Total Products under this Category: 136
Last updated: August 05, 2026
Why You Can Trust G2's Software Rankings:
G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.
Highlighted products: Cobalt, vPenTest, Astra Pentest, Oneleet, NodeZero from Horizon3.ai, Bugcrowd, Verizon Penetration Testing, and H1 Platform.
Underlying data: [Grid® JSON](https://www.g2.com/categories/penetration-testing-tools/grids.json?focus%5B%5D=cobalt-io-cobalt&focus%5B%5D=vpentest&focus%5B%5D=astra-pentest&focus%5B%5D=oneleet&focus%5B%5D=nodezero-from-horizon3-ai&focus%5B%5D=bugcrowd&focus%5B%5D=verizon-penetration-testing&focus%5B%5D=h1-platform)
Sponsored
Cyver Core is a pentest collaboration and management platform to digitize, automate, and optimize manual work for pentest firms, while enabling Pentest-as-a-Service delivery. Cyver Core offers pentest report automation, branded client portals, pentest management, team management, and more.
Veracode helps companies that innovate through software deliver secure code on time. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline,empower developers to fix security defects, and scales your program through best practices to achieve your desired outcomes. Veracode covers your all your AppSec needs in one solution through a combination of five analysis types available for 24 programming languages, 77 frameworks, and application types as varied as microservices, mainframe and mobile apps.
Average Rating: 3.8/5.0
Total Reviews: 25
AI-generated summary from verified user reviews
"Streamlined Security, Effortless Integration"
Rating: 5.0/5.0 stars
— Bhanu Prakash M.
"Clear, Unified View of Application Capabilities"
Rating: 4.5/5.0 stars
— Christopher S.
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
Average Rating: 4.0/5.0
Total Reviews: 12
"Great SQL injection finding tool"
Rating: 5.0/5.0 stars
— Ashen S.
Rating: 4.0/5.0 stars
— Verified User in Accounting
NowSecure Inc., based in Oak Park, Illinois, was formed in 2009 with a mission to advance mobile security worldwide. We help secure mobile devices, enterprises and mobile apps.
Average Rating: 4.6/5.0
Total Reviews: 27
"NowSecure has proven to be an invaluable asset to our mobile application security testing process."
Rating: 5.0/5.0 stars
— Sam S.
"Unmatched efficiency and Expertise in Mobile App Security"
Rating: 5.0/5.0 stars
— Diego T.
Autonomous AI penetration testing
Average Rating: 5.0/5.0
Total Reviews: 9
"AI-Driven Continuous Pen Testing with Validated Findings"
Rating: 5.0/5.0 stars
— Jan M.
"Automates Pen Testing with Clear, Actionable Security Insights"
Rating: 5.0/5.0 stars
— Andrew H.
ZeroThreat is an AI-powered web application and API penetration testing platform designed to identify real, exploitable vulnerabilities, not just surface-level findings. Built for modern engineering teams, it combines Agentic AI pentesting with a high-performance scanning engine to deliver up to 10× faster, deeply validated security testing. Unlike traditional DAST tools that rely on static signatures and generate excessive noise, ZeroThreat executes adaptive, attacker-style workflows that evolve based on application behavior. Its interpreter-driven vulnerability intelligence continuously ingests emerging threats and newly disclosed CVEs, enabling near real-time detection updates and rapid CVE-to-exploit mapping. The platform supports over 100,000 vulnerability checks, including native Nuclei template execution, and extends beyond known issues with zero-day detection through behavioral pattern analysis. It validates every finding through live exploit execution, ensuring only real, impactful vulnerabilities are reported, with clear proof of risk and exposed data.
Average Rating: 4.8/5.0
Total Reviews: 10
AI-generated summary from verified user reviews
"Accurate Scans Without All the False Alarms"
Rating: 4.5/5.0 stars
— Aiden M.
"Continuous Testing & Early Fixes"
Rating: 5.0/5.0 stars
— Ethan H.
Reflectiz is the AI-powered web exposure company trusted by hundreds of global organizations, including DAZN, Cox Communications, Village Roadshow, and Leeds United, to continuously monitor everything that executes on their live websites. Rather than scanning code or configuration, Reflectiz watches real browser execution, the actual scripts, pixels, and third and fourth-party tools running in front of your users, and applies AI to flag malicious behavior, unauthorized data flows, and compliance gaps the moment they appear. Reflectiz is built around four hubs that all run on this same engine. Security Hub continuously monitors every script and library executing on your site, catching Magecart-style skimming, supply chain attacks, and AI-generated threats that firewalls and perimeter tools were never built to see. Privacy Hub verifies that user data is only collected and shared the way your consent banner promises, supporting GDPR, CCPA, HIPAA, and PIPEDA. Offensive Hub runs continuous, agentic penetration testing, using AI agents to map applications and validate exploitable risks at up to 10x the capacity of manual pentesting. PCI Module automates PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1 with audit-ready evidence. Together, the four hubs give Security, Privacy, Compliance, and Digital teams one 360-degree view of web risk instead of four disconnected tools and reports. Reflectiz operates entirely remotely through its proprietary sandbox browser, with zero code changes, zero agents, and no access to sensitive data, typically going live within one business day. Its Exposure Rating draws on an intelligence database built from monitoring millions of websites, and the platform has been recognized with a 2026 Fortress Cyber Security Award, a 2025 Top InfoSec Innovator award, and G2 High Performer status. Customers frequently cite fast, hands-off onboarding and responsive support alongside a growing library of published case studies across e-commerce, financial services, and entertainment.
Average Rating: 4.7/5.0
Total Reviews: 32
AI-generated summary from verified user reviews
"Seamless PCI Compliance and Strong Script Visibility with Reflectiz"
Rating: 5.0/5.0 stars
— Raja Sekhara Reddy G.
"Reflectiz Streamlines PCI Compliance and Strengthens Ongoing Website Script Monitoring"
Rating: 5.0/5.0 stars
— David K.
AppSecure Security is a CREST-accredited offensive security company specializing in Red Teaming, Penetration Testing (Pentesting), and Vulnerability Assessment and Penetration Testing (VAPT). We deliver hacker-focused security assessments to help businesses understand their security posture and protect against real-world cyber threats. Our expert team employs cutting-edge, real-world hacking techniques to evaluate your organization’s security posture, identify critical security vulnerabilities, and work with your team to remediate them effectively. Backed by elite security researchers with proven expertise in leading bug bounty programs like PayPal, Reddit, LinkedIn, Instacart, and more, AppSecure Security is your trusted partner in safeguarding your business from evolving cyber threats.
Average Rating: 4.9/5.0
Total Reviews: 7
AI-generated summary from verified user reviews
"Safeguard your assets from all possible threats."
Rating: 5.0/5.0 stars
— Verified User in Banking
"I have experience in providing strategic insights, writing and analyzing software tools."
Rating: 5.0/5.0 stars
— Umair A.
The ImmuniWeb AI Platform helps over 1,000 enterprise customers from more than 50 countries to test, secure and protect their web and mobile applications, APIs and microservices, cloud and networks, to prevent data breaches and reduce third-party risk, and to comply with regulatory requirements. ImmuniWeb’s products available on the Platform include Continuous Threat Exposure Management (CTEM), External Attack Surface Management (EASM), Dark Web Monitoring and phishing websites takedown, as well as vulnerability scanning and penetration testing for web and mobile apps, cloud and network infrastructure, and LLM models. Headquartered in Geneva, Switzerland, ImmuniWeb has offices in Washington, London and Dubai to provide an uninterrupted service to all global customers and partners.
Average Rating: 4.7/5.0
Total Reviews: 11
AI-generated summary from verified user reviews
"Detailed Remediation Steps and Flexible Report Views Boost Our Efficiency"
Rating: 5.0/5.0 stars
— Harish G.
Rating: 5.0/5.0 stars
— Markus S.
PentestPad is a penetration testing reporting platform used by offensive security consultancies, managed security service providers, and in-house red teams to manage engagements end-to-end and deliver client-ready reports. Testers create projects, capture findings with evidence and CVSS scoring, and collaborate in a shared editor where an AI assistant drafts finding descriptions, impact statements, and remediation guidance based on the vulnerability context already entered. Existing DOCX report templates can be imported and rebuilt inside PentestPad at no additional cost, so consultancies retain their established report style rather than adopt a vendor template. Scanner output from Nessus, Burp Suite, Nuclei, and custom feeds can be imported directly into a project, and finished reports export to DOCX, PDF, and XLSX. It consolidates project planning, collaborative finding management, AI-assisted report writing, and client delivery into a single web application. PentestPad is available as a managed EU-hosted cloud service and as a fully self-hosted installation for air-gapped and regulated environments. The AI assistant can be configured to use a self-hosted language model so client data never leaves the customer's infrastructure. PentestPad is ISO 27001 certified, GDPR compliant, EU-hosted by default, and priced publicly per seat.
Average Rating: 5.0/5.0
Total Reviews: 7
"PentestPad Streamlines Our Pentest Workflow with Fast, Client-Ready Reporting"
Rating: 5.0/5.0 stars
— Leo V.
"Strong Manual Pentesting and Professional Reporting Experience with PentestPad"
Rating: 5.0/5.0 stars
— Verified User in Information Technology and Services
PlexTrac is the leading AI-powered platform for pentest reporting and threat exposure management, trusted by Fortune 500 companies and top security providers. Built to help cybersecurity teams continuously manage and reduce threat exposure, PlexTrac centralizes security data, streamlines reporting, prioritizes risk, and automates remediation workflows—empowering teams to drive measurable risk reduction. The platform is ideal for enterprises & service providers looking to deliver a Continuous Threat Exposure Management (CTEM) framework across their business. With our suite of solutions, you can consolidate security data from tools and manual testing, automatically prioritize risks based on business impact, and automate remediation and retesting workflows for ongoing, more effective threat management.
Average Rating: 4.8/5.0
Total Reviews: 15
AI-generated summary from verified user reviews
"Game Changer for My Cybersecurity Consultancy"
Rating: 5.0/5.0 stars
— Anthony T.
"A Game-Changer for Offensive Security Services"
Rating: 5.0/5.0 stars
— Rene V.
Cytix is the security decision layer for a world where software development never stops. It reads the context behind every ticket, pull request and release, and helps security, engineering and risk teams decide which software changes carry real risk, what response is proportionate, and what evidence to keep. Cytix already powers KPMG and NCC Group's continuous testing programme, turning software change into security decisions the business can stand behind.
Average Rating: 4.7/5.0
Total Reviews: 11
AI-generated summary from verified user reviews
"Cytix has enabled us to streamline secure application development processes"
Rating: 5.0/5.0 stars
— Verified User in Computer & Network Security
Rating: 5.0/5.0 stars
— vikas D.
Penti addresses the complex and costly problem of cybersecurity for SMEs with its AI-enhanced penetration testing platform. By blending cutting-edge AI with expert human oversight, Securily provides thorough, efficient, and affordable security assessments. This unique approach not only detects vulnerabilities but also guides remediation, helping businesses strengthen their defenses and comply with industry standards effortlessly.
Average Rating: 5.0/5.0
Total Reviews: 6
"Our preferred pentesting partner!"
Rating: 5.0/5.0 stars
— Drew D.
"An easy, quick, and effective security solution, backed by an experienced team"
Rating: 5.0/5.0 stars
— Verified User in Computer Software
Escape automates the full offensive security lifecycle, multiplying the impact of every security engineer tenfold. Our key products: 1. Attack Surface Management: Discover and validate exposure of modern applications, APIs, and infrastructure from code to cloud. 2. Business-logic-aware DAST: Replace legacy DAST with business-logic-aware testing that improves over time and helps your team remediate real, exploitable vulnerabilities. 3. AI Pentesting: Replace manual pentest and bug bounty programs with a solution that scales. Escape is a customer-centric company, supporting more than 2000+ security teams worldwide, and we have the privilege of working with exceptional companies like Schibsted (Media), HealthEquity (Healthcare), Applied (InsurTech), Visma & Miro (Tech), DoubleVerify (AdTech), Thinkific (EdTech), and many others.
Average Rating: 4.9/5.0
Total Reviews: 10
AI-generated summary from verified user reviews
"Fast, Transparent DAST with Excellent GraphQL Handling and Strong Support"
Rating: 4.0/5.0 stars
— Varun S.
Rating: 5.0/5.0 stars
— Verified User in Information Technology and Services
Hexway is a full-cycle pentest reporting, automation, collaboration, and management platform. Simplify reporting by integrating tools, aggregating data during the project, collaborating with teammates, reducing time, and providing better pentest services with Hexway Pentest Suite.
Average Rating: 4.6/5.0
Total Reviews: 4
"Seamless integration and collaboration, Excellent Support"
Rating: 5.0/5.0 stars
— Derick B.
"Great UI with Features that makes sense"
Rating: 5.0/5.0 stars
— Tengku Z.
Test running apps and services for common security weaknesses and vulnerabilities using malformed inputs to detect flaws. Leverage fully automated tests across 250+ test suites, protocol-specific attack patterns and automatic test mutation
Average Rating: 4.2/5.0
Total Reviews: 3
"Great tool to test the Protocols. "
Rating: 4.0/5.0 stars
— Verified User in Electrical/Electronic Manufacturing
Rating: 5.0/5.0 stars
— Verified User in Computer & Network Security
