Affordable · Cheap · Telling them apart

Cheap Penetration Testing: What Under $1,000 Really Buys

Affordable and cheap are not the same thing, and the gap between them is where most people get burned. A low price can mean no overhead, or it can mean no testing. Here is how to tell which one you are being sold, using questions any honest tester will answer in a sentence.

Affordable is a cost structure. Cheap is a missing service.

There are two completely different reasons a penetration test can be inexpensive, and they produce opposite outcomes.

The first is a low cost structure. A solo tester with no sales team, no account managers, no project managers, no premises and no margin to feed can charge a fraction of a consultancy's price and spend the same number of hours, or more, actually attacking your system. Nothing has been removed from the test. What has been removed is everything wrapped around it.

The second is a missing service. The price is low because the work is not happening. A scanner runs, the output gets a cover page and a logo, and the invoice says "penetration test". This also costs very little to produce, which is exactly why it is priced to look like a bargain.

From the outside, on a quote, these two look similar. The questions below separate them reliably.

Seven questions that expose the difference

  • How many days of manual testing does this price buy? The single most useful question. A real tester answers with a number immediately, because it is how they built the quote. Evasion here is the answer.
  • Who performs the testing, and what are their certifications? You should get a name. If the work is being subcontracted or staffed by whoever is free that week, you want to know before you buy, not after.
  • Will the report include reproduction steps for every finding? Without them your engineers cannot confirm or fix anything, and the report is decoration. Scanner exports almost never have usable reproduction steps for the findings that matter.
  • Is authenticated testing included? If your application has logins and nobody tests behind them, the entire area where serious findings live has been skipped. This is the most common way a cheap test is technically honest and practically useless.
  • Is a retest included? The retest is what proves the fixes worked. If it is a separate invoice, add it to the quote before comparing.
  • How long will the engagement take? A test of a real application that finishes in four hours did not happen. Three to five business days is a normal window for a small application.
  • Can I see a redacted sample report? This settles it faster than anything else. The format, the depth, the severity rationale and the quality of the reproduction steps are all visible immediately. Mine is at sample report.

What a genuinely low-cost test should still include

Budget is a legitimate constraint and it should shrink the scope, never the standard. Even at the bottom of a sensible price range, these should all be present.

  • Manual testing by a named, certified tester, not only tooling.
  • Authenticated testing against every user role in scope.
  • Business logic testing, not just the OWASP Top 10 checklist.
  • Findings rated with a stated rationale, not an unexplained colour.
  • Reproduction steps an engineer can follow without asking you a question.
  • Immediate notification of anything critical, during the test rather than at the end of it.
  • Remediation support while you fix things, and a retest afterwards.
  • An attestation letter you can send to a customer or an assessor.

If a quote is missing several of these, it is not cheaper than the alternatives. It is a different and smaller product that happens to share a name.

The honest case for spending more

I would rather say this than pretend otherwise. There are situations where a low-cost engagement is the wrong purchase, and you should budget properly instead.

Large estates are one. If you have thousands of hosts, several domains and a decade of acquisitions, the work genuinely takes a team and a team costs what it costs. Red team engagements are another: simulating a real adversary over weeks against a mature detection capability is not a small-budget activity, and that work is scoped and priced quite differently. Regimes that mandate intelligence-led testing, and some regulated financial contexts, also expect a scale of engagement that a single tester on a short timeline cannot produce. And if your buyer has specified a particular firm or an accreditation you can only get from one, your constraint is procurement rather than security.

Outside those cases, for a small to mid-sized application or network, the expensive quote is usually buying you overhead rather than depth.

Where my pricing sits, and why

Web application testing starts at $500 and network and Active Directory work starts at $1,500, fixed against a written scope, with remediation support, a retest and an attestation letter included rather than billed separately. That is a low number by market standards and it is low for the first reason on this page, not the second: there is no firm around the testing to fund. The hours are real, the tester is named and OSCP+ certified, and the sample report is published so you can judge the output before you spend anything.

The full breakdown is on the penetration testing cost page and the pricing page. If a framework is driving your test, compliance-driven testing covers what each regime expects as evidence.

Questions about low-cost testing

It can be, and it can also be worthless. The price tells you nothing on its own. What matters is whether you are buying real tester-days against a small scope, or an automated scan with a cover page. A $500 engagement that is three to five days of manual testing against a single small application with one or two roles is honest work at an honest price. A $500 engagement that is a scanner run is a waste of $500. Ask how many days of manual testing the price buys and who performs them.
Because most of the difference is overhead rather than testing. A large firm's quote carries a sales team, account management, project management, premises and margin before anyone starts work, and on small engagements the actual testing is often done by a junior. A solo tester with no overhead can charge a fraction and still spend the same hours, or more, on the system itself.
The clearest ones are a quote with no stated number of tester-days, a report with no reproduction steps, findings with no severity rationale, a turnaround measured in hours, an unwillingness to name the tester or their certifications, no authenticated testing against an application that has logins, and no retest included. Any two of those together and you are almost certainly buying scanner output.
Only if it produces the evidence they ask for. Most assessors want a scoped report, a severity-rated finding list, documented remediation and retest evidence, and in some regimes the tester's credentials. Price is not what fails these reviews, missing evidence is. Ask the tester directly whether an attestation letter and a retest are included before you buy.
Run one, absolutely, and run it continuously rather than once a year. But understand what it cannot do. A scanner finds known vulnerabilities in known software. It does not find broken access control between two customer accounts, a checkout step you can skip, or a server that trusts a price submitted by the browser. Those require a human, and they are usually the findings that actually matter. There is a fuller comparison in penetration test versus vulnerability scan.

Want to know whether a quote you have is real?

Bring it to a scoping call. I will tell you plainly whether it is priced sensibly, even if the answer is that you should take it.

Contact