.

Detroit firm offering a vehicle security engineering platform alongside automotive penetration testing and defensive security services.

CyCognito provides a platform that discovers and tests external attack surfaces to identify security exposures.

Dragos provides cybersecurity for industrial control systems and operational technology environments.

EC-Council is a cybersecurity certification and training body.

Finite State provides a product security platform for connected devices, automating SBOM generation, vulnerability analysis, and compliance evidence.

Foresite provides managed detection and response services using agentic AI for security operations.

HiddenLayer provides a security platform for AI applications, protecting against adversarial threats.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

Provides managed IT support, cybersecurity services and custom software to small businesses.

NINJIO provides cybersecurity awareness training and human risk management through personalised coaching and phishing simulations.

nuHarbor provides cybersecurity services and managed security operations to organisations across government, healthcare, finance and enterprise.

Picus Security provides a platform that validates exposures and security controls by simulating cyber attacks.

Prescient Assurance provides SOC 2 audits and security compliance certifications for SaaS companies.

ProjectDiscovery builds open-source security tools and infrastructure for mapping, probing, crawling, and detecting vulnerabilities.

RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams.

SCYTHE provides a platform for continuous adversarial exposure validation across IT, cloud, and OT environments.

Simbian provides AI agents that automate security operations tasks such as alert triage and threat hunting.

TestPros is an independent IT compliance firm that has been testing since 1988.

UnderDefense provides managed detection and response, incident response, and compliance automation services.

Cybersecurity consulting and engineering for US government and industry, including threat hunting, zero trust, incident response and defence of critical infrastructure and weapon systems.

Resells security products and provides assessment, testing and advisory services with a data platform.

Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud.

Optiv advises, deploys, and operates cybersecurity programs for organizations.