$ list --filter=quote-only

18 of the 20 vendors in this index publish tier structures (or nothing) but no usable dollar figure. Here they are with what to ask before signing.

$ answer --question="Which pen-test vendors hide pricing entirely?"

Eighteen of the twenty vendors tracked here are quote-only: Cobalt.io, HackerOne, Bugcrowd, Synack, NetSPI, Rapid7, Bishop Fox, Trustwave SpiderLabs, Coalfire, Praetorian, Mandiant, CrowdStrike, Secureworks, Pentera, Intruder.io, BreachLock, DeepSeas Red (ex RedTeam Security), Schellman. Cobalt and BreachLock publish tier maps; the rest route every product to a sales call. None of this is unique to pen-test; it mirrors the wider enterprise-security purchasing pattern.

Last verified June 2026

$ vendors --list

$ open --route=/cobalt-pricing
quote-only
Cobalt.io
PtaaS · Quote only, contact vendor
open
$ open --route=/hackerone-pricing
quote-only
HackerOne
Bug bounty · Quote only, contact vendor
open
$ open --route=/bugcrowd-pricing
quote-only
Bugcrowd
Bug bounty · Quote only, contact vendor
open
$ open --route=/synack-pricing
quote-only
Synack
PtaaS · Quote only, contact vendor
open
$ open --route=/netspi-pricing
quote-only
NetSPI
PtaaS · Quote only, contact vendor
open
$ open --route=/rapid7-pricing
quote-only
Rapid7
Boutique · Quote only, contact vendor
open
$ open --route=/bishop-fox-pricing
quote-only
Bishop Fox
Boutique · Quote only, contact vendor
open
$ open --route=/trustwave-spiderlabs-pricing
quote-only
Trustwave SpiderLabs
Boutique · Quote only, contact vendor
open
$ open --route=/coalfire-pricing
quote-only
Coalfire
Audit firm · Quote only, contact vendor
open
$ open --route=/praetorian-pricing
quote-only
Praetorian
Boutique · Quote only, contact vendor
open
$ open --route=/mandiant-pricing
quote-only
Mandiant
Boutique · Quote only, contact vendor
open
$ open --route=/crowdstrike-pricing
quote-only
CrowdStrike
Boutique · Quote only, contact vendor
open
$ open --route=/secureworks-pricing
quote-only
Secureworks
Boutique · Quote only, contact vendor
open
$ open --route=/pentera-pricing
quote-only
Pentera
Platform · Quote only, contact vendor
open
$ open --route=/intruder-pricing
quote-only
Intruder.io
Platform · Tiered subscription, exact prices on application
open
$ open --route=/breachlock-pricing
quote-only
BreachLock
PtaaS · Three tiers published, prices on application
open
$ open --route=/redteam-security-pricing
quote-only
DeepSeas Red (ex RedTeam Security)
Boutique · Quote only, contact vendor
open
$ open --route=/schellman-pricing
quote-only
Schellman
Audit firm · Quote only, contact vendor
open

$ before-signing --questions

Send every quote-only vendor the same twelve-question RFP. The answer-quality difference is itself a buying signal. See the RFP template.