Cybersecurity consulting firms in the United States

Global testing and certification firm, recognised by the PCI SSC for PTS POI and HSM evaluation, with labs in the UK and China.

IBM is a technology company that sells software, infrastructure, and consulting services.

A-LIGN provides cybersecurity compliance audits and certifications across frameworks like SOC 2 and ISO 27001.

Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.

US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise.

Miami-based cybersecurity firm with 300+ employees and deep healthcare/HIPAA expertise. Delivering pen testing since 2000.

Jones IT provides managed IT services, cybersecurity, and compliance support to businesses in the San Francisco Bay Area.

Boutique security consultancy specialising in IoT, SCADA/ICS, embedded systems, and hardware security research with world-renowned researchers.

Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.

US cybersecurity consulting, audit and testing firm founded in 2004, focused on community banks and credit unions, with external, internal, web application, wireless and PCI DSS penetration testing plus CMMC Level 1 and 2 readiness work.

CREST-accredited California consultancy blending compliance expertise with penetration testing. First to earn ISO 17020 for MITRE ATT&CK and PTES frameworks.

Elite security research firm specializing in source code review, blockchain auditing, and building industry-standard open-source security tools.

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

Adversary-focused security firm created by former DoD red team operators. Creators of BloodHound. CREST-accredited for penetration testing, red teaming, and purple team assessments.

Community-driven penetration testing firm known for free security education, open-source tools, Wild West Hackin' Fest, and practical offensive security services.

Top 10-ranked US pen testing firm with proprietary Real Time Dynamic Testing methodology. Three-tier service model from standard to maximum-depth custom testing.

US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.

US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments.

CREST-accredited information security and GRC consulting firm near Dallas. Pairs full-scope penetration testing with governance, risk, and compliance advisory and security training.

Potenza Services is a veteran-owned firm based in Tampa, Florida, founded in 2012.

Alcott Enterprises is a managed IT service provider and cybersecurity company based in Los Angeles.

AppGate provides zero trust network access and fraud protection software for enterprises and government agencies.

Employee-owned research firm testing embedded systems, including vehicle infotainment, telematics units and CAN networks.

AttackIQ provides a platform for continuous threat exposure management and adversarial exposure validation.

BARR Advisory helps organisations establish, manage, and audit cybersecurity and compliance programmes.

Detroit firm offering a vehicle security engineering platform alongside automotive penetration testing and defensive security services.

Cyberhaven provides a data security platform that traces data lineage to protect information across human and AI workflows.

Computer and IT infrastructure maker whose PowerProtect Data Manager software and Data Domain appliances back up data, detect ransomware and speed recovery.

Integris provides managed IT, cybersecurity, AI and cloud services to small and midsize businesses.

Johanson Group is a CPA firm providing security and compliance audits.

KirkpatrickPrice is a licensed CPA firm that performs cybersecurity audits and compliance assessments.

US engineering consultancy offering ISO 21434 consulting, TARA, security verification and automotive cybersecurity training.

Lorikeet Security provides penetration testing, incident response, and security leadership services.

Netrio provides managed IT, cybersecurity, cloud, and connectivity services to mid-market enterprises.

Provides managed IT support, cybersecurity services and custom software to small businesses.

nuHarbor provides cybersecurity services and managed security operations to organisations across government, healthcare, finance and enterprise.

Ontinue provides managed detection and response services for Microsoft security customers.

Open source software company whose Advanced Cluster Security product protects Kubernetes and container workloads, alongside Red Hat Enterprise Linux and OpenShift.

RemoteThreat provides an offensive cyber operations platform for red teams and government mission teams.

SafeBreach provides a platform that validates security controls and manages cyber exposure for enterprises.

TestPros is an independent IT compliance firm that has been testing since 1988.

Web-based software that automates vehicle threat analysis and risk assessment, plus vulnerability tracking and consulting.

Provides managed IT services including security, cloud desktops, networks and AI deployment support.

Z-JAK Technologies is a Louisville-based provider of managed IT and cybersecurity services for small and midsize businesses, typically with 5 to 150 employees.

Athena Agentic provides a unified cyber operations platform that automates detection, response, and hardening.

Cloudrise provides security services to enterprises and technology partners.

Mandiant provides threat intelligence and incident response, now sold as Google Threat Intelligence alongside VirusTotal within Google Cloud.

Optiv advises, deploys, and operates cybersecurity programs for organizations.

Puma Security provides .NET static analysis tools and application security services.

YSecurity provides an on-demand cybersecurity team for startups, handling compliance and security reviews.