Pentest Vendor Comparison 2026: Cobalt, HackerOne, Synack, Bugcrowd, Bishop Fox, NCC Group, Trail of Bits, IOActive
All 8 vendors on one page, compared on what each one actually publishes. Three put dollar figures in public: Synack lists a starting price per package, Bugcrowd sells standard pentest units at fixed prices through its own AWS Marketplace listing, and Cobalt prices its Autonomous Pentest while keeping its credit tiers quote-only. The other five publish no prices, so for them this page shows how they sell instead, and says “Not published” where there is nothing to show.
What each vendor publishes
| Vendor | Published price | Pricing model | Retest | Test start | Source |
|---|---|---|---|---|---|
| CobaltPTaaS | Autonomous Pentest $3,500/test (promo to 31 Dec 2026). Credit tiers: quote only | Annual credit packages; 1 credit = 8 hours; Standard, Premium, Enterprise | Free retesting 6 months (Standard) or 12 months (Premium, Enterprise) | 1 to 3 business days, by tier | cobalt.io/platform/pricing |
| HackerOnePTaaS | Not published | H1 Pentest and H1 Agentic Pentest, scoped per engagement | Retesting provided; terms not published | Not published | hackerone.com/product/pentest |
| SynackPTaaS | From $4,181 / $10,283 / $27,120 per package. Enterprise: quote. Platform: separate line item | Packages bought with credits that expire after 1 year, plus a required platform | Patch verification in every package | Not published (assessment windows of 4-5, 5, or 14 or 365 days) | synack.com/pricing |
| BugcrowdPTaaS | $5,000 / $8,000 / $15,000 standard pentest units (AWS Marketplace). Bug bounty: quote | Fixed 12-month units by size; Plus Pen Test for custom scope | 12 months, one report update (web app, network, API) | Within 3 business days | Bugcrowd AWS Marketplace listing |
| Bishop FoxConsulting | Not published | Baseline, Standard or Advanced app pentest packages, or custom scope; Cosmos platform | Listed as a deliverable; terms not published | Not published | bishopfox.com |
| NCC GroupConsulting | Not published | Traditional engagements or Continuous Penetration Testing | Not published | Not published | nccgroup.com |
| Trail of BitsConsulting | Not published | Team sized to your threat model; effort stated in person-weeks | Not published | Not published | trailofbits.com/services |
| IOActiveConsulting | Not published | Scoped per engagement; no published packages | Not published | Not published | ioactive.com |
Every cell is taken from the vendor’s own pricing page, product page or seller-authored marketplace listing, read 1 October 2026. Full source links and quotes are on each vendor page. No figures here come from buyer marketplaces, review sites or competitor blogs.
The lowest published entry points: Astra lists per-target plans from $699/yr for automated scanning, $2,999/yr for its autonomous Pentest Auto and $5,999/yr for Pentest Expert with manual testing. Among the 8 vendors above, Cobalt’s $3,500 Autonomous Pentest, Synack’s $4,181 Sara Pentest and Bugcrowd’s $5,000 Small unit are the published starting points.
Disclosure scorecard
Before a sales call, this is what you can learn from each vendor’s own site. “Pricing unit or packages” means the vendor publishes how its work is packaged (credits, fixed units, named packages or person-weeks), even when it attaches no price.
| Vendor | Any price | Pricing unit or packages | Retest terms | Start time |
|---|---|---|---|---|
| Cobalt | Yes | Yes | Yes | Yes |
| HackerOne | No | No | No | No |
| Synack | Yes | Yes | Yes | No |
| Bugcrowd | Yes | Yes | Yes | Yes |
| Bishop Fox | No | Yes | No | No |
| NCC Group | No | No | No | No |
| Trail of Bits | No | Yes | No | No |
| IOActive | No | No | No | No |
PTaaS platforms and consultancies
The two groups sell differently, which is why their quotes are hard to compare directly. Our PTaaS vs traditional consulting page explains when each shape suits a buyer.
- Bishop Fox
Baseline, Standard or Advanced app pentest packages, or custom scope; Cosmos platform
- NCC Group
Traditional engagements or Continuous Penetration Testing
- Trail of Bits
Team sized to your threat model; effort stated in person-weeks
- IOActive
Scoped per engagement; no published packages
Questions buyers ask
Which pentest vendors publish prices?
Of the 8 vendors compared here, three publish dollar figures on their own pages or listings: Synack (package starting prices from $4,181), Bugcrowd (standard pentest units from $5,000 on its AWS Marketplace listing) and Cobalt (its Autonomous Pentest at $3,500 per test, while its credit tiers stay quote-only). Astra, covered separately, also lists per-target plans. HackerOne, Bishop Fox, NCC Group, Trail of Bits and IOActive publish no prices.
Why does this comparison not show estimated prices for the other vendors?
Every entry on this page comes from the vendor's own pages, read on 1 October 2026. Where a vendor publishes no price, we say so rather than fill the gap with figures from buyer marketplaces, review sites or competitors. For market price ranges by test type, see our average cost and day-rate pages.
What is the difference between the PTaaS and consulting vendors here?
The PTaaS vendors (Cobalt, HackerOne, Synack, Bugcrowd) sell testing through a platform in credits, packages or fixed units. The consulting vendors (Bishop Fox, NCC Group, Trail of Bits, IOActive) scope engagements individually, though Bishop Fox publishes three application pentest packages and NCC Group also sells Continuous Penetration Testing.
Need a price range for your scope rather than a vendor list? Average pentest cost by test type and the scope estimator give our own market ranges, separate from anything a vendor publishes.