How much does a penetration test cost?
The short answer is 'it depends on scope', which isn't much help on its own. So here is what actually drives the price of an engagement, what a real quote includes, and how to get an accurate number for your situation.
Why there's no single price
A single fixed price for 'a penetration test' can't reflect what's being tested. A web app with three pages and a marketing site are not the same job as a multi-tenant platform with hundreds of API endpoints. Pricing is effort-based: it tracks how much skilled tester time the work needs. Three things drive that effort most.
How much there is to test: the number of applications, API endpoints, hosts, user roles and environments within the agreed boundary.
The assurance level you need (a focused check or deep white-box verification against a standard) and the box type (black, grey or white).
How complex the target is. Intricate business logic, custom authentication, heavy integrations and custom-built technology all add tester time.
What drives the price
These are the levers that move a quote up or down. Knowing them helps you scope sensibly and spot a number that is too low for real manual testing.
Type and number of targets
A single web app costs less than a web app plus its API, mobile clients and external network. Each target is a distinct engagement with its own method (web, API, mobile, network, cloud).
Size of the attack surface
More pages, more API endpoints, more hosts and more user roles mean more to test. For APIs especially, the route count and the number of roles/tenants to test across drive the time.
Depth and box type
Black-box discovery eats time; grey-box (credentials plus a spec) is the efficient norm; white-box enables the deepest coverage for high assurance or standards verification. Deeper assurance means more hours.
Complexity of the application
Intricate business logic, custom authentication and authorisation, third-party integrations and custom-built technology all take longer to test thoroughly than a standard, off-the-shelf app.
Compliance and reporting needs
Testing tied to a standard (for example PCI DSS segmentation testing) carries specific requirements and report formats. A compliance-grade deliverable and evidence package is more work than an internal summary.
Re-test and retainer
Checking that fixes actually closed the issues takes time too. At Vexaro, a re-test of remediated findings is included at no extra charge, with its window set in the Statement of Work. Ongoing or retainer arrangements are priced differently from a one-off engagement.
What a real quote includes
A credible penetration test is much more than a scanner run. When you compare quotes, check that the price covers real manual testing and a report you can base decisions on, rather than automated output alone. Ours includes everything below.
- Scoping and rules of engagement, with an NDA before any access
- Manual-first testing by a human tester, with scanners only in support
- A prioritised report: each finding with impact, evidence, reproduction and remediation
- Severity scored with CVSS 3.1 and translated into business risk
- An executive summary for decision-makers plus technical detail for engineers
- A free re-test of remediated findings, within the window set in the SoW, to confirm the risks are closed
Indicative timelines
Cost broadly follows duration, and duration follows scope. As a rough guide from our engagement formats: a penetration test (web, mobile, API or external perimeter) typically takes 1-3 weeks, a security and documentation audit 2-4 weeks, and a Red Team engagement 3-6 weeks. Compliance readiness takes longer: ISO 27001 readiness, for example, runs over 6-9 months, and SOC 2 Type II over an implementation period plus an observation window of 3-12 months.
These are indicative durations, not prices. The final scope and effort depend on the agreed threat model and targets. We give a fixed quote once the scope is clear.
Common questions about cost
Because an accurate price needs a scope. The same 'web app pentest' can take a few days or several weeks, depending on size, roles and complexity. We scope quickly, often from a short call, and then give you a fixed quote instead of a number that brings surprises later.
Usually depth. A very low quote often means an automated scan with a light manual pass, not a real manual-first test. Compare what is actually being done (manual testing, business-logic and authorisation coverage, a real report and a re-test), rather than the headline number.
We start with a short, free consultation to understand the targets, roles, environments and your goal. From that we agree a boundary and propose a scope, then give a fixed quote and timeline. An NDA is signed before any access.
Yes. After you remediate, we re-test the fixed findings at no extra charge to confirm the risks are closed. The Statement of Work records which findings are re-tested and the window, so it's agreed up front, not added later.
It can. Testing tied to a standard (such as PCI DSS Requirement 11.4 segmentation testing) has specific requirements and report formats, and a compliance-grade evidence package is more work than an internal summary. We scope that explicitly so there are no surprises.