Directory
AI and LLM penetration testing companies
Penetration testing companies whose own websites list AI or LLM testing. Each line below is our short label for what the firm lists, with a link to the site page it comes from.
How this list is compiled
A firm is here only if its own website lists AI or LLM testing, and we saved the page text on the date shown. That is all this list claims: it does not rate the work, and it is not an accreditation. Any CREST badge on a card below is the firm’s CREST penetration testing accreditation, not one of CREST’s two AI accreditations. For what a test covers, read AI and LLM penetration testing.
Accreditations are reported from public sources, with the source linked on each listing.
| Firm | Serves | What its site lists | Read on |
|---|---|---|---|
| Cognisys Group Ltd | UK | AI and LLM penetration testing ↗ | 2026-11-06 |
| Kulkan Security | US | AI implementations and LLM integrations testing ↗ | 2026-11-06 |
| ONSecurity Technology Limited | UK | LLM and AI application testing (red team LLM and AI pentesting) ↗ | 2026-11-06 |
| Schellman | US | AI red teaming of generative AI systems ↗ | 2026-11-06 |
| Secarma Ltd | UK | AI Integration, AI Agent, AI Chatbot and LLM Application security testing ↗ | 2026-11-06 |
5 companies
UK cyber security firm offering CREST-accredited penetration testing including web and mobile application testing.
UK provider delivering CREST-accredited penetration testing through a subscription-based online platform.
UK cyber security consultancy offering CREST-accredited penetration testing and vulnerability assessment.
Frequently asked questions
- Does being on this list mean a firm is accredited to test AI?
- No. This list is firms that say, on their own website, that they test AI or LLM systems. CREST runs a separate Security Testing of AI accreditation, launched in August 2026. We do not show it here; ask the firm, and confirm with CREST.
- How do I compare two firms on AI testing?
- Ask each for the same things: what it tests (the app, prompts, retrieval, tools), how it reports impact, a sample report with the client removed, and who does the work. The page on what to send for an AI test gives you a scope to send both.