Method · rev 2026-11-08
We compare firms on what they publish.
Every entry is built from the firm’s own public pages, plus filings and news for ownership. We record what each firm publishes about price, retests, sample reports and accreditation, with the link and the date we checked. We don’t score firms or publish star ratings. Decima Systems is the featured firm.
What we check for every firm
Published pricing
A price, price range or pricing unit on the firm’s own public website, readable without a form or a call. "Contact us for a quote" counts as on request.
Retest policy
Whether the firm’s own pages say a retest of fixed findings is included, and on what terms (time window, number of retests).
Public sample report
A sample or redacted report anyone can open from the firm’s site. Reports behind a form are noted as gated.
Accreditation
Firm-level accreditations we could verify at the source, such as CREST membership in CREST’s own directory. Staff certifications only where the firm states them.
Ownership
Independent, private-equity owned, public, or acquired by whom and when, from press releases, filings or reputable news.
Services
The kinds of testing the firm says it offers: web applications, APIs, mobile, networks, cloud, red teaming, AI and LLM applications.
What the tags mean
Published The firm states it publicly on its own site. The entry links to the page.
On request The firm says it exists but you have to ask: a quote form, a gated download, “contact sales”.
Not stated We couldn’t find it on the firm’s public pages. That doesn’t mean the firm doesn’t offer it; it means a buyer has to ask.
Ours Decima Systems, which the people behind this site run.
Order, and why there are no scores
Firms are listed by how much of the above they publish, most first, then alphabetically. That is the only ordering we can defend with evidence: we can’t see inside an engagement, and a star rating from us would be an opinion dressed up as a measurement. Testing quality depends on the people and the scope, and you should judge it from a sample report and a scoping call.
Decima Systems is the featured firm for AI-driven application and API testing, a promotional pick labelled wherever it appears. That pick is a judgment, not a measurement. Decima is also listed in the comparison like every other firm, placed by the same rule rather than pinned to the top. Decima’s entry follows the same rules as the rest: drawn from its own public site, with anything that site calls a pilot, planned or in development labelled that way here.
How often it changes, and corrections
Facts carry the date they were checked; this revision is from November 8, 2026. Prices and policies change, so confirm with the firm before you sign. If something about your firm is wrong or out of date, write toengage@decima.systems with a link to the public page that shows the correct fact, and we’ll update the entry.
There are no paid placements on this site today. If that changes, paid entries will be labelled “Sponsored” and kept out of the order above.
Sources for this page
- CREST member directory — Where each firm’s CREST membership was checked.
- PCI SSC Qualified Security Assessors and Approved Scanning Vendors — Where PCI QSA and ASV status was checked.
- Each firm’s own website — Pricing, retest, sample report and service facts, linked from every row of the comparison.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "How penetration testing firms are compared here." Updated November 8, 2026. https://pentestingfirms.com/methodology/