Question 1

How much does a penetration test cost?

Accepted Answer

For most small and mid-size organizations a penetration test costs between $1,400 and $23,150, depending entirely on scope. A single web application is at the low end, a full-scope engagement across web, network and cloud sits in the middle, and an objective-based red team engagement is at the top. The honest answer is that nobody can quote you without knowing how many applications, hosts, domains and cloud tenants are in scope — which is why we publish an instant estimator rather than a single headline number.

Question 2

Why do penetration testing quotes vary so much between vendors?

Accepted Answer

Three reasons. First, scope: one vendor may be quoting a scan of ten hosts while another is quoting manual testing of a hundred. Second, depth: an automated scan with a report template costs a fraction of an engagement where a human actually attempts exploitation. Third, what is bundled: retesting, compliance mapping, and an executive briefing are often priced separately and quietly excluded. When comparing quotes, normalise on scope, depth, and deliverables before comparing price.

Question 3

What makes a penetration test more expensive?

Accepted Answer

The biggest drivers are the number of internet-facing hosts, Active Directory domains and cloud tenants — each of those is genuinely distinct work rather than more of the same. Internal testing on top of external adds cost, as does a compliance-mapped report for an auditor. Additional web applications do add to the total, but far less than the first one did, because the marginal cost of another application is close to nothing for us. Objective-based red teaming costs more than a scoped pen test because it is measured against goals rather than a checklist, and runs unannounced over a much longer window.

Question 4

What makes it cheaper?

Accepted Answer

Tight, honest scoping is the single biggest lever — testing only what matters rather than every asset you own. After that, test more applications in one engagement: because the swarm runs unattended and writes its own reports, additional applications are priced far below the first, so twelve apps costs nowhere near twelve times one. Bundling a ransomware simulation or data exfiltration test alongside an engagement that already gives us internal access turns a five-figure standalone test into a low four-figure add-on. And providing test credentials up front removes time we would otherwise spend getting in.

Question 5

Why is a real penetration test cheaper from you than from a traditional firm?

Accepted Answer

Because the labor is cheaper, not because the testing is thinner. A traditional firm prices on tester-days, so a bigger scope costs proportionally more. Our agent swarm runs unattended and writes its own reports, so the marginal cost of the twelfth application is close to the cost of the first — the fixed cost is the human time around the engagement, not the testing. We pass that structure straight through in the pricing. Exploitation is still attempted and proven, business logic is still tested, and every finding ships with working proof-of-concept code you can run yourself.

Question 6

Is there a cheaper option if my budget is tight?

Accepted Answer

Not a cheaper tier of the same engagement — we deliberately do not sell one, because a discount tier is really a way of giving you less attention while implying you got the same thing. What we can do instead is scope honestly: test the applications that actually matter rather than everything you own, skip the compliance report if no auditor is asking for it, and give you test credentials-based access so we are not paying for time spent getting in.

Question 7

Is retesting included in the price?

Accepted Answer

With us, yes — a remediation retest of critical and high findings is included in every engagement and the report is reissued with confirmed closure status. Many vendors bill this separately, so it is worth checking explicitly when you compare quotes.

Question 8

How much should a SOC 2 or PCI DSS penetration test cost?

Accepted Answer

Compliance does not have its own price — the scope does. A SOC 2 Type II audit typically needs an annual test covering the systems in your trust boundary, and PCI DSS requires testing of the cardholder data environment and its segmentation. Both usually land in the same bands as an equivalent external or full-scope test, plus a compliance report mapping findings to the relevant controls. What compliance changes is the reporting and evidence requirements, not the testing effort.

Question 9

Do you charge a deposit?

Accepted Answer

Usually. A deposit books the engagement and reserves the testing window, with the balance due on delivery, and the exact percentage is shown on your quote. The deposit mainly protects us on smaller engagements with clients we have not worked with before. For well-established organizations we can waive it and simply invoice the engagement in full on the Statement of Work — just ask, and we will note it on your quote and SOW.

Question 10

Is the instant estimate binding?

Accepted Answer

No — it is an estimate, produced by the same pricing model our internal quoting process uses, so it is close. Final pricing is confirmed once we have scoped the engagement properly with you. If anything moves the number, we tell you before you sign anything.

Engagement	Representative scope	Price
Web application pen test	One production web application, authenticated and unauthenticated testing.	$1,400
External network pen test	Internet-facing perimeter — around a dozen exposed hosts and services.	$3,600
Internal network pen test	Assumed-breach internal test across roughly 400 endpoints and one AD domain.	$6,400
Full-scope pen test	Web, network and cloud in one engagement for a mid-size environment.	$11,000
Phishing campaign	Phishing-to-access simulation against 250 users.	$4,100
Red team engagement	Objective-based multi-vector simulation against a mid-size environment.	$23,150

How much does a penetration test cost?

The short answer

Penetration testing prices by scope

Price your own environment

Instant estimate

What do you want tested?

What moves the price

Pushes it up

Brings it down

Comparing quotes? Normalise these first

Is exploitation actually attempted, or is this a scan?

Exactly what is in scope?

Is retesting included?

Who writes the report, and what is in it?

Is compliance mapping included if you need it?

Penetration Testing Cost — Common Questions