How The PenTest Index works
The PenTest Index helps you prepare to buy a penetration test. It compares selected web application and API testing offers using the terms providers publish, checks some of those terms against an example purchase, and helps you write down what needs testing before you contact anyone.
It does not test systems, recommend a provider for your situation, or send anything on your behalf. Providers confirm scope, price, availability and contracts. Your report recipient confirms what the report must show.
Reading the comparison
The comparison covers selected offers from 8 companies. Managed testing offers sit in two groups, with scanning tools in a separate table further down:
- Tests led by people: human testers carry out the testing. The scope and the amount of automation still vary between offers.
- Tests led by AI: an AI system performs much of the testing. Read the human role in each offer: experts might build the system, direct a test or check a fix, and those are different services.
- Scanning and tools you operate: software you run yourself. A tool subscription does not by itself commission an independent assessment.
Each entry describes a specific offer, not a whole company. One company can sell human testing, AI testing and scanning separately, and one entry can include several packages or tiers.
Companies appear A to Z within each group. The order is not a ranking, and nothing on the site is scored, rated or badged.
Terms you will see
| Term | What it means |
|---|---|
| Provider-published | The provider’s own public page states the fact. It tells you where the fact came from, not whether the service is good. |
| Not stated | The detail was not found in the sources reviewed. It is never treated as zero or as a “no”. Ask the provider. |
| Quote required | The provider does not publish a price for that package. |
| From (price) | A published starting price. Read the conditions beside it, such as required platform charges or annual terms. |
Prices are in US dollars for the stated package and unit. An annual price stays annual; it is not converted into a monthly figure.
Narrowing and emphasizing
Above the comparison, Show filters the managed testing groups: All managed testing, Led by people or Led by AI. Filtering hides groups; it never reorders entries.
Emphasize a column highlights one field across every entry: Who tests, Price, Retesting or Timing. Choose the same field again to clear it.
These controls need JavaScript. Without it, the full comparison is still shown.
Comparing entries side by side
Choose Compare on up to three entries. Once two or more are selected, Compare selected opens a side-by-side view below the managed testing groups, with each field as a row and each entry as a column. On a phone, the entries stack with every field labeled.
The side-by-side view keeps the conditions, units, unknowns and source links from each entry. Use Remove, Clear selection or Close to change it. Your selection stays in place when you change the filter. It is held only on the open page: it is not saved, sent to us or added to the web address.
Checking the sources
Every entry has Sources and check details. Open it to see each supporting fact with:
- the provider page and the section it came from;
- the type of evidence;
- the date that specific fact was checked;
- any limitation on where the fact applies, such as a term stated for only one package; and
- any conflict between two of the provider’s own sources.
The Sources section lists every provider page reviewed and when it was checked. The full comparison was checked on ; specific terms were rechecked on .
Reading a Purchase Check
A Purchase Check tests one condition of an example purchase against an offer’s published terms. The example, called a brief, describes one SaaS web application and the API it uses, two signed-in user roles, one agreed environment, no source-code access, one managed assessment, and a request for a person to check fixes 45 days after the findings.
Each check shows the condition, the evidence that applies, the rule or calculation used, the finding, the question still open and what would change the finding. Every finding has one of five states:
| State | Meaning |
|---|---|
| Supported | Applicable evidence satisfies the stated condition, within the limits named in the finding. |
| Mismatch | Applicable evidence contradicts a mandatory condition of the brief. |
| Unresolved | The evidence needed for a decision is missing, incomplete or not yet applicable to the buyer. |
| Conflicting | Sources disagree about the same applicable condition after checking offer, audience, date, scope and billing basis. |
| Not applicable | The condition does not arise for this brief or offer. |
A finding examines one condition. It does not establish that the whole offer suits your purchase. Copy question copies the open question so you can ask the provider directly.
Preparing your scope checklist
Find My PenTest Match helps you choose what needs testing and see what to settle before you contact providers: the questions for each testing surface, the questions for your report recipient, the questions for comparing offers, and a scope checklist you can copy or print.
The checklist does not submit your selections to us or save them as a form. Analytics may record page interactions on the live site. The checklist prepares a conversation with a provider; it does not produce a match, a quote or a recommendation.
Contacting providers
Links to provider pages go straight to the provider. The PenTest Index does not make introductions, pass on your details or arrange bookings.
This site may contain affiliate or referral links. If you buy through one, we may be compensated. Read how we make money.
Who confirms what
| Question | Who confirms it |
|---|---|
| What will be tested, and at what price | The provider, in a written proposal |
| When testing can start and the report will arrive | The provider |
| Contract, retest and cancellation terms | The provider, in the agreement you sign |
| What the report must contain | The customer, auditor or team that will rely on it |
| Whether an offer suits your purchase | You, using the answers above |