Total Products under this Category: 200
Last updated: November 01, 2026
Why You Can Trust G2's Software Rankings:
G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.
Highlighted products: Cobalt, vPenTest, Astra Pentest, NodeZero from Horizon3, Oneleet, Pentera, H1 Platform, and Verizon Penetration Testing.
Underlying data: [Grid® JSON](https://www.g2.com/categories/penetration-testing-tools/grids.json?focus%5B%5D=cobalt-io-cobalt&focus%5B%5D=vpentest&focus%5B%5D=astra-pentest&focus%5B%5D=nodezero-from-horizon3&focus%5B%5D=oneleet&focus%5B%5D=pentera&focus%5B%5D=h1-platform&focus%5B%5D=verizon-penetration-testing)
AISafe Labs is a fully autonomous, AI penetration testing platform that discovers vulnerabilities and helps teams keep their web applications secure. Founded by renowned security researchers,
AIPTx is an AI-powered penetration testing platform that discovers vulnerabilities, validates exploits and delivers actionable security
Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.
SEWORKS focuses on automated offensive security to empower organizations to simulate real-world attack scenarios and discover security weaknesses in advance.
Assail is an autonomous offensive security platform that uses agentic AI to continuously discover, map, and exploit vulnerabilities across APIs, web applications, and mobile infrastructure. Rather than flagging theoretical risk, its platform, Ares, chains findings together the way a real attacker would and only surfaces an issue once exploitability has actually been proven, delivering evidence instead of a severity score. Built for security teams that need continuous validation between point-in-time assessments, Assail helps organizations catch new exposure as fast as their applications ship
Safe, real-world attack scenarios are at the click of a button. Designed for anyone to run with actionable guidance to keep you protected.
Autonomous Testing is an autonomous penetration test for mobile applications, web applications, internal network, and external network, that identifies vulnerabilities and misconfigurations with repeatable, on-demand, or scheduled runs. It is designed to deliver tenfold performance versus a traditional manual penetration test by identifying complex vulnerabilities, escalating misconfigurations, sophisticated exploit chains that mimic a persistent adversary, and producing developer-ready findings with clear reproduction steps and remediation guidance. Enables security and engineering teams to validate releases faster, reduce regression risk, and maintain a consistent security baseline across app versions and environments.
BugDazz Autonomous is an AI-driven penetration testing platform that continuously discovers, proves, and verifies vulnerabilities across web, API, and Active Directory environments
Bugsmirror Mobile Application Security Suite & Tools (MASST) is designed specifically for your business, providing scalable, end-to-end security for your mobile app. From detection to protection, MASST ensures your app is safeguarded against evolving security threats. With MASST, you can focus on growing your business, knowing your app is fully protected at every stage.
Callstrike is a deepfake attack simulation and training platform for enterprises. It tests how employees respond to AI-generated impersonation attacks across voice calls, video conferences and messaging apps. Security teams can run AI vishing campaigns, carry out real-time voice impersonation for red team exercises, create deepfake videos for training scenarios, and join live Zoom, Google Meet and Microsoft Teams calls using face and voice swapping. The platform also supports WhatsApp spear vishing and voice cloning from short audio samples. Adaptive training then adjusts to each employee's results, helping organisations find weak points and track improvement over time.
Perform agentic penetration testing for web apps, APIs, cloud environments, and AI systems. Optionally, have expert security engineers review every finding and get a FAANG-approved penetration test within days instead of weeks. Casco security test reports exceed the requirements for SOC2, ISO27001, PCI DSS, and other compliance frameworks.
Clone Systems Automated Penetration Testing is an automated penetration test you buy online at a published price and start the same day. It runs real exploitation attempts against your external IPs and domains or your internal network and Active Directory using production-safe playbooks mapped to MITRE ATT&CK, and every confirmed finding carries proof of exploit. Authenticated web application testing is included. The report pack (Executive Summary, Detailed Report, Letter of Attestation, Scan Comparison and a findings spreadsheet) is generated in the customer portal the moment the test completes, and you can fix a finding and retest inside your 30-day window to prove the fix. The reports are used as evidence for PCI DSS Requirement 11.4, SOC 2, HIPAA, ISO 27001, the FTC Safeguards Rule and cyber insurance renewals, and upload to Vanta, Drata or Secureframe. Pricing: automated external tests from $1,995 for one IP or domain ($3,495 for 10, $6,495 for 50) per 30-day window, automated internal tests from $2,995 for 25 hosts ($6,995 for 100, $12,995 for 250), and annual programs from $5,995 per year. Internal testing connects through a virtual appliance over VPN with nothing shipped on site. Where an assessor requires a human-performed test, Clone Systems also offers engineer-led penetration testing scoped to your environment. Clone Systems has delivered managed security since 1998 and has been a PCI SSC Approved Scanning Vendor since 2007, so PCI ASV scanning, vulnerability scanning and penetration testing can come from one vendor and one portal.
