How Much Does a Penetration Test Cost? A Practical Breakdown
"How much is a pentest?" is one of the first questions founders ask, and the honest answer is "it depends." This article explains what it depends on, so you can budget sensibly and avoid paying for the wrong thing.
What drives the price
Traditional penetration tests are priced on effort: how many tester-days the work will take. Everything that changes effort changes price.
- Scope size. The number of applications, user roles, API endpoints, IP addresses and cloud accounts.
- Depth. An unauthenticated external test is quicker than an authenticated test covering every role and workflow.
- Type of test. Web apps, APIs, mobile apps, internal networks, cloud configuration and social engineering each need different skills.
- Reporting and retesting. Many firms charge separately for retesting fixed issues.
- Compliance requirements. Tests that must satisfy PCI DSS or specific customer contracts can involve extra documentation.
- Scheduling. Rush engagements often carry a premium.
Typical price ranges
Prices vary by region and provider, but these ranges are commonly quoted for manual consultancy engagements:
| Test type | Common range (USD) | Typical duration |
|---|---|---|
| Small web application | $5,000 to $15,000 | 1 to 2 weeks |
| Complex web app with APIs | $15,000 to $40,000+ | 2 to 4 weeks |
| External network | $3,000 to $15,000 | Several days |
| Cloud configuration review | $5,000 to $20,000 | 1 to 2 weeks |
| Mobile application | $8,000 to $25,000 | 1 to 3 weeks |
Treat these as orientation, not quotes. The real number comes from a scoping call.
Hidden costs people forget
The invoice is only part of the cost. Teams often underestimate:
- Lead time. Waiting weeks for a testing slot can delay a deal or an audit.
- Internal time. Scoping calls, test account setup and answering tester questions.
- Retest fees. Proving fixes to an auditor or customer may cost extra.
- Point-in-time coverage. A test covers the code that existed that week. New releases are untested until the next engagement.
Automated and AI-driven testing changes the math
Automated and AI-assisted pentesting is priced on usage rather than tester-days. Because agents do the repetitive work of recon, crawling, fuzzing and verification, the cost per test drops dramatically, and you can test continuously instead of once a year.
That does not make human expertise worthless. Complex business logic, novel attack chains and high-assurance environments still benefit from experienced testers. But for most startups and SaaS teams, the bulk of real-world findings, such as access control flaws, injection, misconfigurations and exposed secrets, can be found and verified automatically.
How to budget as a startup
- Start with continuous automated testing to catch the common, high-impact issues on every release.
- Fix and retest until critical and high findings are gone.
- Add a focused manual test of your most sensitive workflows when a large customer, regulator or audit requires it.
This order means your expensive manual test is spent on hard problems instead of finding the same easy bugs a tool would catch.
SecurityInfinity starts free with 100 credits, no credit card needed, and you can see pricing for ongoing testing.
Frequently asked questions
Why do pentest quotes vary so much?
Providers estimate effort differently and include different things, such as retesting, report quality and tester seniority. Always compare scope, methodology and deliverables, not just price.
Is a cheap pentest worth it?
It depends on what you get. A cheap test that is really an unverified scanner export is rarely useful. A low-cost test that verifies findings and gives clear fixes can be very good value.
How often should I budget for testing?
At least annually and after major changes. Continuous testing spreads the cost and keeps coverage current.