Penetration Test Cost: What You Are Actually Paying For
/ CybeRaccoon / 4 min read
The short answer: a penetration test costs whatever its scope takes to test properly, which is why any honest quote starts with questions rather than a price list. You are paying for days of skilled manual testing, and the number of days depends on how much there is to test, what kind of system it is, and how much access the testers get. Most engagements fit within 14 business days. A quote should also include the report and a retest of whatever you fix, not bill them separately. Below is what moves the price, what a suspiciously cheap test usually is, and how to spend less without testing less.
How much does a penetration test cost?
It costs the testing time your scope needs, and nothing sensible can be quoted before the scope is known.
A penetration test is mostly people's time. Tools are cheap and largely the same everywhere. What you are buying is an experienced tester working through your system by hand, so the price follows the number of days that work takes. A single web application with a handful of user roles is a short engagement. A platform with an API, a mobile app and several cloud accounts is a long one.
That is also why fixed-price "packages" deserve suspicion. A package prices the test before anyone has looked at your system, so either the price is padded for the worst case or the testing is trimmed to fit the price. Our first post covers how long a penetration test takes and why duration is set by scope.
What makes one penetration test cost more than another?
Four things, in roughly this order of impact.
Size of the scope. The number of applications, endpoints, user roles and integrations. Every role multiplies the paths that have to be checked, because a flaw often only appears when one kind of user reaches something meant for another.
Type of environment. Web applications, APIs, mobile apps, internal and external networks, and cloud configuration each need different work. Our security services page breaks down what each one involves.
Testing style. Black box testing spends paid time on reconnaissance an attacker would do for free. Grey box, where you hand over a normal user account, puts that time into finding real flaws instead.
Depth. Business logic, chained vulnerabilities and privilege escalation take the longest, and they are exactly where automated tools see nothing.
Why are some penetration tests so cheap?
Usually because they are not penetration tests.
A vulnerability scan takes minutes to run and can be resold as a "pen test" with a new cover page. It finds known, surface-level issues and misses almost everything that leads to a real breach: broken access control, logic flaws, and weaknesses that only appear when several small issues are chained together.
Warning signs in a quote: a price given before any scoping questions, no named testing days, a sample report that is mostly scanner output, and a retest sold as a separate engagement. We run a scanner too, but only to clear the noise so that human time goes where it matters. That approach is the core of how we work.
How can you lower the cost without weakening the test?
Spend the budget on testing, not on friction.
- Choose grey box. It removes paid reconnaissance and reflects how most breaches actually happen, through an attacker who already holds some access.
- Scope the risk first. Test the systems that hold customer data or money before the brochure site.
- Have access ready. Credentials and a route in on day one, so no testing day is spent waiting.
- Fix, then retest. A retest that is included in the price lets you close findings without paying twice.
What should a penetration test quote include?
A named scope, the number of testing days, the testing style, the methodology, a report with findings ranked by real risk, and a retest of the fixes. An NDA should be signed before you share any technical detail, not promised for later.
If a quote cannot tell you exactly what will be tested and for how long, you cannot compare it with anything. Get in touch and we will scope your environment properly before naming a price.
Frequently Asked Questions
Is the retest included in the price?
Yes. The retest of your fixes is part of the original engagement, not a second invoice. It is what actually closes a finding, because a fix only counts once the same attack has been tried again and fails.
Do you offer fixed-price penetration tests?
No. We quote after a scoping call, because the price follows the testing days your scope needs. Pricing a test before seeing the system means padding the price or trimming the testing, and neither helps you.
Is a vulnerability scan the same as a penetration test?
No. A scan checks for known issues automatically and in minutes. A penetration test is manual work that finds what scanners miss: access control failures, business logic flaws and chained vulnerabilities, which are the issues behind most serious breaches.
How often should we pay for a penetration test?
At least once a year, and again after any significant change, such as a new application, a major release or a move to new infrastructure. Attackers test continuously, so a test that predates your last big change is describing a system that no longer exists.