Home / Knowledge hub / Penetration test cost
Knowledge hub
Penetration test cost
What drives the price of a pentest: scope, depth, time and who does the work.
What it means
Penetration test cost is the price of having an authorised tester try to find and prove vulnerabilities in your application. There is no standard rate. Quotes vary because the work varies, and a low figure and a high figure may not describe the same job.
Most of the price comes from effort. The tester's time, how experienced they are, and how much of the work is done by a person and how much by automation all feed into the figure you are quoted. Expect the quote to rise with scope, depth and urgency.
Why it matters
Buying on price alone can mislead. A cheap quote may be a scan with a new cover page, which finds little that matters. An expensive one may include scope you do not need. You want a test that matches the risk of the application and the evidence your customers or auditors will accept.
Knowing the drivers lets you compare offers like for like, trim scope sensibly, and avoid paying twice for a retest that should have been included. It also helps you plan a budget before you ask, so the conversation starts from what you need.
How it shows up
The main drivers are the size of the target (pages, endpoints, account types and integrations); the approach (black-box, grey-box or white-box, with more access usually meaning deeper results); whether authenticated testing is in scope; the environment; the reporting; and the timeline.
Ask what is in scope in writing, how many days of testing you get, who does the work, whether the retest is included, what the report contains, and whether it is accepted for your compliance needs. Compare answers, not totals. A good pentest scope avoids surprises on both sides.
Questions people ask
Penetration test cost, answered
Why do pentest quotes differ so much?
Because the scope, depth and method differ. One vendor may run automated scans and another may spend days testing business logic by hand.
Ask each to describe exactly what you will receive.
Is a retest included in the price?
Sometimes, sometimes not, and for a limited period. A retest checks that fixes work, and it is a normal part of the process.
Get the terms in writing before you sign.
Does white-box testing cost more?
It can need more setup, such as sharing code, but it often finds more in the same time because the tester knows where to look.
Compare findings and coverage, not only price.
How can we lower the cost?
Narrow the scope to what matters most, prepare test accounts and documentation in advance, and fix findings before the retest so there is less to repeat.
Do not remove the parts that carry your real risk.
Is a cheaper automated test enough for compliance?
It depends on the standard and your auditor. Some frameworks expect manual testing by qualified people, and an automated scan alone may not satisfy them.
Check the requirement before you buy.
Related
Terms that sit next to this one
Penetration test scope
The written list of what a pentest may and may not touch.
Choosing a pentest provider
What to ask, check and compare before hiring a firm to test your software.
Pentest as a service
Penetration testing bought as an ongoing subscription rather than a one-off project.
Retest
Running the test again to confirm that a reported flaw has really been fixed.
Continuous penetration testing
Testing that runs again whenever your application changes, not once a year.
What does the quote really cover?
We find vulnerabilities in web apps and APIs with black-box, grey-box and white-box testing, report only what we exploited, and prove each fix by re-running the exploit. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.