During scoping, every pentest vendor asks how much the testers should know going in. In a white box test, the answer is nearly everything: source code, architecture diagrams, documentation, and a working login for each user role. The testers attack the running system the way an outsider would, and they read the code behind it to find what an outsider would take weeks to stumble on, or never find at all.
Sharing code with an outside firm can feel like a big step. For a product that handles payments, health data, or anything a customer would sue over, it’s often the fastest way to the flaws that matter. CYBRI’s explainer on white box penetration testing covers the method in more depth.
This list compares ten US-based firms that test with source code in hand, and the kind of company each one suits best.
The ten companies on this list:
- CYBRI: best for SaaS companies that want manual-first testing with source code and full documentation before an audit or an enterprise deal
- Trail of Bits: best for engineering-heavy teams that want an in-depth code audit plus tooling they can keep using
- Include Security: best for software companies that want source-assisted testing sized to their budget
- Doyensec: best for large companies that want code review and penetration testing from one provider
- Bishop Fox: best for large companies that want code review and penetration testing from one provider
- IOActive: best for companies whose software runs on devices, from embedded systems to chips
- Atredis Partners: best for teams that want source-assisted testing across apps, APIs, and the hardware behind them
- TrustedSec: best for mid-size and enterprise teams that want code review results to steer the hands-on test
- Raxis: best for companies that want to pick white, gray, or black box system by system
- Leviathan Security Group: best for companies that want secure code review alongside broader risk and compliance advice
When White Box Testing Is Worth It
A white box test takes more preparation than other types, and it isn’t the right pick for every system. Two situations make it worth the effort.
When the Worst Flaws Hide in the Code
Some problems barely show from the outside. A hardcoded key, a permission check that runs on one code path but not another, an old admin endpoint nobody links to anymore, or a weak piece of encryption can all sit quietly behind a working app. A tester without the code has to guess they exist. With the code open, they can trace exactly where user input travels and where the checks are missing, then prove the issue against the live app.
That makes white box the natural fit for code that carries high stakes: payment flows, authentication, multi-tenant data separation, and anything a regulator will ask about. CYBRI’s comparison of black box, gray box, and white box testing shows how far each one gets.
When Testing Days Need to Count
Pentests are priced in testing days. In a black box test, a large share of those days goes to reconnaissance. A gray box test cuts that time by handing over logins. White box goes a step further, so nearly all of the time lands on finding and confirming real flaws. Findings also come back with the exact file and line to fix, which shortens the remediation work for your engineers.
Enterprise customers have started asking for it too. Some vendor security questionnaires now ask whether your app has had a white box or source-assisted test. Frameworks such as SOC 2, ISO 27001, and PCI DSS don’t require a specific box type, but a white box report gives an auditor clear evidence of depth.
How These Companies Were Chosen
Each firm had to clear the same bar before its “best for” line was written:
- Based in the United States. All ten companies are US-based. Some also have staff or offices abroad.
- Code access in writing. The firm’s own pages describe source code review, source-assisted testing, or white box testing with code access.
- People lead the testing. Static analysis tools can point testers at risky code. A person confirms each issue and decides what it means.
- Experienced testers. Hands-on certifications such as OSCP, or a long public record of code auditing and security work.
- A clear fit. Each firm does something specific well, which is what its “best for” line describes.
Crowdsourced platforms and AI-first products were left out. Sharing source code works best with a known team under a clear confidentiality agreement.
The 10 Best White Box Penetration Testing Companies in 2026
1. CYBRI
Best for: SaaS companies that want manual-first testing with source code and full documentation before an audit or an enterprise deal
CYBRI is a New York penetration testing company founded in 2017, and its testing is manual-first, with automated tools in a supporting role. For a white box penetration test, the access list is agreed before work starts and can include source code repositories, architecture and network diagrams, configuration files, API documentation and tokens, cloud test accounts, and a test account for each user role. OSCP-certified testers (OSCP is a hands-on certification earned by breaking into live systems) then use that knowledge to go after the parts of the system that matter most.
Scope can cover web apps, APIs, iOS and Android apps, internal and external networks, cloud environments, source code, and AI features. Testing follows OWASP ASVS (a detailed checklist of application security requirements) and the OWASP Top 10, with code review guided by OWASP’s Code Review Guide. Testers chain weaknesses into real-world attack paths and stay inside the approved scope, with no destructive actions.
Every finding carries a CVSS 4.0 severity score, the affected asset, technical evidence, reproduction steps, business impact, and a fix. Leadership gets a separate executive summary, and reports map to SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR. Critical issues are reported during the engagement, and remediation testing within the 90-day window confirms each fix.
2. Trail of Bits
Best for: engineering-heavy teams that want an in-depth code audit plus tooling they can keep using
Trail of Bits has worked out of New York since 2012, and code review sits at the center of its application security work. Its comprehensive code assessments use a hybrid of manual review, static analysis, and dynamic testing such as fuzzing, and they can cover application code, infrastructure as code, container configurations, and build pipelines together.
What sets it apart is what the client keeps afterward. Along with a findings report that rates severity, difficulty, and an exploit scenario for every issue, engagements include static analysis rules tuned to the client’s own code and fuzzing setups the engineering team can run on every release. The team reads out findings in person and retests patches as they land.
3. Include Security
Best for: software companies that want source-assisted testing sized to their budget
Include Security is headquartered in Brooklyn and serves clients in New York, San Francisco, and beyond. Its specialty is cost-effective, source-assisted security assessments: testers work through the running app and use the code to confirm and extend what they find. Each project is sized to the codebase’s size, language, attack surface, and the level of assurance the client needs, instead of a fixed package.
Every team member has at least five years of application hacking experience, and assessments are staffed by expertise rather than availability. The technical report lists findings by risk with reproduction steps and recommended fixes, usually about a week after testing ends, and the team walks the client through the results.
4. Doyensec
Best for: product companies built on specialist technology such as GraphQL, Electron, or LLM features
Doyensec has a US office in San Francisco and a second office in Europe, and its work combines manual source code auditing with dynamic testing on large codebases. The firm says it can audit virtually any type of platform and code base, and its service areas show the range: web apps and APIs, mobile, desktop and server software, GraphQL, Electron apps, cloud, smart contracts, large language models, and IoT devices.
That breadth matters for products that don’t fit a standard web app template. A team shipping an Electron desktop app or a GraphQL API can get testers who already know where those technologies tend to break. Doyensec describes finding bugs as only the first step in its process.
5. Bishop Fox
Best for: large companies that want code review and penetration testing from one provider
Bishop Fox is based in Tempe, Arizona, and has worked in offensive security for more than 20 years. Its secure code review combines scanning technology with expert analysis. The process starts by inventorying the open-source components in the code, runs static analysis across the company’s own code, then moves to manual review and reporting with fix guidance.
For a large company, the benefit is that code review and penetration testing can run as one program. The same provider can review the code behind a new feature and then attack the running app, with findings from both feeding one set of priorities. Its application testing prep asks for accounts across every user role and privilege level, which pairs naturally with a code-assisted engagement.
6. IOActive
Best for: companies whose software runs on devices, from embedded systems to chips
IOActive has been independent since 1998 and runs hacking labs in Seattle, the UK, and Spain. Its consultants bring decades of code auditing experience across a wide range of languages, and its review methods include instrumented fuzzing, entry-point analysis, risk-based reviews, and full-coverage reviews of an entire codebase.
The firm stands out for work below the software layer. Its embedded and silicon labs test devices with techniques such as side-channel analysis and fault injection, so a company shipping hardware, firmware, and the apps around them can have one team review the code and attack the device. Its penetration testing also covers mobile apps, web services, and cloud environments.
7. Atredis Partners
Best for: teams that want source-assisted testing across apps, APIs, and the hardware behind them
Atredis Partners is a worker-owned security firm, and the people who deliver the work also write the proposals. Its application security work is source-assisted, covering web apps, APIs, mobile clients, and the attack paths that connect them. Testers use the code to see how each component talks to the next, which is where many serious flaws live.
The firm also reverse-engineers hardware and firmware for embedded, mobile, automotive, and critical infrastructure systems. A company selling a connected product and its companion app can have both sides tested by the same team, with the code in hand for each.
8. TrustedSec
Best for: mid-size and enterprise teams that want code review results to steer the hands-on test
TrustedSec was founded by David Kennedy in 2012 and is based in Fairlawn, Ohio. Its software security testing comes in three levels, and the deepest is a hybrid: a source code review runs first, and its results feed into a gray box test of the running app. Testers can head straight for the risky parts of the code instead of discovering them one request at a time.
The same team tests APIs, iOS and Android apps, and the services behind them. Its pentest process ends with validation testing to confirm fixes are closed, and the testing supports PCI DSS, HIPAA, and SOC 2 requirements.
9. Raxis
Best for: companies that want to pick white, gray, or black box system by system
Raxis, based in Atlanta, has run manual penetration tests since 2011, and it lets the buyer decide how much the attacker knows going in. Its white box option offers full transparency: complete documentation, credentials, and source code access for the most thorough assessment possible. Gray box starts with partial information, and black box with none. All three are run by hand.
That menu helps when one company has very different systems. A public marketing site might get a black box test, the customer portal a gray box test, and the payments service a white box test with code access. Every engagement includes a retest of the fixes.
10. Leviathan Security Group
Best for: companies that want secure code review alongside broader risk and compliance advice
Leviathan Security Group was founded in 2006 in the Seattle area and became part of New York-based K2 Integrity in March 2026. Its application security work pairs penetration testing with secure code reviews and DevSecOps advice, and the firm also offers network testing, red team work, and hardware security assessments.
K2 Integrity is a risk and compliance advisory firm, so Leviathan now sits inside a group that also handles investigations and compliance work. For a company where a code review is one piece of a bigger risk program, that can keep technical findings and compliance follow-up with one partner.
How to Choose a White Box Pentest Partner
Two firms can both say “white box” and run very different projects. Use these points to compare the shortlist:
| Criteria | What to look for |
| Access requested | A clear list before kickoff: repository access, architecture diagrams, API documentation, and a test account per user role. |
| Code handling | How the firm stores your code, who can see it, and when it’s deleted after the project. Get this in the contract. |
| Code review and live testing | Whether testers both read the code and attack the running app, and whether one informs the other. A code scan alone isn’t a penetration test. |
| Languages and frameworks | Hands-on experience with your stack, from the backend language to the mobile and front-end frameworks. |
| Who tests | Named, senior testers with hands-on certifications such as OSCP. |
| Retesting | Whether a retest is included and whether you get an updated report afterward. CYBRI’s guide to retesting explains the usual process. |
| Reporting | Findings that point to the file and line to fix, severity scores, and mapping to SOC 2, ISO 27001, or PCI DSS. Ask for a sample and compare it with this checklist of what a pentest report should contain. |
Final Thoughts
Each of these ten firms tests with the code in hand, and the right pick depends on what you build, which technologies you run, and how much of your wider security program you want one partner to cover. For SaaS companies that want OSCP-certified testers working manual-first with full access to code and documentation, and a report an auditor will accept, CYBRI is a strong fit. A short call is enough to agree on what testers need, so contact CYBRI with a list of your apps and repositories.
Frequently Asked Questions
Is it safe to share source code with a pentest firm?
It can be, with the right controls. Sign an NDA and a contract that spells out where the code will be stored, who can access it, and when it will be deleted. Many firms prefer read-only access to a specific repository or a time-limited copy instead of broad access to your code platform. Ask each vendor to describe its handling process before you share anything.
How is a white box pentest different from a code scan?
A code scan runs automated rules across the code and lists possible issues, many of which turn out to be harmless. A white box penetration test uses the code as a map, then attacks the running app to confirm which issues an attacker could use and how far each one reaches. The report shows real, proven risk rather than a list of warnings.
Do I need white box testing for every system?
No. White box earns its cost on high-stakes code such as payments, authentication, and multi-tenant data separation. Many companies run gray box tests on most of their product and add white box testing to the most sensitive services, or to a major new feature before launch.
Ready for a White Box Pentest?
CYBRI runs white box tests of web apps, APIs, mobile apps, networks, cloud environments, and AI features, manual-first, with OSCP-certified testers leading every project. Findings carry CVSS 4.0 scores and evidence, reports map to SOC 2, ISO 27001, PCI DSS, HIPAA, and GDPR, and fixes are retested within 90 days. Get a quote to scope a test for your code.
