Penetration testing cost in 2026 typically ranges from about $5,000 for a small, tightly scoped test to $150,000 or more for a multi-week red team engagement, and most single-application tests for startups and mid-market companies land between $10,000 and $35,000. Nearly every quote is tester-days multiplied by a day rate, so the scope you define decides most of the bill. The figures here are typical market ranges rather than a price list: they rest on the assumptions stated in each section, and real quotes vary by vendor and region.
This guide is written from the pricing side of the table. It covers how a pentest quote is built, what moves it, which compliance frameworks force your hand, and how to scope and compare vendors so you pay for adversarial testing rather than a scanner export. For the engagement itself (kickoff, testing phases, reporting calls), see our guide on what to expect during a penetration test.
How Much Does a Penetration Test Cost in 2026?
A penetration test is a time-boxed, manual attempt by qualified testers to exploit your systems the way a real attacker would, documented in a report your engineers can act on. Its cost follows the test type, because each type needs a different number of tester-days and a different skill set.
The table assumes gray-box testing (testers receive accounts and documentation but not source code), one environment, a written report, one retest, and experienced testers billing roughly $1,200 to $2,500 per day, which is typical for reputable firms serving US and Western European clients. Large consultancies often charge more, and firms in lower-cost regions often charge less.
| Test type | Scope assumption | Tester-days | Typical market range (USD) | |---|---|---|---| | Web application | One app, 2 to 3 roles | 4 to 8 | $6,000 to $18,000 | | Web app plus API (typical SaaS) | 3 to 5 roles, 50 to 150 endpoints | 8 to 15 | $12,000 to $35,000 | | Standalone API | 30 to 100 documented endpoints | 4 to 10 | $6,000 to $22,000 | | Mobile app | iOS and Android builds plus backend API | 8 to 15 | $12,000 to $35,000 | | External network | Up to about 30 live hosts | 2 to 5 | $3,000 to $12,000 | | Internal network and Active Directory | One site or VPN access, one domain | 5 to 10 | $8,000 to $25,000 | | Cloud configuration review | 1 to 3 AWS, Azure or GCP accounts | 4 to 8 | $6,000 to $20,000 | | LLM and AI features | One assistant or agent with tools or RAG | 3 to 8 | $5,000 to $18,000 | | Social engineering | One phishing campaign, a few hundred staff | 3 to 6 | $4,000 to $14,000 | | Red team | Objective-based, multi-vector, 4 to 8 weeks | 25 to 60 | $50,000 to $150,000+ |
Two rules fall out of this table. First, a quote under $5,000 for a multi-role SaaS application buys two or three days of human work at market rates, which is not enough to test authorization across roles, so it is almost certainly a scan with a cover page. Second, a red team is a different product: it tests whether your detection and response catch a determined adversary pursuing an objective, and you should buy it only after fixing what ordinary pentests find.
If your product ships AI features, scope them as their own line item. LLM application risks such as prompt injection need dedicated test cases that a standard web checklist does not cover.
How Pentest Quotes Are Built: The Tester-Day Formula
Almost every pentest quote reduces to one formula: price = tester-days × day rate + retest + extras. Per-IP, per-endpoint and per-application pricing look different on paper, but vendors derive them from the same arithmetic.
Tester-days break into three buckets:
- Testing days: hands-on-keyboard time for mapping, manual testing, exploitation and chaining findings together.
- Reporting and QA days: writing findings, reproducing them and peer review. As a rule of thumb, a well-run engagement spends 15% to 25% of its days here; much less usually means a thin report.
- Management overhead: kickoff, status updates, escalation calls and the readout meeting, usually priced into the day rate or charged as a small fixed fee.
Example: a B2B SaaS product with a React front end, 85 REST endpoints, four roles (owner, admin, member, read-only), two test tenants and one AWS production account, tested gray-box in staging.
- Mapping, reconnaissance and automated coverage: 1 day
- Authentication, sessions and SSO: 1.5 days
- Authorization across roles and tenants: 3 days
- API business logic (billing, invitations, exports, webhooks): 3 days
- AWS configuration review: 2 days
- Reporting and QA: 2 days
- Retest of fixed findings: 1 day
That totals 13.5 tester-days. At an assumed $1,500 per day the quote is about $20,250, and across the $1,200 to $2,500 range it spans roughly $16,200 to $33,750. This illustrative math shows why two honest vendors can differ by 2x on the same scope: both the rate and the effort estimate move.
Authorization is the line item buyers underestimate. Four roles create twelve ordered role pairs (a member attempting admin actions, an admin attempting owner actions, and so on), plus the boundary between tenants, and multiplying by 85 endpoints yields over a thousand possible access checks. Good testers prioritize the sensitive ones, but that is still days of manual work, and it is exactly where broken object-level authorization, the flaw behind many API data exposures, gets found.
What Drives Penetration Testing Cost?
Scope size is the obvious driver, but it is rarely the one that surprises buyers. The table lists the drivers that move quotes most, and what each typically does to the price.
| Driver | Why it moves the price | Typical effect on the quote | |---|---|---| | User roles and tenants | Each role pair and tenant boundary adds authorization cases | Often the largest driver for SaaS | | Attack surface size | More apps, endpoints, hosts or cloud accounts | Roughly linear with scope | | Business-logic complexity | Payments, approvals, quotas and integrations need manual abuse cases | Adds days that tools cannot replace | | Knowledge level | Black box spends days on reconnaissance; white box adds code review | Gray box is usually the best value | | Test type | Network, cloud, mobile and red team need different skills | See the price table above | | Environment constraints | Production-only testing, narrow windows, WAF blocking, unstable staging | Slower testing, more days | | Compliance reporting | PCI-specific reports, attestation letters, customer summaries | Adds reporting time | | Retesting | Verifying fixes, sometimes over several rounds | Included once, or 1 to 2 extra days | | Tester seniority | Senior testers cost more per day and find more per day | Higher rate, often fewer days | | Timing | Rush starts and after-hours testing | Premium pricing |
Roles Matter More Than Pages
Buyers often describe scope in pages or screens, while testers think in roles, objects and state changes. A 20-screen app with five roles and multi-tenancy can take longer to test than a 200-page marketing site with a single login. Lead every scoping conversation with your permission model, not your sitemap.
Gray Box Is Usually the Best Value
Black-box testing simulates an outsider, but you pay for days of reconnaissance that your own documentation could replace. Gray-box testing (accounts for every role, API specs, an architecture diagram) points expensive human hours at the logic that matters. Choose white box, with source code access, when you want the deepest coverage of a critical component such as authentication or payment handling.
Which Compliance Frameworks Require Penetration Testing?
Compliance rarely defines your scope, but it sets the floor: how often you test and what the report must show. Here is what the frameworks buyers most often face actually say.
| Framework | What it says about penetration testing | Budget impact | |---|---|---| | PCI DSS v4.x (Requirement 11.4) | Internal and external tests at least every 12 months and after significant changes; segmentation tests yearly, every six months for service providers | Recurring annual line item, plus change-driven tests | | SOC 2 | No explicit mandate; the Trust Services Criteria cite penetration testing as an example evaluation under CC4.1, and auditors expect one | One annual test of the in-scope system | | ISO/IEC 27001:2022 | Requires managing technical vulnerabilities (Annex A 8.8) and security testing in development (8.29); a pentest is common evidence | An annual test is the norm | | Israel Data Security Regulations, 2017 | Regulation 5(d): databases at the high security level need penetration tests at least every 18 months | Minimum cadence for high-tier Israeli databases | | HIPAA (proposed update) | HHS proposed penetration tests at least every 12 months; not final as of September 2026 | Plan ahead if you sell to US healthcare | | DORA (EU financial sector) | Designated financial entities must run threat-led penetration testing at least every three years | TLPT is a red team program, priced accordingly |
The primary sources are the PCI DSS standard from the PCI Security Standards Council, the English translation of Israel's Privacy Protection (Data Security) Regulations, and the HHS fact sheet on the proposed HIPAA Security Rule update. This is general guidance, not legal advice.
Two practical consequences follow. If you are working toward a first audit, schedule the test early in the observation window so remediation and retesting finish before the period closes; our SOC 2 roadmap for startups shows where it fits. If you supply EU banks or insurers, expect their DORA programs to pull you into testing and contract clauses, as covered in our guide to NIS2 and DORA for tech vendors.
Pentest Pricing Models: Fixed Price, Day Rate, PTaaS and Retainers
The same tester-days can be sold five ways. The model changes who carries scope risk and how predictable your spend is, not how much human testing an hour buys.
| Model | How it is priced | Best for | Watch out for | |---|---|---|---| | Fixed price per scope | Quote after scoping, tester-days built in | Defined apps, audit deadlines, first tests | Vague scope clauses, change fees | | Day rate (time and materials) | Tester-days × rate, billed as used | Evolving scope, internal networks | Needs a cap and daily status | | PTaaS subscription | Annual platform fee or credits for tester-hours | Frequent releases, many apps | Expiring credits, scanning sold as testing | | Annual retainer | Fixed yearly fee for planned tests and retests | Teams with a testing calendar | Unused days, stale scope | | Bug bounty | Payout per valid finding plus platform fees | Broad coverage after a pentest baseline | No guaranteed coverage or audit-ready report |
Penetration testing as a service (PTaaS) is a subscription that pairs a platform (scoping, live findings, retest requests) with human testing sold as credits or scheduled tests. It rarely makes an hour of human testing cheaper; what it does is make smaller, more frequent tests practical. Use these decision rules:
- Use fixed price when the scope is stable and you need a firm number for a budget or an audit deadline.
- Use a day rate when you cannot see the full scope in advance, such as an internal network or an acquisition target, and always cap it.
- Use PTaaS when you ship weekly across several applications and want to test features as they land.
- Use a retainer when you already know your annual calendar: one deep test, targeted tests after major releases, and retests.
- Add a bug bounty only after at least one thorough pentest, or you will pay bounty prices for issues a single test would have found in bulk.
How to Scope a Pentest So Quotes Are Comparable
Most quote confusion comes from vendors pricing different scopes. Send every vendor the same written brief and you can compare like for like. Work through this checklist first:
- Inventory every target with counts: applications and URLs, API endpoints (export the OpenAPI spec), mobile builds, public IPs and cloud accounts.
- List roles and tenants, and name the boundaries that matter most: tenant A versus tenant B, member versus admin, support staff versus customers.
- Choose the knowledge level: black, gray or white box, and whether testers get source code.
- Pick the environment: a staging environment that mirrors production, or production with explicit constraints.
- State the driver and the audience: SOC 2 evidence, PCI, a customer questionnaire, due diligence or a launch, and who will read the report.
- Flag high-risk flows: payments, file uploads, SSO, webhooks, admin panels, data exports, AI features and third-party integrations.
- Declare exclusions and constraints: no denial of service, rate limits, testing windows, and third-party services you cannot authorize testing against.
- Prepare test accounts: two per role, seeded data and a plan for MFA.
- Set dates: start, report deadline, remediation window and retest date.
- Define retest terms: how many rounds, within what window, and whether they are included or billed.
- Name contacts and escalation paths: who gets called about a critical finding, and how fast.
- Confirm authorization: signed rules of engagement plus your cloud provider's testing policy. AWS permits testing of its listed services without prior approval, for example, but lists denial-of-service testing among prohibited activities.
Then capture the answers in a brief like this one and attach it to every request for a quote:
engagement:
driver: "SOC 2 Type II evidence and enterprise security reviews"
report_audience: [auditor, customers, engineering]
report_due: "2026-11-15"
targets:
web_app:
url: "https://app.example.com"
roles: [owner, admin, member, read_only]
test_tenants: 2
api:
spec: "openapi.yaml"
endpoints: 85
auth: "OAuth 2.0 and API keys"
cloud:
provider: aws
accounts: 1
approach:
knowledge: gray_box # black_box, gray_box or white_box
environment: staging # mirrors the production data model
high_risk_flows: [billing, file_upload, saml_sso, webhooks, ai_assistant]
constraints:
excluded: [denial_of_service, social_engineering]
window: "weekdays 06:00 to 18:00 UTC"
retest:
rounds_included: 1
window_days: 60
escalation:
critical_findings: "phone and Slack, within 2 hours"
How to Compare Quotes and Spot a Scan Sold as a Pentest
Normalize before you compare: convert every quote into tester-days, then check what those days include. The cheapest quote is often not the lowest day rate; it is simply the fewest days.
Illustrative scenario: three vendors quote the scope in the brief above. The figures are hypothetical and chosen to show a common pattern.
| Item | Quote A | Quote B | Quote C | |---|---|---|---| | Price | $4,500 | $21,000 | $38,000 | | Tester-days | "2 to 3" | 12 | 14 | | Effective day rate | $1,500 to $2,250 | $1,750 | About $2,700 | | Manual testing per role pair | Not mentioned | Yes | Yes | | Retest | Billed extra | One included | One included | | Sample report | Scanner export | Manual findings, CVSS, repro steps | Same, plus executive deck |
Quote A is not cheap per day; it is small. Three days cannot cover four roles and 85 endpoints, so most of the work will be automated. Quotes B and C buy similar testing, and C's premium pays for brand and presentation, which may matter if your board or a regulator reads the report. The warning signs of a scan sold as a pentest are consistent:
- A price arrives before anyone asks about roles, endpoints or environments.
- One to three days for a multi-role application.
- A sample report dominated by missing headers, TLS cipher suites and version banners rated "High".
- No named testers, no CVs, and vague answers about credentials such as OSCP or OSWE.
- "Unlimited retests" with a 48-hour turnaround, which only works if a tool does the testing.
- Findings without reproduction steps or evidence.
What Should a Penetration Test Report Include?
The report is what you are buying; the testing is how it gets made. A report that your auditor, your customers and your engineers can all use contains seven parts:
- Executive summary: overall risk in plain language, the most serious attack paths and what to fix first.
- Scope and methodology: exact targets, dates, accounts used, exclusions and the methodology followed, such as the OWASP Web Security Testing Guide.
- Risk-rated findings: each with a severity score, ideally a CVSS v4.0 vector as defined by FIRST (many reports still use v3.1), plus a rating adjusted for your business context.
- Reproduction steps and evidence: requests, responses and screenshots that let an engineer confirm the issue in minutes.
- Remediation guidance: specific fixes for your stack, not generic advice to "sanitize input".
- Retest results: the status of every finding after your fixes, ideally in an updated report.
- Attestation letter: a short summary you can share with customers without exposing vulnerability details.
CVSS measures technical severity, not your business risk. A medium-severity insecure direct object reference that exposes another tenant's invoices can matter more to a B2B SaaS company than a high-severity flaw on an isolated marketing server, and a good tester says so in the report.
How Agentixly Approaches Penetration Testing
At Agentixly, pricing transparency is part of the methodology: you should be able to see exactly what you are paying for. Our cybersecurity team runs every engagement in five phases:
- Scoping: a call and a written questionnaire covering targets, roles, environments, constraints and the compliance driver behind the test.
- Quote: a fixed price that shows tester-days per component, with assumptions, exclusions and retest terms written into the proposal, so you can compare it line by line.
- Rules of engagement: signed authorization, named contacts, testing windows and escalation paths, checked against your cloud providers' testing policies.
- Testing: manual-first testing aligned with OWASP guidance for applications and APIs, with automation used for coverage rather than as a substitute. Critical findings are escalated as soon as they are confirmed, not held for the report.
- Reporting and retest: an executive summary, technical findings with CVSS vectors, reproduction steps and remediation guidance, a readout call with your engineers, a retest of fixed findings, and a letter you can share with customers.
Because Agentixly also builds web platforms, SaaS products and cloud infrastructure, remediation help comes from engineers who ship production code. When we have built or maintain the system under test, we say so up front and keep the testers separate from the people who wrote the code, because independence is what makes a test credible to an auditor. The offensive-security culture behind this approach is described in our piece on why Israel leads in cybersecurity.
The Bottom Line: Budget for the Whole Cycle
The vendor invoice is only part of the cost. Preparing test accounts and environments, fixing findings and supporting the retest all consume engineering time, and a test whose findings nobody fixes buys you nothing.
Illustrative scenario: a Series A SaaS company with one application, an 85-endpoint API and one AWS account, preparing for SOC 2 Type II and shipping monthly. Assume a $1,500 day rate and a fully loaded engineering cost of $800 per engineer-day.
| Budget line | Assumption | Illustrative cost | |---|---|---| | Annual gray-box test (app, API, AWS) | 12.5 tester-days | $18,750 | | Retest | 1 tester-day | $1,500 | | Targeted test after a major release | 3 tester-days | $4,500 | | Preparation (accounts, data, access) | 4 engineer-days | $3,200 | | Remediation of findings | 15 engineer-days | $12,000 | | Total for the year | | $39,950 |
Almost 40% of that total is your own engineers' time, which is why an accurate scope and a report with clear reproduction steps save real money. Spend testing budget where a breach would hurt most, test after significant changes rather than on the anniversary of the last report, and never let a deadline push you into buying a scan.
If you want a quote you can check line by line, send us your scope. Agentixly's penetration testing and security services cover web applications, APIs, mobile apps and cloud environments, and you can contact our team for a scoped, fixed-price proposal; we answer every inquiry within 24 hours.