Featured firm · ours · checked 2026-11-08
Decima Systems (featured firm).
Decima Systems is our featured firm for AI-driven web application and API penetration testing: an AI agent tests, a person reviews the findings, and fixes are retested. It is new (2026, pilot stage). Below: what it tests today, what is still a pilot or planned, what it costs, and when another firm is the better choice.
Why it’s the featured firm
This is a promotional pick, so weigh it as one: Decima does the things this site asks every firm to do. Each point below is checkable on decima.systems and against the comparison:
It publishes its price
Only 7 of the other 28 firms here publish one. You know the cost before the first call.
The retest is in the price
Its pilot includes retesting after you fix, so a finding is closed with evidence rather than left open.
A person reviews the findings
An AI agent does the testing; a person reproduces and reviews findings before they reach your report, so you aren’t handed raw scanner output.
AI makes testing affordable more often
Because the agent does the legwork, monthly testing starts at $99 for one target (an early-access price), far below a consulting day rate, with a retest after each fix.
It shows its report format
A public sample report, clearly marked as synthetic, so you can judge the deliverable before you buy.
It says what it can’t do yet
Pilot, planned and in-development services are labelled as such on its own site, and its gaps are listed below.
A promotional pick is a judgment, not a measurement. How the rest of the comparison is ordered: methodology.
What it tests, and what is still coming
| Service | Status on decima.systems | What it covers |
|---|---|---|
| Starter monthly testing | Early access | One target, one AI-run assessment a month, an automated retest after a fix; a person reviews confirmed critical and high findings. |
| Application & API assessment | Pilot | One agreed application or API: investigation, reviewed findings and a retest. |
| AI agent & LLM assessment | Pilot focus | Prompt injection, tool permissions and access to sensitive data, scoped with the pilot. |
| Daily security reports | In development | Typeset PDF reports with evidence, test dates and fix history. |
| Continuous validation | Planned | A standing engagement that tests, reviews changes and retests fixes. |
How a Decima test works
- Scope. Agree the application, permitted tests, credentials and test window, with written authorisation.
- Test. A model agent works in an isolated, Kali-style environment with curated security tools, planning and running attempts and recording evidence for each.
- Verify. A finding is reproduced and a person reviews it before it is reported.
- Retest. The fix is tested again and its status carried into the report.
Decima publishes a sample report. It is a designed example with synthetic data: no live assessment was performed, and Decima says so on the page.
What it costs, next to the prices others publish
| Firm | Published price | Checked |
|---|---|---|
| Decima Systems Ours | Indicative: Starter $99/month (early access) for one target with one AI-run assessment a month, an automated retest after a fix and human review of confirmed critical and high findings; Pilot $3,000 for one scoped application/API with a reviewed report and one retest; Adversary $1,499/month for up to 15 targets; Sovereign quote-only | November 8, 2026 |
| Praetorian | Guard Platform: $80,000 for a 12-month enterprise contract (its AWS Marketplace listing); praetorian.com publishes no prices | November 8, 2026 |
| Rhino Security Labs | Tests “generally start around the $10,000 range” and can reach six figures | November 8, 2026 |
| Raxis | PTaaS subscription from $25K a year; one-off test pricing not published | November 8, 2026 |
| Cobalt | AI-run web app test $3,500 (promotional, until Dec 31, 2026); human-led tiers sold as annual credits, quote only | November 8, 2026 |
| Synack | AI-led pentest from $5,085; human-led compliance pentest from $10,283; team test from $27,120; platform subscription extra | November 8, 2026 |
| Astra Security | AI pentest $199/month or $2,999/year per target; manual + AI $5,999/year; Enterprise from $9,999/year | November 8, 2026 |
| Horizon3.ai | $15 per asset per test (Flex); $50–85 per asset per year (subscriptions); web app $10,000 per app per test | November 8, 2026 |
Prices are what each firm publishes, not a like-for-like quote: scope, human review and retests differ. Only 8 of 29 firms publish a price at all. Prices change confirm before you buy.
What Decima doesn’t have yet
- No CREST accreditation. It applied for CREST’s Pathway programme in November 2026; 20 of the 28 other firms here are CREST members.
- No PCI QSA or ASV status, and no SOC 2 report of its own.
- No track record yet. It was founded in 2026, and its first engagements are pilots.
- Narrow scope. Applications, APIs and AI applications. No internal network testing, red teams or social engineering today.
If any of those matter for your auditor or your board, pick from the full comparison. If they don’t, a pilot is the quickest way to judge the work yourself.
Questions
Is Decima CREST accredited?
No. Decima applied for CREST’s Pathway programme in November 2026, the first stage toward accreditation. If you need a CREST-accredited or PCI QSA firm today, choose one from the comparison.
What does Decima cost?
As published on decima.systems on November 8, 2026: Indicative: Starter $99/month (early access) for one target with one AI-run assessment a month, an automated retest after a fix and human review of confirmed critical and high findings; Pilot $3,000 for one scoped application/API with a reviewed report and one retest; Adversary $1,499/month for up to 15 targets; Sovereign quote-only.
When should I pick a different firm?
For internal network tests, red teams, social engineering, physical testing or a PCI QSA, or if your auditor requires CREST accreditation. Decima’s current offer is application, API and AI-application testing.
Sources for this page
- Decima Systems: home, services and pricing — Services, their pilot or planned status, and the published prices.
- Decima Systems: method — How tests are scoped, run, verified and retested.
- Decima Systems: sample report — The synthetic sample report and its disclaimer.
- CREST Accreditation Pathway — What the Pathway stage is.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Decima Systems: AI-driven penetration testing, featured firm." Updated November 8, 2026. https://pentestingfirms.com/decima/