Total Products under this Category: 172
Last updated: September 26, 2026
Why You Can Trust G2's Software Rankings:
G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.
Highlighted products: vPenTest, Cobalt, Astra Pentest, Oneleet, Pentera, NodeZero from Horizon3.ai, H1 Platform, and Bugcrowd.
Underlying data: [Grid® JSON](https://www.g2.com/categories/penetration-testing-tools/grids.json?focus%5B%5D=vpentest&focus%5B%5D=cobalt-io-cobalt&focus%5B%5D=astra-pentest&focus%5B%5D=oneleet&focus%5B%5D=pentera&focus%5B%5D=nodezero-from-horizon3-ai&focus%5B%5D=h1-platform&focus%5B%5D=bugcrowd)
SEWORKS focuses on automated offensive security to empower organizations to simulate real-world attack scenarios and discover security weaknesses in advance.
Assail is an autonomous offensive security platform that uses agentic AI to continuously discover, map, and exploit vulnerabilities across APIs, web applications, and mobile infrastructure. Rather than flagging theoretical risk, its platform, Ares, chains findings together the way a real attacker would and only surfaces an issue once exploitability has actually been proven, delivering evidence instead of a severity score. Built for security teams that need continuous validation between point-in-time assessments, Assail helps organizations catch new exposure as fast as their applications ship
Safe, real-world attack scenarios are at the click of a button. Designed for anyone to run with actionable guidance to keep you protected.
Autonomous Testing is an autonomous penetration test for mobile applications, web applications, internal network, and external network, that identifies vulnerabilities and misconfigurations with repeatable, on-demand, or scheduled runs. It is designed to deliver tenfold performance versus a traditional manual penetration test by identifying complex vulnerabilities, escalating misconfigurations, sophisticated exploit chains that mimic a persistent adversary, and producing developer-ready findings with clear reproduction steps and remediation guidance. Enables security and engineering teams to validate releases faster, reduce regression risk, and maintain a consistent security baseline across app versions and environments.
BugDazz Autonomous is an AI-driven penetration testing platform that continuously discovers, proves, and verifies vulnerabilities across web, API, and Active Directory environments
Bugsmirror Mobile Application Security Suite & Tools (MASST) is designed specifically for your business, providing scalable, end-to-end security for your mobile app. From detection to protection, MASST ensures your app is safeguarded against evolving security threats. With MASST, you can focus on growing your business, knowing your app is fully protected at every stage.
Callstrike is a deepfake attack simulation and training platform for enterprises. It tests how employees respond to AI-generated impersonation attacks across voice calls, video conferences and messaging apps. Security teams can run AI vishing campaigns, carry out real-time voice impersonation for red team exercises, create deepfake videos for training scenarios, and join live Zoom, Google Meet and Microsoft Teams calls using face and voice swapping. The platform also supports WhatsApp spear vishing and voice cloning from short audio samples. Adaptive training then adjusts to each employee's results, helping organisations find weak points and track improvement over time.
Perform agentic penetration testing for web apps, APIs, cloud environments, and AI systems. Optionally, have expert security engineers review every finding and get a FAANG-approved penetration test within days instead of weeks. Casco security test reports exceed the requirements for SOC2, ISO27001, PCI DSS, and other compliance frameworks.
ComplyArmor — an autonomous offensive security engine that pentests your attack surfaces continuously.
CyberOrbit.ai is a penetration testing platform combining AI automation with certified security professional oversight to deliver audit-ready security assessments. It conducts continuous testing across external attack surfaces, web applications, networks, cloud configurations, and email systems. AI agents map attack surfaces, identify vulnerabilities, and maintain evidence, while certified professionals review and sign findings. Reports include executive summaries, methodologies, detailed findings with CVSS scores, remediation guidance, and compliance mappings for standards like ISO 27001, SOC 2, and PCI-DSS. Testing spans six domains, prioritizing remediation by impact and blast radius over CVSS scores. Re-testing is included post-remediation.
