Question 1

How much does a penetration test cost?

Accepted Answer

For most small and mid-size organisations a penetration test costs between roughly $2,000 and $20,000, depending entirely on scope. A single web application is at the low end, a full-scope engagement across web, network and cloud sits in the middle, and an objective-based red team engagement is at the top. Individual automated tests through our AutoPT engine start at $35 per target. The honest answer is that nobody can quote you without knowing how many applications, hosts, domains and cloud tenants are in scope — which is why we publish an instant estimator rather than a single headline number.

Question 2

Why do penetration testing quotes vary so much between vendors?

Accepted Answer

Three reasons. First, scope: one vendor may be quoting a scan of ten hosts while another is quoting manual testing of a hundred. Second, depth: an automated scan with a report template costs a fraction of an engagement where a human actually attempts exploitation. Third, what is bundled: retesting, compliance mapping, and an executive briefing are often priced separately and quietly excluded. When comparing quotes, normalise on scope, depth, and deliverables before comparing price.

Question 3

What makes a penetration test more expensive?

Accepted Answer

The biggest drivers are the number of internet-facing hosts, the number of distinct web applications, Active Directory domains and cloud tenants (each adds real complexity), whether internal testing is in scope, and whether you need a compliance-mapped report for an auditor. Objective-based red teaming costs more than a scoped pen test because it is measured against goals rather than a checklist, and takes longer.

Question 4

What makes it cheaper?

Accepted Answer

Tight, honest scoping is the single biggest lever — testing only what matters rather than every asset you own. Choosing the AutoPT-delivered option over the fully human-led one covers the same scope at roughly half the testing cost. Bundling a ransomware simulation or data exfiltration test alongside an engagement that already gives us internal access turns a five-figure standalone test into a low four-figure add-on. And providing test credentials up front removes time we would otherwise spend getting in.

Question 5

Is a cheap penetration test worth it?

Accepted Answer

A $500 "penetration test" is almost always an automated vulnerability scan with a cover page. That has value as a hygiene check, but it will not find business logic flaws, it will not chain findings into a real attack path, and most auditors and cyber-insurance underwriters can tell the difference. If budget is the constraint, narrow the scope rather than lowering the depth — a genuinely tested single application beats a superficial sweep of fifty.

Question 6

Is retesting included in the price?

Accepted Answer

With us, yes — a remediation retest of critical and high findings is included in every engagement and the report is reissued with confirmed closure status. Many vendors bill this separately, so it is worth checking explicitly when you compare quotes.

Question 7

How much should a SOC 2 or PCI DSS penetration test cost?

Accepted Answer

Compliance does not have its own price — the scope does. A SOC 2 Type II audit typically needs an annual test covering the systems in your trust boundary, and PCI DSS requires testing of the cardholder data environment and its segmentation. Both usually land in the same bands as an equivalent external or full-scope test, plus a compliance report mapping findings to the relevant controls. What compliance changes is the reporting and evidence requirements, not the testing effort.

Question 8

Do you charge a deposit?

Accepted Answer

Yes. A deposit is required to book the engagement and reserve the testing window, with the balance due on delivery. The exact percentage is shown on your quote.

Question 9

Is the instant estimate binding?

Accepted Answer

No — it is an estimate, produced by the same pricing model our internal quoting process uses, so it is close. Final pricing is confirmed once we have scoped the engagement properly with you. If anything moves the number, we tell you before you sign anything.

Engagement	Representative scope	AutoPT-delivered	Human-led
Web application pen test	One production web application, authenticated and unauthenticated testing.	$1,900	$3,150
External network pen test	Internet-facing perimeter — around a dozen exposed hosts and services.	$2,550	$4,450
Internal network pen test	Assumed-breach internal test across roughly 400 endpoints and one AD domain.	$2,900	$5,150
Full-scope pen test	Web, network and cloud in one engagement for a mid-size environment.	$3,900	$7,150
Phishing campaign	Phishing-to-access simulation against 250 users.	$3,950	$3,950
Red team engagement	Objective-based multi-vector simulation against a mid-size environment.	$6,650	$18,650

How much does a penetration test cost?

The short answer

Penetration testing prices by scope

Price your own environment

Instant estimate

What do you want tested?

What moves the price

Pushes it up

Brings it down

Comparing quotes? Normalise these first

Is exploitation actually attempted, or is this a scan?

Exactly what is in scope?

Is retesting included?

Who writes the report, and what is in it?

Is compliance mapping included if you need it?

Penetration Testing Cost — Common Questions