Prices · Scope · What moves the number

What a Penetration Test Actually Costs

Two quotes for what looks like the same job can differ by ten times, and neither firm is necessarily lying. The difference is almost always scope, seniority and how much of the work a human actually does. Here are my prices, and the seven things that move them.

The prices

These are starting points, not a menu. Every engagement is fixed against a written scope before anything begins, there is no hourly billing, and the number is confirmed in writing within 24 hours of a free scoping call.

  • Web application testing - from $500. Manual OWASP Top 10, authentication and authorisation, business logic and workflow abuse, and API testing across REST and GraphQL. Typically three to five business days. Scoped to the number of user roles, the size of the endpoint surface, and whether an API is in scope.
  • Network and Active Directory testing - from $1,500. Internal and external network testing, ADCS, Kerberoasting and ACL abuse, BloodHound-mapped attack paths, and segmentation validation. Scoped to domain size, host count and trust relationships.
  • Cloud testing - from $1,500. Azure and cloud infrastructure fall under the same infrastructure tier, scoped the same way.
  • Compliance-driven testing - from $500. Framework work follows the same underlying pricing: from $500 for an application-only scope, from $1,500 once infrastructure is in scope. The framework changes the evidence you need, not the cost of the testing itself.

Every engagement includes the things that are frequently sold as extras: remediation support while you fix what was found, a retest to confirm the fixes hold, and an attestation letter you can hand to a customer or an assessor. The full breakdown is on the pricing page.

Why two quotes for the same job differ by ten times

This is the question I get most, and the honest answer is that most of the spread has nothing to do with testing quality.

1. Tester-days, not features

Penetration testing is sold in days of a skilled person's attention. A small application with one user role and forty endpoints is a genuinely different amount of work from a platform with six roles, a payment flow and a public API. When you compare quotes, convert each one into tester-days and the spread usually collapses. If a firm will not tell you how many days you are buying, that is the finding.

2. Overhead you are funding

A quote from a large consultancy carries a sales team, account management, a project manager, premises and margin before a single packet is sent. None of that makes the test better. It is a real cost of buying from a large firm, and it is most of the gap between a $2,000 engagement and an $18,000 one for the same application.

3. Who actually does the work

Large firms staff junior testers on small engagements and have a senior review the output. You are quoted at a blended rate and tested at a junior one. With a solo tester the person who scopes the work is the person who runs it and writes the report, which is worth asking about explicitly whoever you buy from.

4. Manual work versus tooling

A scanner finds missing headers, out-of-date libraries and known CVEs. It does not find broken access control between two tenants, a workflow you can skip a step in, or a price field the server trusts. Those are the findings that matter and they only come from a human. The cheapest quotes on the market are frequently scanner output with a cover page, which is why price alone tells you very little.

5. Scope creep protection

A quote that looks low and then bills hourly for anything unforeseen is not a low quote. Fixed price against a written scope is the only version where the number you are shown is the number you pay.

6. Retest and remediation

Many firms charge separately for the retest, which is the part that actually proves you fixed something. If a quote excludes the retest, add it before comparing.

7. The deadline

Work that has to start this week costs more everywhere, mine included. If a customer contract or an audit date is driving the test, the cheapest thing you can do is start the conversation early.

What you should never pay for

A few things turn up on quotes regularly and are not worth money. An unedited scanner export, however long it is. A report with no reproduction steps, because your engineers cannot act on it. A finding list with no severity rationale, which makes triage impossible. A "penetration test" with no authenticated testing against an application that has logins, which skips the entire area where the real findings live. And any engagement where nobody will tell you the name or the certifications of the person doing the testing.

Working out your own number

If you want to arrive at a call already knowing roughly where you will land, answer these five: what kind of system is it, how large is it in rough terms, how many distinct user roles exist, is an API in scope, and is a framework or a customer setting the deadline. Those five answers determine nearly all of the price. There is a longer explainer in how much does a penetration test cost, and the sample report shows what the money produces.

By situation

Cost works differently depending on what is driving the test. If a funding round or an enterprise customer is the reason, see penetration testing cost for startups. If an auditor is, see SOC 2 penetration testing cost or PCI DSS penetration testing cost. And if you are weighing up an offer at the very bottom of the market, read what cheap penetration testing actually buys first.

Pricing questions

Because you are not paying for the consultancy. A firm quoting $18,000 for a web application test is covering a sales team, account managers, a project manager, an office, a margin, and frequently a junior tester whose work a senior reviews. I am one OSCP+ tester with no overhead, and the person who scopes your test is the person who runs it and writes the report. The testing hours on a small application are not materially different. The price around them is.
It depends entirely on whether the hours are real. A $400 engagement that runs an automated scanner and reformats the output is worthless at any price. A $500 engagement that is three to five days of manual work against a small application is genuinely good value. The question to ask is never the price on its own, it is how many tester-days you are buying and who is doing them. How to tell the difference is worth reading before you buy anything at the low end.
No. Every engagement is a fixed price against a written scope, agreed before anything starts. Hourly billing moves the risk of a bad estimate onto you, and it gives the tester a quiet incentive to be slow. You get the number, the timeline and the deliverables in writing within 24 hours of the scoping call, and that number does not change unless you change the scope.
Nothing that a test needs. Remediation support, the retest after you fix things, and the attestation letter are all included rather than billed as extras. What is genuinely out of scope is work I have not scoped, for example adding a second application halfway through, or a physical or social-engineering component you did not ask for. Those get re-quoted rather than absorbed, so the original number stays honest.
Usually within a single call. I need to know what kind of system it is, roughly how large, whether there are authenticated roles, whether an API is in scope, and whether a framework or a customer is driving the deadline. From that the price and the timeline go into a written proposal within 24 hours.

Want the number for your scope, not a range?

A short scoping call is free, and the written proposal with a fixed price follows within 24 hours.

Contact