Top Penetration Testing Companies In New York For 2026
Dominic Tarn
Head Writer - ReVerb
10.23.2026
The strongest penetration testing companies in New York in 2026 are Kroll, Trail of Bits and IBM X-Force Red. Kroll pairs CREST-accredited testing with one of the largest incident response practices in the country, run from its global headquarters at One World Trade Center. Trail of Bits is the pick for deep code-level assurance on AI, blockchain and cryptographic systems. IBM X-Force Red, part of Armonk-headquartered IBM, covers applications, networks, hardware and people at enterprise scale with its Red Portal platform. Below them sits a bench of NYC boutiques that are easier to engage and often a better match for startups, funds and mid-market firms.
This list is for security leaders, CTOs and compliance officers who want a tester with a real New York base: someone who can be on site in Manhattan or Brooklyn, understands the regulators that oversee New York finance and insurance, and can produce evidence that stands up to an NYDFS examiner. Every firm below has a verified headquarters, office or registered business address in New York City or New York State. We ranked them on depth of manual testing, breadth of services, published research, compliance fit and how clearly they describe what a client actually receives.
Penetration Testing Companies In New York At A Glance
Company
Headquarters
Best For
Key Services
Kroll
One World Trade Center, New York, NY
Regulated enterprises that want testing and incident response under one roof
Network, web, API, mobile, cloud, IoT, red team, AI/LLM testing
Trail of Bits
Park Avenue South, New York, NY
Code-level assurance for AI, blockchain and cryptography
Product companies that need source-assisted application testing
Application assessments, reverse engineering, fuzzing, exploit development
Gotham Security (Abacus Technology)
Manhattan, NY
Hedge funds and financial firms
Red team testing, adversary-led pentesting, application testing
CYBRI
433 Broadway, New York, NY
Startups and SaaS firms preparing for SOC 2 or ISO 27001
Web, mobile, API, network, cloud and LLM testing
Virtue Security
New York, NY
Application and AWS testing for SaaS and healthcare
Application, API, AWS, cloud and network pentesting
Invadel
1178 Broadway, New York, NY
Buyers who want fixed prices and on-site NYC coverage
Application, cloud, network, OT, red team, PTaaS
Best Penetration Testing Companies In New York In 2026
1. Kroll — CREST-Accredited Testing Backed By A Global Incident Response Practice
Kroll runs its global business from One World Trade Center in Lower Manhattan, and its offensive security team is one of the most complete in the city. The service catalog covers web applications, APIs, mobile apps, cloud, internal and external networks, IoT and hardware, and container environments. It also offers red teaming, threat modeling, AI and LLM security testing, and an agile testing model that folds regular tests into the software development lifecycle.
Engagements follow a six-phase method: scoping, reconnaissance, scanning and vulnerability analysis, threat modeling, attack execution, then reporting and advisory. Kroll holds global CREST accreditation for penetration testing and is a certified PCI Forensic Investigator, which matters if a test is part of a payment card program. The firm says it handles more than 3,000 cyber incidents a year, so testers see current attacker behavior first hand.
The tradeoff is scale. Kroll is a large advisory firm, and pricing and process reflect that. For a bank, insurer or law firm that wants testing, incident response and cyber insurance support from one vendor, that is the point.
Best for: Regulated New York enterprises that want CREST-accredited testing linked to incident response and forensics.
2. Trail of Bits — Deep Security Reviews For AI, Blockchain And Cryptographic Systems
Trail of Bits has operated since 2012 and lists its address on Park Avenue South in Manhattan. It also started Empire Hacking, a long-running New York security meetup. The firm is less a checklist pentest shop than a research-driven engineering team: its work spans software assurance across the full development lifecycle, application security reviews of code, cloud and architecture, AI and ML system reviews, blockchain audits, and applied cryptography including zero-knowledge proofs, multi-party computation and post-quantum migrations.
Its research record is unusual for a services firm. Trail of Bits placed second in the DARPA Cyber Grand Challenge in 2016 and took second place at the DARPA AI Cyber Challenge finals in 2025. It maintains more than 200 open-source repositories, including Slither, Echidna and Medusa, which it uses in its own smart contract reviews. The firm publishes many of its audit reports, so buyers can read real deliverables before they sign.
If you need a network test for an annual compliance checkbox, Trail of Bits is likely more than you need. If you are shipping an AI agent, a protocol or cryptographic code that has to hold up, it belongs on your shortlist.
Best for: Engineering-led companies that need code-level assurance on AI systems, blockchains or cryptography.
3. IBM X-Force Red — Enterprise Offensive Security Program With The Red Portal Platform
IBM launched X-Force Red in 2016 as its dedicated security testing team, and it now sits inside IBM, which is headquartered in Armonk in Westchester County. The team tests applications, networks, cloud, hardware and AI systems, and it runs threat actor emulation, breach readiness exercises, and phishing, vishing and physical social engineering. Its AI red teaming covers prompt injection, model manipulation and data exposure.
Clients manage work through Red Portal, where they can schedule expert-led tests, launch autonomous tests, centralize findings, connect results to ticketing and vulnerability management tools, and track remediation. IBM maps testing to PCI DSS, HIPAA, SOC 2, ISO 27001, FedRAMP, DORA and TIBER-EU, which helps global firms with New York operations that answer to several regulators at once.
Best for: Large enterprises that want a continuous, platform-managed testing program across many business units.
4. BreachLock — CREST-Certified PTaaS With Autonomous Testing Built In
BreachLock lists its US office at 1350 Avenue of the Americas in Midtown Manhattan, with further offices in London, Amsterdam and Noida. Its core product is penetration testing as a service: CREST-certified tests that can be scoped and launched within 24 to 48 hours, with findings posted as they are discovered, unlimited retesting and reports mapped to SOC 2, PCI DSS, ISO 27001 and HIPAA.
Around that service, BreachLock sells attack surface management, continuous penetration testing and Breach360, an autonomous multi-step testing engine that runs from reconnaissance through exploitation and lateral movement, with human approval points and a kill switch. The company is named a Representative Vendor in Gartner’s 2026 Market Guide for Adversarial Exposure Validation. In-house testers hold credentials such as OSCP and OSCE.
Best for: SaaS and mid-market teams that want fast scheduling, a live findings portal and frequent retests.
5. Include Security — Brooklyn Application Security Specialists For Source-Assisted Testing
Include Security is headquartered in Brooklyn and has focused on application security since 2010. It assesses mobile, web, IoT, server, client and web services targets, and builds custom fuzzing and dynamic analysis tooling, reverse engineers software and develops exploits when a finding needs proof. The firm favors source-assisted assessments, where testers work with your code as well as the running app, and it says every consultant has at least five years of application hacking experience.
Scoping is based on codebase size, language, attack surface and the level of assurance you need, not on small, medium or large packages. Each project has a technical project manager as the single contact, and the report, with risk-ranked findings, reproduction steps and remediation advice, is targeted for about a week after testing ends. The team blogs regularly; 2026 posts cover AI-assisted source code review, Android data storage and gaps between Terraform and console defaults on AWS.
Best for: Product companies in streaming, consumer hardware, healthcare and software that want experienced testers inside their code.
Gotham Security was founded in Manhattan in 2013 as a boutique offensive security firm offering penetration testing, adversary simulation and threat intelligence. Its clients included hedge funds, insurers and options exchanges. In January 2023 Abacus Group, the New York managed IT provider for financial services and healthcare, acquired Gotham and its parent GoVanguard, and Gotham’s red team work is now sold as Abacus Technology’s red team testing service.
The service combines adversary-led testing (privilege escalation, lateral movement and real exploitation paths) with testing of web and mobile apps, APIs and large language models. Abacus also offers continuous autonomous testing on Horizon3.ai’s NodeZero platform, and feeds results into its NIST-based risk assessments and a cybersecurity dashboard. The Gotham team has a public research record: it found two critical ScreenConnect vulnerabilities that ConnectWise confirmed and patched.
Best for: Hedge funds, private equity firms and other financial businesses that want red teaming from a provider that already knows their sector.
7. CYBRI — SoHo Pentest Firm For Startups Chasing SOC 2 And ISO 27001
CYBRI was founded in New York City in 2017 and works from 433 Broadway in SoHo. It tests web and mobile applications against the OWASP Top 10, internal and external networks, APIs, AWS, Azure and Google Cloud, and large language models. Its compliance-focused testing maps to SOC 2, HIPAA, PCI DSS, SEC rules, ISO 27001, GDPR and ISO 42001.
Work runs through the Blue Box platform, a cloud dashboard where clients track progress, assign findings to developers and download executive and technical reports. CYBRI includes 90 days of remediation validation and lets clients speak directly with the OSCP-certified testers on their project. Co-founder Paul Kubler leads the red team.
Best for: Startups and SaaS firms that need audit-ready pentest evidence and direct access to the testers.
8. Virtue Security — Focused Application, API And AWS Pentesting From A Small NYC Team
Virtue Security is a New York-based firm that limits itself to two things: application and network penetration testing. On the application side it covers web apps, mobile apps, APIs and thick clients. On infrastructure it tests internal and external networks and AWS, Azure and Google Cloud environments, and it is an AWS partner. Retesting and follow-ups are included in its assessments.
The team is small and founder-led, under CEO Elliott Frantz, and scoping starts with a demo call where testers review your technology before writing a proposal. For networks it also offers a continuous testing model that automates scans and reporting between manual tests. Healthcare is a visible focus, with work for providers, payers and health tech vendors.
Best for: SaaS and healthcare technology companies that want a specialist for application and cloud testing rather than a full-service firm.
9. Invadel — Fixed-Price NYC Penetration Testing With On-Site Coverage Across The Metro Area
Invadel is headquartered at 1178 Broadway in NoMad and covers the five boroughs, Long Island, Westchester, New Jersey and Connecticut on site. The catalog is broad: web, API, mobile and thick-client testing, secure code review and smart contract audits; cloud, Kubernetes, Microsoft 365, Salesforce and AI testing; external, internal, Active Directory, wireless, IoT, OT and physical tests; and phishing, red team and purple team work.
Its main draw is published pricing. Engagements are fixed scope and fixed price, with web applications starting at $5,200, APIs at $4,000 and external networks at $4,200, and a free retest with every project. Testing usually starts within a week of a signed proposal, and the firm maps its work to NYDFS 23 NYCRR 500, SOC 2, PCI DSS, HIPAA, ISO 27001 and CMMC Level 2.
Best for: Small and mid-sized New York firms that want a known price and a tester who can come on site.
NYDFS Penetration Testing: What 23 NYCRR 500 Requires
For many buyers, the reason to hire New York penetration testing services is the New York Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500. It applies to banks, insurers, money transmitters, virtual currency businesses and other entities licensed by DFS, and it is one of the few US rules that sets a specific testing schedule.
Section 500.5, as amended effective November 1, 2023, requires covered entities to run penetration tests of their information systems from both inside and outside the system boundaries, carried out by a qualified internal or external party at least once a year. The same section requires automated vulnerability scans, plus manual review of systems the scans do not cover, at a frequency set by the entity’s risk assessment and promptly after material system changes. The amendment dropped the old bi-annual vulnerability assessment and phased in the scanning requirement from May 1, 2025.
In practice, NYDFS penetration testing means an annual internal and external test, documented well enough to support the compliance certification that the CISO and the most senior executive must sign each year. When you brief a tester, ask for a report that states scope, dates, tester qualifications and remediation status, so it can serve as evidence. Our guide to penetration testing for compliance explains how NYDFS testing overlaps with PCI DSS, SOC 2 and HIPAA.
How To Choose A Penetration Testing Company In New York
Do You Need A Compliance Test Or A Deep Assessment?
An annual NYDFS or SOC 2 test and a source-level review of a new trading platform are different jobs. Compliance-driven tests reward clear reporting and predictable scheduling, which favors firms like CYBRI, BreachLock and Invadel. High-risk products reward depth, which is where Trail of Bits, Include Security and Kroll stand out. Decide which you are buying before you compare quotes.
Who Will Actually Do The Testing?
Ask for the names and certifications of the testers who will be assigned, not the firm’s best people in general. Check whether work is done by employees or contractors, and where they are based if data residency or on-site access matters. Our list of the best penetration testing certifications shows which credentials signal hands-on skill.
Can They Test Inside And Outside Your Network?
Part 500 explicitly calls for testing from inside and outside system boundaries. Confirm the vendor will run both an external test and an internal or assumed-breach test, and that cloud and identity systems such as Active Directory and Microsoft 365 are in scope where they hold sensitive data.
What Does The Report And Retest Include?
Ask for a sample report. A good one has an executive summary, risk-rated findings, reproduction steps and specific fixes. Check whether retesting is included and for how long; several firms here include at least one retest, and some offer unlimited retests through a platform.
How Is The Engagement Priced?
Price depends on scope: number of applications, IP addresses, user roles and testing days. Fixed-price offers are easier to budget; time-and-materials quotes can fit complex work better. Our penetration testing cost guide breaks down typical ranges by test type.
Frequently Asked Questions
What Are The Top Penetration Testing Companies In New York In 2026?
Our Top Penetration Testing Companies In New York In 2026 are Kroll, Trail of Bits, IBM X-Force Red, BreachLock, Include Security, Gotham Security (Abacus Technology), CYBRI, Virtue Security and Invadel. Each has a verified base in New York City or New York State.
Does NYDFS Require Annual Penetration Testing?
Yes. Under 23 NYCRR 500.5, covered entities must have a qualified internal or external party run penetration tests from inside and outside their system boundaries at least annually, alongside risk-based automated vulnerability scanning.
Do I Need A Local Firm For NYC Penetration Testing?
Not always. Most buyers looking at penetration testing New York vendors can work fully remotely, because application, cloud and external network tests rarely need anyone on site. A local firm helps for physical security tests, on-site internal tests, wireless assessments and when you want testers who can meet your team and auditors in person.
How Long Does A Penetration Test In New York Take?
A single web application or external network test usually takes one to two weeks of testing, plus scoping beforehand and about a week for the report. Red team engagements and multi-application programs run longer.
Conclusion
New York has a deep bench of penetration testing companies, from Kroll’s enterprise practice at One World Trade Center to focused boutiques in SoHo, NoMad and Brooklyn. Start from what you need to prove, whether that is NYDFS compliance, SOC 2 evidence or real assurance on a high-risk product, and shortlist two or three firms whose strengths match. If your scope goes beyond the city, compare these firms with our national ranking of the top penetration testing companies in 2026 and our list of top red teaming companies.
For more vendor lists, guides and buying advice, visit our penetration testing hub, and browse the New York hub for other agencies and service providers across the city.
If you want to feature your company on this list, email us or submit a form in the Top Choices section. After a thorough assessment, we’ll decide whether it’s a valuable addition.
