Penetration testing firm trusted by nine of the top ten US banks, with the Resolve platform for continuous attack surface management.
Accreditations: SOC 2, ISO 27001, CREST
Services: Web Application, Network, Cloud, API +7
PTES Penetration Testing Providers
Penetration Testing Execution Standard · Published by PTES Community
The Penetration Testing Execution Standard (PTES) provides a comprehensive framework that defines the entire penetration testing engagement lifecycle from start to finish. Developed by a group of information security practitioners, PTES covers seven distinct phases: pre-engagement interactions, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation, and reporting. Each phase is defined with detailed technical guidelines that help both testers and clients understand what a professional penetration test should include.
PTES is particularly valuable because it addresses not just the technical testing itself but also the business and communication aspects of an engagement, including scoping, rules of engagement, legal considerations, and report structure. The standard includes a technical guidelines supplement that provides specific techniques, tools, and procedures for each testing phase, making it practical for testers to implement.
PTES is methodology-agnostic regarding specific tools, focusing instead on the objectives and outcomes of each phase. Many penetration testing providers reference PTES alongside other frameworks to ensure their engagements follow a structured, professional process that delivers consistent, repeatable results across different testing scenarios and client environments.
Key Features
- —Seven-phase engagement lifecycle
- —Pre-engagement through reporting coverage
- —Technical guidelines supplement
- —Tool-agnostic approach
- —Business and communication guidance
Best For
- —Full-scope penetration testing
- —Engagement lifecycle management
- —Network penetration testing
- —Structured testing methodology
- —Client communication frameworks
Providers using PTES (72)
72 providers
CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.
Accreditations: CREST, CHECK, STAR, NCSC Assured, ISO 27001 +1
Services: Web Application, Network, Mobile App, API +8
Full-service London-based cybersecurity consultancy with CREST, CHECK, and NCSC accreditations delivering offensive testing, managed detection, and strategic advisory services.
Accreditations: CREST, CREST AI Penetration Testing, CHECK, ISO 27001, Cyber Essentials +2
Services: Web Application, Network, Cloud, API +5
Global managed security provider with the elite SpiderLabs penetration testing team and deep PCI DSS compliance expertise.
Accreditations: PCI QSA, ISO 27001, SOC 2, CREST
Services: Web Application, Network, Mobile App, Cloud +6
US penetration testing firm founded in 2011, running 600+ engagements a year with a fully remote, US-based team. Manual, expert-led testing across web, network, cloud, mobile, wireless, OT/ICS, and AI/LLM. Gartner Sample Vendor for PTaaS.
Accreditations: OSCP Employer
Services: Web Application, Network, Mobile App, Cloud +12
Manchester-based independent cybersecurity consultancy with over 20 years of experience delivering CREST and CHECK-accredited penetration testing, red teaming, and compliance certification services.
Accreditations: CREST, CHECK, ISO 27001, Cyber Essentials, Cyber Essentials Plus +1
Services: Web Application, Network, Mobile App, Cloud +5
Fast-growing CREST and CHECK-accredited UK cybersecurity consultancy with deep expertise in critical national infrastructure sectors.
Accreditations: CREST, CHECK, ISO 27001, Cyber Essentials Plus
Services: Web Application, Network, Cloud, API +6
World-renowned cybersecurity firm now part of Google Cloud, delivering threat intelligence-led penetration testing and red teaming informed by front-line incident response experience.
Accreditations: SOC 2, ISO 27001, FedRAMP 3PAO
Services: Red Teaming, Purple Teaming, Network, Web Application +5
US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.
Accreditations: FedRAMP 3PAO, PCI QSA, SOC 2, ISO 27001
Services: Web Application, Network, Mobile App, Cloud +11
Creators of Metasploit offering enterprise penetration testing integrated with their comprehensive vulnerability management and security operations platform.
Accreditations: SOC 2, ISO 27001
Services: Web Application, Network, Mobile App, Cloud +6
Helsinki-headquartered Finnish cybersecurity firm with roots dating to 1988, offering CREST-accredited penetration testing and deep expertise in EU regulatory compliance including GDPR, NIS 2, and TIBER-EU.
Accreditations: CREST, ISO 27001
Services: Web Application, Network, Cloud, API +6
Compliance-focused cybersecurity advisory firm and FedRAMP 3PAO specializing in penetration testing that meets stringent regulatory requirements.
Accreditations: SOC 2, FedRAMP 3PAO, PCI QSA, ISO 27001
Services: Web Application, Network, Cloud, API +4
PTES FAQs
What are the seven phases of PTES?+
The seven PTES phases are: Pre-engagement Interactions, Intelligence Gathering, Threat Modelling, Vulnerability Analysis, Exploitation, Post-Exploitation, and Reporting. Each phase has defined objectives and deliverables.
How does PTES differ from OWASP?+
OWASP focuses specifically on application security testing with detailed test cases. PTES covers the entire penetration testing engagement lifecycle including scoping, communication, and reporting, making it broader in scope but less application-specific.
Is PTES still actively maintained?+
PTES was published as a community standard and remains widely referenced, though updates have been infrequent. Many providers use PTES as a foundational framework supplemented by more frequently updated resources like OWASP.