Buying
How much does a penetration test cost?
Published Updated 4 min read
The short answer
The cost of a penetration test is driven mainly by how much skilled tester time the scope requires, so the same provider can quote very different prices for a small web app and a multi-surface cloud estate. The biggest drivers are scope size, the number of surfaces and user roles, testing depth, whether retesting is included, scheduling constraints and the experience of the testers. Understanding those drivers is more useful than any published price range, because ranges rarely match your scope.
Why is there no standard price?
A penetration test is a service measured in human effort. NCSC guidance notes that effort is agreed during scoping and is usually expressed in resource days, and that is how most providers build a quote: estimate tester days, multiply by a day rate, add project management and reporting. Two quotes for "a pentest" can differ widely simply because they assume different scopes.
You will find price ranges published online, mostly by vendors. We have not cited any here because we could not find one from an independent, checkable source that would reliably match your situation. The better approach is to understand what moves the number and ask every provider for a quote against the same written scope.
What drives the cost of a penetration test?
| Driver | Why it changes effort | What raises cost | What lowers cost |
|---|---|---|---|
| Scope size | More targets mean more time to map and test | Many applications, hosts, endpoints or environments | A tightly defined, prioritized scope |
| Surfaces | Web, API, cloud, identity and internal network each need different work | Several surfaces in one engagement | Testing the highest-risk surface first |
| User roles and tenants | Authorization must be tested between every role pair | Many roles, multi-tenant data, admin consoles | Fewer roles, or prioritizing the sensitive ones |
| Depth and approach | Manual logic testing and code review take longer than scanning | White-box review, social engineering, long objective-based tests | Gray-box access that saves discovery time |
| Retesting | Verifying fixes is extra tester time | Retests billed separately or per round | One retest included in the quote |
| Timing | Out-of-hours or compressed windows constrain scheduling | Night or weekend testing, urgent start dates | Flexible dates, business-hours testing |
| Tester skill | Experienced testers find more in the same time and cost more per day | Senior specialists in niche technology | Generalists, at the risk of shallower results |
| Reporting | Custom formats and attestations take time to produce | Multiple report versions, auditor letters, presentations | One standard report |
| Readiness | Blocked access wastes paid days | Missing accounts, broken test environments, a firewall blocking testers | Accounts, data and allow-listing ready on day one |
How does scope affect the quote?
Scope is the largest lever. For a web application, providers typically ask how many distinct pages or features exist, how many user roles there are, whether there is an API and how many endpoints it has, and whether file uploads, payments or third-party integrations are involved. For infrastructure, they ask how many IP addresses or hosts, and whether cloud accounts and identity systems are in scope.
If you cannot afford to test everything, rank systems by what an attacker would gain: customer data, money movement, administrative control, credentials to other systems. A deep test of the system that matters most is usually worth more than a shallow test of everything.
Have these answers ready before you ask for quotes, because they are what providers use to estimate days:
- Which applications, APIs, cloud accounts and network ranges are in scope, and which are explicitly out.
- How many user roles and tenants exist, and which handle sensitive data.
- Whether testing is in production, staging or both.
- Whether testers get accounts, documentation or source code.
- Any compliance framework the report must satisfy, and any fixed deadline.
Why do cheaper tests sometimes cost more?
A very low quote often means less human time, which usually means more reliance on automated scanning. That can be fine if a scan is what you need, but it is a poor deal if you are paying for assurance about access control and business logic, which scanners rarely find (see penetration testing vs vulnerability scanning).
The hidden costs of a shallow test include engineering hours spent triaging false positives, a report your customers or auditors do not accept, and real vulnerabilities left in place. When comparing quotes, compare tester days and method, not just the total.
Is retesting included?
Ask explicitly. Some providers include one retest round within a time window, some charge per round, and some do not retest at all. A finding is not really closed until someone repeats the attack and it fails, so a test without retesting gives you a list of problems but no proof they are fixed. See retesting and fix verification.
Other line items to check: project management, report revisions, attestation letters for customers, and emergency notification if a critical issue is found mid-test.
How can you reduce the cost without reducing value?
- Fix the scanner-detectable issues first, so testers do not spend paid days on missing patches.
- Choose gray-box testing for applications, giving testers accounts and documentation so they spend time testing rather than guessing. See black box, gray box and white box testing.
- Prepare properly: working test accounts for each role, seeded data, allow-listed tester IPs and a named technical contact. See how to prepare for a penetration test.
- Prioritize scope by business impact rather than testing everything thinly.
- Share previous reports and scan results so known issues are not rediscovered.
- Consider frequency. For systems that change constantly, continuous penetration testing can replace repeated full-scope engagements.
How should you compare quotes?
Send every provider the same written scope and ask each to state: tester days, the split between manual and automated work, what is out of scope, whether retesting is included, what the report contains, and who will do the testing. Then compare like with like. A quote that is far below the others usually has a smaller scope or less manual work, and it is worth asking which.
For a full evaluation checklist beyond price, see how to choose a penetration testing company.
How Brexa approaches this
Brexa scopes each engagement before quoting. The one-time vulnerability assessment is time-boxed and focused on the issues you would patch first, and retesting of fixes is part of the engagement before it closes. To get a scoped quote, contact us.
Frequently asked questions
Is a penetration test a one-time cost?
A single engagement is, but most organizations test again yearly, after major changes, or continuously, so it is better budgeted as a recurring cost.
Does compliance make a penetration test more expensive?
It can, if the framework requires specific coverage such as PCI DSS segmentation testing or particular report content. The testing itself is similar; the scope and documentation requirements are what add effort.
Why do providers ask so many questions before quoting?
Because the price is built from estimated tester time, and the number of applications, roles, endpoints and hosts determines that time. A provider that quotes without asking is either guessing or selling a fixed, largely automated product.
Is a fixed-price pentest a bad sign?
Not necessarily. Fixed pricing for a clearly defined scope is common. Check what the fixed price includes in tester time, manual work and retesting.
Sources
Written and reviewed by the Brexa team. Educational information, not legal or compliance advice. See our editorial policy.
Keep reading
Find out what an attacker could do with your systems.
Book a short scoping call. Nothing is tested until scope and rules of engagement are signed, and every finding comes with proof.