Most published guides put a single penetration test between about $5,000 and $45,000, with large or specialized scopes reaching $60,000 to $150,000 or more. Price follows scoped effort: how many days a tester spends, at a rate of roughly $200 to $500 an hour. As of 19 October 2026, these are vendor estimates, not market survey data.
Key takeaways
- Four guides from testing firms (labelled A to D below and in Sources) give overlapping ranges: $5,000 to $30,000 (A), a $10,000 to $20,000 average (B), $10,000 to $45,000 (C) and $5,000 to $100,000 or more (D).
- Web application tests are quoted at $5,000 to $30,000 by two of the guides. Mobile and cloud tests sit higher.
- A quote is usually estimated hours multiplied by an hourly rate, so scope and depth are the real price levers.
- Retests, remediation help and scope growth are the usual surprise costs.
- All the figures come from firms that sell testing. Treat them as a sanity check on quotes, not as a price list.
What does a penetration test cost by type?
Web application tests are the most commonly quoted type, and two guides agree on $5,000 to $30,000. The table lists the ranges each source publishes for the same test types. Guide A lists one network figure and no separate internal figure.
| Test type | Guide A (10 Nov 2025) | Guide B (12 Jul 2024) |
|---|---|---|
| External network | $5,000 to $20,000 (network) | $5,000 to $20,000 |
| Internal network | not separated | $7,500 to $30,000 |
| Web application | $5,000 to $30,000 | $5,000 to $30,000 |
| Cloud | $10,000 to $40,000 | $10,000 to $50,000 |
| API | $5,000 to $20,000 | $5,000 to $30,000 per asset |
| Mobile application | $12,500 to $40,000 | $12,500 to $40,000 |
Guide B also gives an average client spend per type: about $10,000 for an external network test, $12,500 for web applications and APIs, $15,000 for cloud and about $25,000 for mobile. It describes external network tests as typically three to five days of testing and web application tests as about a week.
What is the typical price range overall?
The overall ranges differ because each firm sells to a different market. Here is what each page says.
- Guide A: most organizations can expect $5,000 to $30,000, and costs can reach $60,000 or higher.
- Guide B: an average of $10,000 to $20,000, with a basic tier at $5,000 to $15,000, a comprehensive tier at $10,000 to $30,000 and a high-end tier at $30,000 to $100,000.
- Guide C: an average base cost of $10,000 to $45,000.
- Guide D (2026, undated page): a low end of $5,000 to $10,000 for mostly automated work, a mid tier of $15,000 to $50,000 for human-led testing, and an enterprise or continuous tier of $75,000 to $150,000 or more.
The same page gives a worked example: an external network test plus authenticated testing of three web apps, with three retest rounds, for $42,000 over three weeks.
How do pen testers set the price?
Most quotes are fixed prices built from estimated effort. Guide C explains the method: estimated hours for testing, report writing and project management, multiplied by the hourly rate. The UK National Cyber Security Centre says a scoping plan should state the timeframe and effort, usually in resource days.
Hourly rates quoted in these guides run from about $200 to $500. Guide C states $200 to $500 as a typical consulting range and says its own rate is $340 an hour. Guide B lists $250 to $500 for skilled testers. Guide D says certified testers often charge $200 to $400 an hour.
What makes a penetration test cost more?
Scope breadth and depth drive the price more than anything else. The factors repeated across the sources are:
- The number of applications, IP addresses, endpoints, cloud accounts or devices in scope.
- Depth: how far testers exploit a flaw and move on from it.
- Internal tests over external ones. Guide D puts the uplift at 10 to 30 percent.
- Black-box over grey-box or white-box. The PCI Security Standards Council guidance notes that a black-box test, where you share nothing, may require more time, money and resources.
- Tester experience, certifications and firm brand.
- Compliance extras such as attestation letters or framework mapping.
- Travel, after-hours work and special lab or equipment setup.
What costs do people forget?
Retesting is the usual one. Guide A lists remediation retests or rescans, remediation support, scope creep, retainers and product security assessments as additional costs, and suggests a contingency of 10 to 20 percent of testing spend. Guide D says retests may be included, bundled or billed separately, and that extra rounds from a freelancer can run $150 to $300 an hour.
Ask in writing how many retest rounds are included, and whether a fix verification letter costs extra.
How can I lower the cost of a penetration test?
Narrow the scope to what the test is for, and share more information up front. Guide C lists these ways to save: reduce scope to match your goals, give testers more information since black-box testing takes more effort, buy several tests together, and consider scheduling in the first quarter or early second quarter when demand is usually lower.
You can also make the tester's hours count. Fix the issues a scanner already finds before the test, so paid time goes to what automation misses. A free scan of your dependencies at gold.safeguard.sh/scan runs in the browser, with no login, and keeps your file on your machine, up to 100 dependencies.
How to check a quote
Use this list against any quote you receive.
- Is the scope written down: named apps, URLs, IP ranges, environments, user roles?
- Is the test grey-box, white-box or black-box, and why?
- How many days of effort are estimated, and at what rate?
- Is the report, a debrief call and one retest included?
- What triggers a change order?
- Who does the work, and what is their relevant experience?
- Is the quote fixed price or time and materials?
Frequently asked questions
How much does a penetration test cost for a small business?
Published guides start around $5,000 for a small, focused test. Guide B lists a basic tier at $5,000 to $15,000 for smaller, less complex organizations. Some vendors quote less for mostly automated assessments, but that is closer to a scan.
How much does a web application penetration test cost?
Two guides we read give $5,000 to $30,000. Guide B says web tests usually take about a week and depend on the number of applications and their complexity.
Is a cheap penetration test worth it?
It depends on what you need. Guide D describes the low end as mostly automated with limited manual verification. If an auditor or customer asked for a manual penetration test, check that the quote covers manual testing and a report that names the tester.
Why do penetration test quotes vary so much?
Scope, depth, effort estimates and rates all differ between firms. Two quotes for the same label can cover different numbers of assets, different retest terms and different amounts of manual work.
Do these figures include retesting?
Not always. Retests may be bundled, billed separately or unlimited under a test-until-fixed term, so ask before you sign.
Safeguard publishes this guide and sells security tooling, not penetration tests. We cite pricing pages only as the firms wrote them, and we do not rank or recommend any testing firm.
Sources
- Guide A, penetration testing cost guide from a testing firm, published 10 November 2025, published 10 November 2025
- Guide B, penetration test cost guide from a testing firm, published 12 July 2024, published 12 July 2024
- Guide C, penetration test cost guide from a testing firm, published 30 July 2024, published 30 July 2024
- Guide D, penetration testing cost guide from a testing firm, 2026, undated, 2026, undated
- NCSC, Penetration testing
- PCI SSC, Penetration Testing Guidance v1.1, September 2017
Last reviewed: 19 October 2026.
