Bugcrowd

Active, privately held. Bugcrowd announced it acquired Mayhem Security to add AI-driven offensive testing.

Sources 1, 2, 3, 4 · checked 2026-11-08

• AI penetration testing for LLM applications by a crowdsourced team of vetted human testers matched with CrowdMatch
• Methodology checks the OWASP Top 10 for LLMs, including prompt injection, excessive agency, and training data poisoning
• Crowd-powered AI red teaming, AI bias assessments, bug bounty, and vulnerability disclosure programs
• Real-time dashboard of findings; detailed reports and retesting in higher tiers

Sources 1, 2, 3, 4 · checked 2026-11-08

• Teams that want time-boxed human testing of an LLM application with a report
• Programs that want an ongoing bug bounty that includes AI flaws

Sources 1, 2, 3, 4 · checked 2026-11-08

Contact vendor (AI pen test tiers Basic, Standard, Plus, and Max are listed without prices)

Sources 1, 2, 3, 4 · checked 2026-11-08

• FedRAMP Moderate
• CREST
• SOC 2 Type 2
• SOC 3
• ISO/IEC 27001:2022
• ISO/IEC 27018:2019
• CSA STAR Level 1
• Cyber Essentials Plus
• NIST 800-53 Rev. 5

Listed as stated by the vendor. Scope can differ by product or subsidiary; request current reports.

Sources 1, 2, 3, 4 · checked 2026-11-08

• No public pricing
• Retesting is listed only in the Plus tier of AI pen testing
• The AI pen test page does not name MITRE ATLAS or agents as a tested target; confirm agent and tool-use scope
• Certifications cover Bugcrowd's platform; confirm they apply to your engagement

Sources 1, 2, 3, 4 · checked 2026-11-08