LLM penetration testing services, compared by scope and price

By The PenTest Index · Offers checked October 10, 2026

LLM penetration testing services attack your AI feature to show what it can be tricked into leaking or doing. Five providers publish a price. For a document assistant with one or two tools, Invadel lists $7,500 and Software Secured starts at $10,800; Schellman's minimum is $16,000. The price follows what your AI can read and do, so match scope before comparing numbers.

One warning before the tables: "AI pentest" is sold with three different meanings, and only one of them tests your LLM feature. We read the service and pricing pages of 15 providers and sorted them below. We did not buy or run any of these tests.

Is this a test of your AI, or a test done by AI?

Only the first row below is what you were asked for. The other two get sold under the same words.

The middle row is the easy one to buy by mistake. Synack's pricing table lists Sara's asset type as "External web or host" (Synack pricing, checked October 10, 2026). Cobalt's Autonomous Pentest page names no LLM scope and says it "does not produce compliance attestation reports" (Cobalt, checked October 10, 2026). Both companies sell a separate LLM test. Astra lists Pentest Auto as autonomous testing for web and SaaS apps (checked October 7, 2026).

If you wanted an AI tool to pentest your regular app, that is a different purchase: see automated penetration testing.

What do LLM penetration testing services actually test?

They test the application you built: the prompt, the data it can reach, the actions it can take and what happens to its answers. Some services also test the model itself when that is in scope. Cybersecify puts it plainly: "We test your application, not the foundation model."

What your AI feature can do decides how big the test is.

Think of a helpful librarian. The risk is not that the librarian says something rude. The risk is that a convincing question gets another customer's file handed over. Once the librarian can also issue refunds, there is a till to protect as well.

Two things to settle in writing. First, cost and uptime attacks are sometimes left out: Schellman says it "does not test for token exhaustion attacks unless specifically requested." Second, a security test is not an accuracy review. It will not tell you whether the answers are right.

Most providers map findings to the OWASP Top 10 for LLM Applications. OWASP published a 2026 edition in August 2026, and it reordered and renamed entries. Excessive Agency is now LLM03, and there is a new LLM08, Hidden Context Exposure (OWASP's 2026 list, checked October 10, 2026). Some provider pages still cite the 2025 edition. Ask which edition your report will use. OWASP's list is guidance on risks. It is not a certificate, and we are not affiliated with OWASP.

Which LLM penetration testing services publish a price?

Five of the 15 providers we read publish a price that applies to LLM testing. They are not the same purchase. One is per scope, one is per year, three are per engagement, and two of those are starting figures.

Every cell is provider-published and was read on the provider's own page on October 10, 2026. None is a quote for your project.

Sources: Astra pricing · Cybersecify pricing and service page · Invadel pricing · Schellman · Software Secured pricing and service page.

Three things this table shows that a single price does not.

The cheapest tier may not be your test. Invadel's $4,500 tier is defined as "no tool access." If your assistant reads documents and calls a tool, you are in the $7,500 tier. That is a $3,000 difference decided by one fact about your product.

A scope is not always what you think. Cybersecify says an agent and the API it calls count as two scopes. For an assistant that calls tools, we work that out on the two-scope Startup plan as INR 74,999 + INR 44,999 = INR 119,998 plus taxes, or about $1,260 on Cybersecify's own indicative dollar figures. Its Growth plan costs INR 179,999 plus taxes for two scopes and adds compliance mapping and other testing. Confirm the scope count and plan before you budget on $790.

Retest deadlines differ by months. Astra and Cybersecify close the retest in about a month. Software Secured gives 12 months. Invadel and Schellman do not state a deadline on the pages we read.

We do not publish a "typical range" for this kind of test. Most providers quote, and a range built from five different units would mislead you.

Which offers deserve a closer look?

Start with the thing that would rule an offer out. For most buyers that is the retest deadline or the scope, not the price.

That last row may save you the whole purchase. A web app test usually covers the login, the pages and the API around your chat. It often does not try to trick the model unless you ask. Send your provider the scope lines further down and ask one question: "Does our current scope include prompt injection, document access between customers and the assistant's tool calls? If not, what would it cost to add them?" See what a standard web application penetration test covers.

If you already know your scope, go straight to the provider.

See Invadel's AI/LLM tiers and what each includes

See Software Secured's AI pentesting prices

See what Astra Pentest Expert includes

See Cybersecify's plans and scope rules

See Schellman's AI Red Teaming service

The AI feature is one part of your scope. Providers will also ask about user roles, environments, your deadline and who reads the report. Find My PenTest Match walks you through those and gives you a scope checklist to copy or print. It is free, asks for no email, and sends nothing to providers. Choose "A web app and its API", since that is where most LLM features live, then add the AI lines from this page.

Find My PenTest Match

A worked example: one buyer, five published offers

For this buyer, two offers are worth the first calls: Invadel Medium and Software Secured. Each has one open question. Here is how we got there.

The buyer is made up. Say you run a 30-person SaaS company. Your support assistant reads customer documents and can call two read-only tools: look up an order and look up a ticket. A large customer's security questionnaire asks for a penetration test of the AI feature. They want the report in six weeks. Your team needs about 45 days to fix what turns up, and the customer wants proof that the fixes were rechecked.

That gives four requirements. The test must cover document retrieval and the two tools. It must check that one customer cannot pull another customer's documents. The report must arrive within six weeks. A retest must still be available on day 45 after the findings.

This is the PenTest Index Purchase Check: we take one buyer's requirements and hold each published offer up against them. "Supported" means the published terms support that one requirement. It says nothing about how good the testing is.

What this buyer should do. Call Invadel and Software Secured first. If Invadel's retest deadline covers day 45, it is the lower published price for this scope. If Software Secured can start within two weeks, it is the one whose published retest terms already fit. Astra and Cybersecify cost less, but both retest windows close before this buyer's fixes are ready, so they only work with a written extension. Schellman may fit at a higher minimum once its retest terms are known.

A mismatch here rules an offer out for this buyer only. A team that fixes findings in two weeks would read the same table and reach a different answer.

These are our readings of published terms. No provider has quoted for this example.

Who else offers LLM penetration testing?

Ten more providers describe a relevant service and ask you to request a quote. This table shows what each page says and what it leaves open. All cells are provider-published, read October 10, 2026. Providers are listed A to Z; this is not a ranking.

We did not find an open LLM sample report among the pages we read. Cybersecify publishes a sample without a form, but it is a web and API report with no LLM findings in it. So ask every provider on your list for a redacted report from an LLM engagement before you sign. It is the fastest way to see whether you will get evidence your customer can follow.

What should you send providers before asking for a quote?

Send every provider the same description of your AI feature. Then each one prices the same job, and their answers line up.

Add these lines to your normal scope. Leave out passwords, keys and the text of your system prompt.

1. What the feature does, in one sentence.
2. Where users reach it: web app, API, chat tool, email.
3. Model: which provider, and whether they host it or you do.
4. Data it reads: which sources, and how one customer's data is kept from another's.
5. Who can add content it reads: staff only, customers, or the public web.
6. Roles and test customers: the user roles to test, and two made-up customers with made-up data for the cross-customer check.
7. Tools and actions: every tool it can call and what each can change.
8. Outside connectors: plugins, MCP servers, other agents, and who runs each.
9. Where to test: production or a copy, and which actions must never really happen (refunds, emails, deletions).
10. Cost and uptime attacks: in or out.
11. What surrounds it: whether the web app and API around the feature are in this test or a separate one.
12. Fix checking: how many retests you need, by what date, and whether you need an updated report.
13. Who reads the report, what they asked for in their own words, and your deadline.
14. Ask each provider to mark every line as covered, not covered or needs a conversation, with a price for anything extra.

A filled-in example (made up). "Support assistant inside our web app. Hosted model from a third party. Reads each customer's uploaded help documents. Staff and customers can add documents. Three roles: customer user, customer admin, our support staff. Two test customers with made-up data. Two read-only tools: order lookup and ticket lookup. Test on staging only. Cost attacks out. Web app and API were tested in March and are out of scope. One retest needed about 45 days after findings, with an updated report. Our customer's security team reads the report and asked for 'a penetration test of the AI feature'. Report needed in six weeks."

AI scope lines

1. What the feature does:
2. Where users reach it:
3. Model:
4. Data it reads:
5. Who can add content it reads:
6. Roles and test customers:
7. Tools and actions:
8. Outside connectors:
9. Where to test:
10. Cost and uptime attacks:
11. What surrounds it:
12. Fix checking:
13. Who reads the report:
14. Ask each provider to mark every line as covered, not covered or needs a conversation, with a price for anything extra.:

This list prepares a conversation with providers. It does not authorize testing.

Prepared with The PenTest Index: https://thepentestindex.com/llm-penetration-testing-services/

Copy AI scope linesPrint

If you cannot answer a line yet, write "Not known yet, please advise." A blank reads as "none," and that is how gaps get missed.

This list starts a conversation. It does not give anyone permission to test. Written authorization has to name the real systems and the real actions, and it comes from you in the contract or the rules of engagement. If a third party hosts your model, check their terms on security testing before work starts.

Once quotes come back, compare them line by line. For the rest of your scope, see a filled-in penetration testing scope.

Is AI red teaming the same as LLM penetration testing?

Providers use the two names for overlapping work, so compare the scope and ignore the label. Schellman calls its service AI Red Teaming and prices it per engagement at about two weeks. HackerOne's AI Red Teaming runs for 15 or 30 days. Invadel calls similar application work a penetration test and treats model-level red teaming as extra scope, "quoted after scoping."

A rough way to tell them apart: an application test asks "can someone misuse this feature to reach data or actions they should not?" A model-level exercise asks "can this model be pushed into harmful behavior at all?" Most companies building on someone else's model need the first one.

OWASP publishes a free guide to judging these providers, and it is written to help you separate real adversarial testing from "jailbreak-only" offerings: OWASP Vendor Evaluation Criteria for AI Red Teaming Providers & Tooling (v1.0, February 2026). For the general difference, see red teaming vs pentesting.

Do you have to buy a separate LLM penetration test?

Not always. It depends on what the person asking for the report needs and what your current test already covers.

Provider pages name frameworks such as the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework. A provider naming a framework does not mean the framework requires this test. Your customer, auditor or regulator decides what counts. No provider and no index can promise a report will be accepted.

So ask the person who asked you:

• "Which system must the test cover, and does it include the AI feature specifically?"
• "Is automated testing alone acceptable, or do you need people doing the testing?"
• "Do you need proof that findings were fixed and rechecked, and by when?"

Their answers go straight into line 13 of your scope. If they say your existing web app test is enough once it includes the AI feature, you may only need an add-on from your current provider.

Can you just run a tool yourself?

Yes for regular checks between tests. No if someone outside your company needs an independent report.

Promptfoo, garak and PyRIT are open-source tools you run against your own feature. They are good at repeating known attacks every time you change a prompt or a model. They do not understand your business rules, they do not check whether one customer can reach another's documents unless you build that test, and nobody independent signs the result. Many teams use both: a tool in the release process and a commissioned test once or twice a year. The same split applies across security testing; see penetration testing vs vulnerability scanning.

More questions buyers ask

How long does an LLM penetration test take?

Stated times on the pages we read: Cybersecify says 5 business days per scope, Invadel about a week for one feature, Schellman around 2 weeks, Qualysec 1 to 3 weeks, and HackerOne 15 or 30 days. These are testing periods the providers state. They are not booked start dates. Add scheduling time, which Software Secured puts at 3 to 6 weeks, and ask for the report date in writing.

Do testers need our system prompt or source code?

It depends on the offer. Some tests work only from the outside, the way a user would. Others go faster and deeper with the prompt, the tool list and test accounts. Ask each provider what access their quoted price assumes, and share anything sensitive through the channel you agree with them, not in a scope document.

Is it safe to test an agent in production?

Only with written limits. Agree which actions must never really run, set rate and spending caps, and name someone who can stop the test. A staging copy with made-up customer data is the safer choice when your agent can send, change or delete things. Our guide to rules of engagement covers what that document should say.

Does our model provider's own testing cover us?

No. The model maker tests its model. It has not tested the documents your feature reads, the permissions behind your tools, or what your app does with the answer. Those parts are yours.

Is a provider missing, or has an offer changed?

Send us the provider name and the source page. We check corrections against the evidence and update the entry and its check date.

How we checked, and how we make money

We read each provider's own service and pricing pages on October 10, 2026 and recorded what the page says, including where two pages from the same company disagree. Everything in the tables is provider-published. We have not bought these services, inspected a real engagement or confirmed any term in writing with a provider. We do not perform or authorize penetration testing. Read our method.

Provider links on this page are plain links. Payment never decides which providers appear, the order or which offer fits. See how we make money.

Sources