Home / Blog / Penetration testing cost
Buyer guides
Penetration testing cost in 2026: what drives it and how to compare quotes
Penetration testing cost follows effort, not a rate card. Here is what moves a quote up or down, the pricing models you will be offered, and a way to compare quotes that holds up.
Cyberlop Labs · Updated · 12 min read
Penetration testing cost is the price of skilled people finding and proving vulnerabilities in your software, set by effort in resource days. Scope, application and API count, account types, test type (black, grey or white box), reporting and retests drive it. Compare quotes by days, scope and retest terms.
- Penetration testing cost follows effort in resource days, so ask every provider for a day breakdown.
- Scope, account types and test type move the quote more than anything else.
- Pricing models differ in who carries the risk of scope growth; read the terms, not the total.
- Compare quotes in one shape: scope, days, methodology, sample report and retest rules.
- Compliance sets minimum scope and frequency, so confirm needs with your auditor first.
- Cutting depth to save money can remove the access control checks most likely to find something.
Penetration testing cost is the total price of having a qualified team find and prove vulnerabilities in your software, and it is set mainly by how much work the test involves, not by a standard rate card. Scope (apps, APIs, roles), depth, the test type, reporting needs and retests decide the effort. Below you will see how each driver works and how to compare quotes. No prices appear here, because any fixed number would be wrong for your system.
What decides penetration testing cost?
Effort decides cost. A penetration test is skilled people spending days on your application, so the quote is a count of days multiplied by a rate, plus reporting and project time. The UK National Cyber Security Centre says test effort is usually expressed in "resource days". Its scoping advice asks for a written document that sets technical boundaries, test types, timeframe, staffing and compliance needs.
That is the useful way to read every quote you receive. Ask what the days are spent on. If a provider cannot tell you, you are comparing labels, not work. The pentest cost entry in our glossary gives the short definition; the rest of this page is the working method.
The main cost drivers at a glance
| Driver | What it changes | Question to ask yourself |
|---|---|---|
| Number of applications and APIs | Each one needs its own mapping, testing and write-up | Which apps hold customer data or money? |
| Size of each application | Pages, endpoints, features and user journeys to cover | How many distinct features and endpoints exist? |
| Account types and permissions | Each role and tenant adds paths to check for cross-account access | How many kinds of signed-in account do we have? |
| Test type: black, grey or white box | How much the tester knows and can read before starting | Do we want an outsider view, a user view, or code-level depth? |
| Business logic depth | Manual reasoning about prices, limits and workflows takes time | Where does a wrong rule lose us money? |
| Environment and access | Staging that mirrors production, test data, VPN, allow-listing | Is the target stable and ready on day one? |
| Reporting and evidence | Auditor-ready reports, executive summary, attestation letter | Who will read the report and what must it prove? |
| Retesting | Checking that fixes actually close the issue | Is a retest included, and how many rounds? |
| Timing | Short notice and fixed windows reduce flexibility | Is there a hard audit or launch date? |
The cost drivers, one by one
Scope: how many applications, APIs and environments
Scope is the largest driver and the easiest to control. A single web app with one API is a smaller job than a customer portal, an admin console, a mobile back end and three partner integrations. Good pentest scoping lists every host, application and API in plain words, and says what is out of bounds.
Count APIs separately from the web front end. Many applications expose far more through their API than the screen shows, and an API pentest has its own test cases. If you cannot name your APIs, build an inventory first. It reduces both cost and risk. The web application penetration testing guide shows how scope turns into phases.
Accounts, roles and tenants
Whether one account can reach another account's data is usually where the serious findings live, and it takes the most manual effort. Two roles need a short comparison. Six roles across three tenant types need many more checks. That is authenticated testing, and it is why the number of account types shows up in quotes.
The stakes are real. Broken access control is the first item in the OWASP Top 10 for 2025, and OWASP found some form of it in 100% of the applications it tested. Skipping authenticated depth to save days can remove the part of the test most likely to find something. See broken access control and IDOR.
Black, grey or white box
The amount of knowledge handed to the tester changes how days are spent. Black-box testing starts with nothing and spends time discovering. Grey-box testing starts with accounts and documentation, so more days go on depth. White-box testing adds source code, so a finding can name the file and line. None is cheaper in every case; each buys a different kind of coverage. Our black-box, grey-box and white-box comparison covers the trade-off.
Business logic and custom workflows
A scanner can find a missing header. It cannot know that a coupon should apply once. Business-logic flaws need a person, or a tool that reasons about your rules, to try combinations and judge the result. Checkout, refunds, credits, approvals and multi-step onboarding all add reasoning time, and that is the right place for your budget to go.
Environment readiness
Unready environments waste paid days. A staging site that is down, missing seed data, behind an unexpected allow-list, or different from production produces idle time and weaker results. Agree rules of engagement, test accounts, rate limits and a named contact before day one.
Reporting, evidence and retesting
A report for your own engineers differs from one an auditor, customer or regulator will read. Extra layers (executive summary, mapping to a framework, attestation letter) take time. Retesting, which means confirming a fix with the original proof, is where many quotes differ silently. Some include one round, some charge per round, some exclude it. See retest and closed-loop retest.
How are penetration tests priced?
Providers use five main models: time and materials, fixed price per scope, subscription or pentest as a service, retainers with a pool of days, and results-based programmes such as a bug bounty. The model decides who carries the risk of scope growth, so it matters more than the headline figure.
Pricing models compared
| Model | How you are billed | Works well when | Watch out for |
|---|---|---|---|
| Time and materials | Resource days actually worked | Scope is unclear and may change | No ceiling unless you set one |
| Fixed price per scope | One agreed amount for a written scope | Scope is stable and well defined | Out-of-scope extras and capped depth |
| Subscription / PTaaS | Recurring fee for ongoing or repeated testing | Releases are frequent and you need retests | Whether a human reviews findings; what the platform actually covers |
| Retainer or day pool | Prepaid days used over a period | You test several apps through the year | Unused days expiring; vague allocation |
| Bug bounty | Rewards for accepted reports | You want broad outside eyes on a mature app | No guaranteed coverage or audit evidence |
| Automated or AI-assisted | Per app, per scan or per seat | You need frequent, repeatable coverage | Proof of exploitation, false positives, business logic depth |
No model is the correct one. A fixed price suits a clean, bounded scope such as a release before launch. A subscription suits teams that ship weekly. Many companies mix both: a yearly manual test for depth and an ongoing programme for the time in between. The continuous penetration testing guide explains that mix, and continuous pentesting has the definition.
Manual, automated and hybrid testing
Manual pentesting
Manual pentesting is priced on skilled hours. It is strongest on logic, chained issues and judgement. Its limit is that it is a snapshot, so what it found is true on the days it ran.
Automated pentesting
Automated pentesting and DAST are priced to repeat. They are good at breadth and regression, and weaker at deeper logic unless built to reason about it. Judge a tool by what it proves, not by how many items it lists. Our honest-limits page states what Cyberlop does and does not do.
How the effort adds up
A quote is built the same way across vendors, even if the labels differ. The figure below shows the sequence. Cost grows at each step, and each step is a place to ask a question.
Why do penetration testing quotes differ so much?
Quotes differ because the work behind them differs, even when the title is the same. One firm may run automated tools for a day and write them up. Another may spend a week reasoning about your account types and workflows. Both are sold as "a web application pentest".
Four things hide inside a low quote: fewer days, a junior-heavy team, scanner output pasted into a report, and a retest that is not included. Four things justify a high one: authenticated depth, code-aware testing, manual logic work and evidence you can hand to an auditor. Neither a low nor a high figure tells you which you are buying.
How to compare penetration testing quotes
Put every quote into the same shape before you read the totals. Ask each provider to fill in the table below in writing.
Quote comparison checklist
| Question | What a good answer looks like |
|---|---|
| How many resource days, and for which tasks? | A breakdown: discovery, testing, reporting, retest, project management |
| What exactly is in scope? | Named hosts, apps, APIs, account types and environments |
| Which test type is it? | Black, grey or white box stated, with what you must supply |
| How many account types will be tested? | A number, and cross-account checks named as a task |
| Who does the work? | Named roles and experience, not only a logo |
| What methodology is followed? | A recognised one, such as the OWASP Web Security Testing Guide or NIST SP 800-115 |
| Is a retest included? | Stated rounds and window, using the original proof |
| What does a finding contain? | Request, response, steps to reproduce, severity, fix advice |
| Will we see a sample report? | Yes, redacted, before you sign |
| What happens if scope grows? | A written change process with a day rate or a stated cap |
| How is your data handled? | Storage, retention, deletion, and where it is processed |
| Does the report meet our audit need? | Mapping to the framework you must satisfy |
Judge the sample report hard. The penetration test report reading guide and the post on how to choose a penetration testing company go deeper, and choosing a pentest provider gives the short version.
Red flags in a quote
- No days, no breakdown, only a total.
- "Unlimited retests" with no window or conditions.
- A methodology that is not named.
- Scope described as "your website" with no list of apps or APIs.
- A report promised before testing starts, with a fixed page count.
- No mention of how findings are proven, only how many will be found.
Why the cheapest quote can cost the most
The cost you really care about is the cost of a missed flaw. If a thin test returns a clean report and a customer finds the hole later, you pay for the incident, the rework and the lost trust, plus a second test. A cheap test that is honest about its limits is fine. A cheap test sold as full coverage is the expensive one.
What does it cost to skip penetration testing?
Skipping testing leaves the most common way in untested. The Verizon 2026 Data Breach Investigations Report summary reports that 31% of breaches now start with a software vulnerability, ahead of stolen passwords, and that 48% of all breaches now involve ransomware. The CISA Known Exploited Vulnerabilities catalog listed 1,734 entries when we read it on 7 October 2026, each one a flaw already used in real attacks.
Your own code is a different matter from third-party components, and a scan of dependencies will not find a missing ownership check in your custom endpoint. That is the gap a pentest fills. In the OWASP 2025 data the top category covers 40 mapped CWEs and 1,839,701 occurrences, which is why access control testing deserves budget.
How does compliance change penetration testing cost?
Compliance changes cost by fixing the minimum scope, the frequency and the paperwork. It does not usually raise the price of the testing itself; it raises the cost of doing it more often, on more systems, with a report an auditor accepts.
Frameworks and what they mean for a pentest budget
| Framework | What it asks for | Cost effect |
|---|---|---|
| PCI DSS v4.0.1, requirement 11.4 | Defined penetration testing methodology; internal and external tests at least annually and after significant changes; segmentation checks where used; fixes retested | Annual cycle, network scope and mandatory retest rounds |
| SOC 2 | No named pentest rule in the criteria; auditors look for evidence that vulnerabilities are identified and managed, and a pentest is the usual evidence | Report quality and retest evidence matter more than extra days |
| ISO/IEC 27001:2022 | Annex A controls on management of technical vulnerabilities (8.8) and security testing in development and acceptance (8.29) | Testing tied to release and change management |
| CERT-In and DPDP (India) | CERT-In empanels security auditors and issued 2022 directions on incident reporting; the DPDP Act 2023 requires reasonable security safeguards | May require an empanelled auditor or a documented safeguard programme |
Check the exact wording with your auditor before you scope. The PCI Security Standards Council document library holds the standard and its penetration testing guidance, and ISO/IEC 27001 is the control source for Annex A. Related terms: PCI DSS 11.4, SOC 2, ISO 27001, the DPDP Act and CERT-In directions.
One test, several frameworks
If you need PCI, SOC 2 and a customer questionnaire in the same year, run one properly scoped test and ask for a report that maps findings to each. Three separate engagements triple the fixed cost for no extra coverage. The VAPT guide explains how vulnerability assessment and penetration testing fit together.
How can you lower penetration testing cost without lowering coverage?
Lower cost by removing waste, not depth. Waste is idle days, unclear scope, retests that repeat work and findings that arrive too late to fix cheaply. Most of it is in your hands before the tester starts.
- Inventory first. List every app, API and environment, and drop retired ones from scope.
- Rank by risk. Test what holds customer data, payments or admin power first.
- Prepare accounts. Give the tester working accounts for each role and tenant type, with seed data.
- Stabilise staging. A target that mirrors production and stays up saves paid days.
- Fix the obvious. Clear known scanner findings before the test, so the days go on harder problems.
- Agree retest terms in the quote. Confirm rounds, window and method.
- Test after big changes. New auth, payment flows and multi-tenant work deserve a focused test, not a full yearly one.
- Reuse the evidence. One report, mapped to each audit, beats three.
The VAPT checklist turns these into a before, during and after list. Also keep remediation SLAs so findings get closed quickly; a finding that sits open for months wastes the test.
How do continuous and AI-assisted tests change the cost picture?
They shift cost from large yearly events to smaller recurring ones, and they make retesting a routine step instead of a separate engagement. The trade is depth: repeatable testing is good at regression and breadth, while a person is still needed for unusual logic and judgement. Combine them rather than choose one.
Cyberlop is built for that recurring part. It finds vulnerabilities in web apps and their APIs with black-box, grey-box and white-box pentesting. In white-box mode it reads your code while testing the running app, so a finding can point to the file and line. It reports only what it actually exploited, each finding carries the request, the response, a screenshot where a person can see it and the line of code, and a fix is proven by re-running the exact exploit against the new code. It can run on a schedule or in CI/CD and gate a build, and private scanning keeps your code inside your network. See how it works, the evidence.
For agencies and MSSPs
If you resell testing, cost is margin. Agencies and MSSPs can run Cyberlop under their own brand, so findings and retests reach the client in your format. See Cyberlop for agencies, MSSP and white-label pentesting.
How do you budget for penetration testing?
Budget for a programme, not a purchase. A sound plan has three lines: a depth test on high-risk applications, a lighter recurring check between releases, and reserved time for retests and fixes. Engineering time to fix findings is usually the part teams forget.
A simple yearly budget outline
| Line | Purpose | How to size it |
|---|---|---|
| Depth test | Manual or hybrid test of the critical applications | Resource days from a written scope |
| Recurring checks | Regression and new-release coverage | Number of releases and applications |
| Retests | Proof that fixes closed the issue | Expected findings by severity |
| Fix capacity | Engineering time to remediate | Past fix times for similar issues |
| Audit evidence | Reports mapped to frameworks | Number of frameworks and customers asking |
Give every supplier the same inputs, so that totals are comparable.
The short version
Penetration testing cost follows effort, and effort follows scope, account types, test type, logic depth, environment, reporting and retests. Ask for days, scope and retest terms in writing, compare quotes in one shape, and spend the money where cross-account access and business rules are at stake. Then close the loop: a fix is only done when the exploit no longer works. Related: pentest report and OWASP Top 10.
Questions people ask
Penetration testing cost: FAQs
How much does a penetration test cost?
It depends on scope, test type, account types, reporting needs and retests, so no single figure fits. Quotes are built from resource days, as the NCSC notes, so ask each provider for a day breakdown and compare those.
What is the biggest factor in penetration testing cost?
Scope. The number of applications, APIs, environments and account types sets how many days the work takes. Tight scoping on the systems that hold customer data and money is the best way to control cost without losing coverage.
Why are penetration tests expensive?
They are skilled, manual work: mapping the app, reasoning about business rules, proving each finding and writing it up so engineers can fix it. A cheap test is usually fewer days or more automation, which suits some jobs and not others.
Is a penetration test worth it?
Yes, when it covers the code and logic you wrote yourself. Verizon's 2026 summary says 31% of breaches now start with a software vulnerability, and a test finds those in your own application before someone else does.
Is continuous penetration testing cheaper than a yearly test?
Not always cheaper, but spread differently. A yearly test is one large event; continuous testing is smaller and recurring, and makes retesting routine. Many teams keep a yearly depth test and add recurring checks between releases.
Does a retest cost extra?
It depends on the quote. Some providers include one round, some charge per round, some exclude it. Ask for the number of rounds, the time window and whether the original proof is re-run, and get it in writing.
Do compliance reports change the price?
Indirectly. Frameworks such as PCI DSS 4.0.1 requirement 11.4 set minimum scope, frequency and retesting, which adds days and paperwork. Ask your auditor what they accept before you scope, and request one report mapped to each framework.
Can I get a penetration test without paying for a full engagement?
You can start smaller: test one high-risk application, or one new feature after a big change. Narrow scope with named accounts is a legitimate test, as long as the report says exactly what was and was not covered.
Sources
Where the facts come from
- NCSC: Penetration testing
- Verizon: 2026 Data Breach Investigations Report
- CISA: Known Exploited Vulnerabilities Catalog
- OWASP: Top 10 2025, A01 Broken Access Control
- OWASP: Top Ten
- OWASP: Web Security Testing Guide
- NIST: SP 800-115, Technical Guide to Information Security Testing and Assessment
- PCI Security Standards Council: Document Library
- ISO: ISO/IEC 27001 information security management
Keep reading
Related articles
Black box vs white box penetration testing: which to choose
Black, grey and white box penetration testing compared: what each finds and misses, how effort differs, when to choose each and how to combine them.
Continuous penetration testing: how to run it alongside your annual pentest
What continuous penetration testing really means, how it compares with annual pentests, DAST and PTaaS, and how to run both in your pipeline.
How to choose a penetration testing company: 20 questions, red flags and a report check
20 questions to ask, red flags, how to review a sample report, and what CREST, OSCP and CERT-In empanelment do and do not tell you.
Get the most from every test day
Cyberlop finds vulnerabilities in your web app and APIs, reports only what it exploited, and proves each fix by re-running the exact exploit. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.