Somewhere in the first scoping call, the vendor will ask whether you want a black box, gray box, or white box test. Most buyers have never heard the terms before. In a gray box test, the testers get a normal login for each type of user in your product, plus some background on how the system fits together, but not your source code. They start where a real intruder with a stolen password would start: already signed in.
The choice affects what the report finds. Many of the flaws that cost companies the most, such as one customer opening another customer’s records, only show up once someone is past the login page. A test that spends its days trying to get in may never reach them. CYBRI’s guide on how a gray box test works covers the method itself.
This list compares ten US-based firms that test behind the login, and the kind of company each one suits best.
The ten companies on this list:
- CYBRI: best for SaaS and fintech teams that want manual-first testing of every user role before an audit or an enterprise deal
- Bishop Fox: best for large companies running many apps on a busy release schedule
- TrustedSec: best for mid-size and enterprise teams that want code review and gray box testing in one project
- Doyensec: best for product companies with complex web, mobile, or desktop apps
- Include Security: best for software companies ready to share their code for a deeper test
- Raxis: best for teams that want to choose black, gray, or white box test by test
- Triaxiom Security: best for mid-size companies working toward a PCI DSS deadline
- Secure Ideas: best for teams that want flexible, ongoing testing instead of one big annual project
- Atredis Partners: best for companies that ship connected devices alongside their apps
- Red Siege: best for small and mid-size companies that want to see what one stolen employee login could reach
Why Gray Box Testing Is the Default for Most Companies
Black box testing still has a job. It shows what a stranger on the internet can see and attack, and some buyers need exactly that. For most web apps, SaaS products, and APIs, though, gray box turns up more useful findings in the same number of testing days. Two reasons explain why.
Many Attackers Already Have a Password
Phishing emails, leaked password lists, and passwords reused across sites hand attackers real logins every day. Someone holding a working account doesn’t need to break down the front door. What matters then is what that account can reach once it’s inside.
Security people call that layer access control: the rules that decide which user sees which data and who can press which button. When those rules break, a regular user can reach admin-only functions, or swap an account number in the browser and pull up someone else’s invoices. Those problems live entirely behind the login, so a test that never signs in rarely finds them. CYBRI’s explainer on black box, gray box, and white box testing compares how far each one gets.
More Testing Time Goes Into Your App
Pentests are scoped in testing days. In a black box test, a good share of those days goes to reconnaissance and guessing a way in. Hand the testers working accounts and an architecture overview, and they can spend nearly all of their time on the parts of the product your customers use.
Auditors don’t object to that. SOC 2, ISO 27001, and PCI DSS don’t require a particular box type. PCI asks for a documented, industry-accepted testing method, and payment flows usually sit behind a login, so testers need accounts to reach them.
How These Companies Were Chosen
Every firm below fits a specific kind of buyer, and each had to clear the same bar first:
- Based in the United States. All ten are US companies. Some also have testers in other countries.
- Gray box testing in writing. The firm’s own materials describe testing with credentials, authenticated testing, or testing with access to source code. A vague promise to “test apps” wasn’t enough.
- People lead the testing. Tools can help map the app or network. A person does the actual attacking and decides what each finding means.
- Experienced testers. Hands-on certifications such as OSCP, or a long record of security work the buyer can look up.
- A clear fit. Each firm does something specific well, which is what its “best for” line describes.
Crowdsourced platforms and AI-first products were left out of this list. They follow a different model, and a gray box test depends on a known tester learning how your roles fit together over the whole project.
The 10 Best Gray Box Penetration Testing Companies in 2026
1. CYBRI
Best for: SaaS and fintech teams that want manual-first testing of every user role before an audit or an enterprise deal
CYBRI was founded in New York City in 2017, and gray box is its standard way of testing web apps, SaaS products, and APIs rather than an add-on. Before kickoff, the client provides a test account for each user role in scope (admin, manager, regular user, and so on) and a technical contact who can unblock the testers quickly. OSCP-certified testers then sign in as each role and try to move between them. Can a regular user change an ID in a request and read a manager’s data? Can a free account reach a paid feature by skipping a step? Automated tools help with mapping, and people do the rest by hand.
Coverage runs across web apps, APIs, mobile apps, cloud accounts, and AI features. If a critical issue turns up mid-test, the client hears about it the same day instead of waiting for the final report. Findings and fixes are tracked in Blue Box, CYBRI’s online platform, which includes team collaboration and remediation tracking.
Every finding carries a CVSS 4.0 severity score (the standard 0 to 10 scale) and reproduction steps, and reports map to SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR. Leadership gets a separate executive summary, and a sample report is public. A 90-day remediation validation window lets the testers confirm each fix and issue an updated report.
2. Bishop Fox
Best for: large companies running many apps on a busy release schedule
Vinnie Liu and Francis Brown co-founded Bishop Fox, and the Tempe, Arizona, firm has worked in offensive security for more than 20 years. Its application testing prep asks clients to set up accounts across all user roles and privilege levels before work starts, and the stated goal is to find business logic and privilege escalation flaws that are easy to overlook. Privilege escalation means a user gaining more power than their account should have.
Teams that want to go further can add a secure code review, where consultants examine the code behind the features under test. Mobile assessments come with a choice of zero, partial, or full knowledge, so the same firm can run a gray box test on one app and a code-assisted test on another. Retesting to confirm fixes is part of the deliverable. Buyers comparing similar firms can also look at CYBRI’s list of Bishop Fox alternatives.
3. TrustedSec
Best for: mid-size and enterprise teams that want code review and gray box testing in one project
TrustedSec, founded by David Kennedy in 2012 in Fairlawn, Ohio, spells out its app testing levels plainly. A black box option uses validated automated scanning. In its grey box option, “credentials are manually utilized to gain access to the inner workings of the application.” The third choice is a hybrid where source code review results feed into the gray box test, which lets testers head straight for the risky parts of the app.
The same team tests APIs, building attack scenarios around the endpoints the client provides, along with iOS and Android apps and the services they connect to. Its pentest process ends with validation testing: once issues are fixed, the team retests to confirm they’re closed. TrustedSec is CREST certified (CREST is an independent body that vets pentest firms), and its testing supports PCI DSS, HIPAA, and SOC 2 requirements.
4. Doyensec
Best for: product companies with complex web, mobile, or desktop apps
John Villamil and Luca Carettoni started Doyensec in 2017, and the two founders remain its only owners. The company is headquartered in San Francisco, with a second office in Europe. Its testers combine manual source code auditing with dynamic testing, meaning they work on the running app and read the code behind it in the same project.
The firm takes on technology that calls for specialist skills: GraphQL APIs, desktop apps built on Electron, smart contracts, LLM features, and IoT devices, along with standard web, mobile, and cloud work. Doyensec describes itself as an offensive security firm that works with a defender’s frame of reference, and it treats finding bugs as the first step in the job rather than the end of it.
5. Include Security
Best for: software companies ready to share their code for a deeper test
Erik Cabetas founded Include Security, and the firm has worked out of Brooklyn, New York, for more than 15 years. Its specialty is source-assisted testing: testers work through the running app as in any gray box test, with the code available to check what they find. That moves the work partway toward white box testing, and the firm presents it as a cost-effective way to reach deeper flaws.
Each assessment is scoped to the codebase’s size, language, and attack surface instead of a fixed package, and every tester has at least five years of application hacking experience. A technical project manager runs point for the client. Reports go through quality review before delivery, usually within a week after testing ends, and the team walks the client through the findings.
6. Raxis
Best for: teams that want to choose black, gray, or white box test by test
Raxis, based in Atlanta, has done manual penetration testing since 2011, and it puts the choice in the buyer’s hands: “You choose how much the attacker knows going in.” Its grey box option starts with partial information, typically user credentials or limited architecture details, to mimic a compromised account or an insider. Black box starts from zero, and white box adds documentation and source code. All three are run by hand.
That flexibility helps when one company has very different systems. A public marketing site might get a black box test, while the customer portal gets gray box and a payments service gets white box. Every engagement includes a retest of the fixes. Teams that ship constantly can also choose Raxis Attack, a penetration testing as a service option for launching tests on demand and retesting fixes year-round.
7. Triaxiom Security
Best for: mid-size companies working toward a PCI DSS deadline
Triaxiom Security is based in Charlotte, North Carolina, and operates as a division of Strata Information Group. Its web app tests cover both the public pages and everything behind the login, combining manual and automated testing. Testers look for logic flaws and authorization bypasses, check whether a lower-privileged role can gain more permissions, and test login and session handling. The number of user roles shapes how the project is scoped.
The firm lists CREST accreditation and works with clients preparing for PCI DSS assessments. That suits companies that want their pentest handled by people who know the standard. Clients get a one-time retest of fixed findings within 90 days of the report, followed by updated reports.
8. Secure Ideas
Best for: teams that want flexible, ongoing testing instead of one big annual project
Secure Ideas has its main office in Jacksonville, Florida, and has done penetration testing for well over a decade under the tagline “Professionally Evil.” Its own guidance describes gray box as the most common type of third-party pentest, with testers given valid user accounts instead of spending time tricking employees into handing them over.
Its main offering, Professionally Evil Testing as a Service (PETaaS), works on prepaid testing days. A team can spend them on a gray box web app test this quarter and a network test next quarter without starting a new contract each time. Secure Ideas is CREST accredited and also runs security training, including a CISSP mentorship program.
9. Atredis Partners
Best for: companies that ship connected devices alongside their apps
Shawn Moyer, Nathan Keltner, and Josh Thomas founded Atredis Partners in 2013. The firm is owned by the people who work there, and its staff are spread across the US and Canada. Application work is source-assisted, covering web apps, APIs, mobile clients, and the attack paths between them. The team also tests AI and LLM systems, cloud and Kubernetes setups, and the pipelines that ship code to production.
Hardware is where it stands out. Atredis reverse-engineers device firmware and hardware, so a company selling a smart device, its companion app, and the cloud behind them can have one team test the whole chain. It also offers advisory work such as virtual CISO support and incident readiness.
10. Red Siege
Best for: small and mid-size companies that want to see what one stolen employee login could reach
Gray box isn’t only for apps. Red Siege, founded and led by CEO Tim Medin, offers an Assumed Breach Assessment. The test starts as if an attacker already has one employee’s access, then measures how far that foothold spreads across the internal network. A cloud version covers Microsoft 365 and AWS.
For a lean IT team, the result answers a practical question: if one person on staff falls for a phishing email tomorrow, what does the attacker get? Red Siege also runs web app tests, red team work, and purple team sessions where testers and the client’s defenders work side by side. A sample report is available on its website.
How to Choose a Gray Box Pentest Partner
Two firms can both say “gray box” and mean quite different projects. Use these points to compare the shortlist, and see CYBRI’s roundup of web application testing companies if you need a wider field.
| Criteria | What to look for |
| Access requested | A clear list before kickoff: one test account per user role, API documentation, and a short architecture overview. |
| Role coverage | How many roles are in scope, and whether testers try to cross from each role into the others (user to admin, one customer to another, one tenant to another). |
| Source code option | Whether the firm can add code review if you’re willing to share it, and how that changes the timeline. |
| Test environment | A staging environment that mirrors production, with realistic data, so testers can push hard without affecting customers. |
| Who tests | Named, senior testers with hands-on certifications such as OSCP, ideally the same people for your next test. |
| Communication | A direct line to the testers and a same-day heads-up on anything critical. |
| Retesting | Whether a retest is included, how long the window stays open, and whether you get an updated report afterward. The guide to retesting explains how it usually works. |
| Reporting | Executive summary, CVSS severity scores, reproduction steps, and mapping to SOC 2, ISO 27001, PCI DSS, or HIPAA. Ask to see a sample, and compare it with this checklist of what a pentest report should contain. |
Final Thoughts
Each of these ten firms tests behind the login, and the right pick depends on what you run and how much you want to share. For SaaS and fintech companies that want OSCP-certified testers working through every role by hand, a report an auditor will accept, and fixes checked within 90 days, CYBRI is a strong fit. Scoping takes one short call, so contact CYBRI with a list of your apps and user roles.
Frequently Asked Questions
What do I need to give testers before a gray box test?
Plan on one working test account for each user role in scope, ideally two for any role where customers shouldn’t see each other’s data, so testers can try to cross between them. API documentation or a Postman collection helps, as does a short diagram of how the app, database, and outside services connect. Name one technical contact who can reset accounts or unblock access quickly. Accounts that don’t work on day one are the most common cause of delays.
Is a gray box test enough for SOC 2 or PCI DSS?
Usually, yes. Neither framework requires a specific box type. SOC 2 auditors look for evidence that a qualified third party tested your systems and that you fixed what they found. PCI DSS requires a documented, industry-accepted method that covers both internal and external systems, and a gray box test meets that when the scope is right. Confirm the scope with your auditor or QSA before testing starts.
Should gray box replace black box testing entirely?
Not always. A black box test still shows what an outsider can see and attack with no help, which matters for public-facing systems and some customer requirements. Many companies run gray box as their main yearly test and add a short black box check of the external perimeter, or alternate the two.
Ready for a Gray Box Pentest?
CYBRI runs gray box tests of web apps, APIs, mobile apps, cloud accounts, and AI features, with each user role in scope. OSCP-certified testers sign in as every role, critical findings are reported the same day, fixes are tracked in Blue Box, and each fix is retested within 90 days with an updated report. Get a quote to scope a test for your app.
