A traditional penetration test from a strong firm commonly costs somewhere between $10,000 and $30,000 per engagement. The range is that wide because the work is priced in expert hours, and the number of hours depends on five things that vary enormously between one application and another.
That figure is also why so many organisations test once a year and call it a programme. It is not negligence, it is a budget line.
The five things that move the price
- Scope size. How many applications, how many APIs, how many distinct user roles. Roles matter more than people expect: testing authorisation properly means attempting to cross every boundary between every pair of roles, and that grows faster than the role count.
- Depth. A surface review of the login flow and a full attempt at chained exploitation are different products sold under the same name. This is the factor most often quietly reduced to hit a target price.
- Test type. Web application, API, network, mobile, and social engineering all carry different effort profiles. Black box costs more for less coverage, because the tester spends billable hours rediscovering what you could have handed over. See types of penetration testing for how each of those is scoped differently.
- Environment complexity. Single-tenant is simpler than multi-tenant. A monolith is simpler than forty microservices. Anything requiring bespoke setup, VPN access, or test-data provisioning adds hours before testing starts.
- Retest. Whether re-running the successful attacks after your fixes is included, or billed again later, or quietly absent.
Typical market ranges
Treat these as orientation rather than quotes. They reflect commonly observed market pricing and every one of them moves with the five factors above.
| Engagement | Commonly quoted range | What you usually get |
|---|---|---|
| Single small web app, grey box | Low thousands | One application, limited depth, often no retest |
| Standard web app plus API | Mid five figures and below | Real depth on a defined scope, report and retest |
| Elite manual engagement | $10k to $30k | Deep, named testers, thorough reporting |
| Full-scope multi-app programme | Well above $30k | Several applications, repeated through the year |
The pricing model matters more than the number
Two quotes with the same figure can carry very different risk.
Day rates look transparent and transfer scope risk to you. If the estimate was ten days and the application turns out to be more complex, the overrun is yours. You also cannot compare two day-rate quotes meaningfully, because a day of a specialist and a day of a junior are both a day.
Fixed price after scoping puts that risk on the vendor. It requires them to actually look at your application before quoting, which is itself informative. This is the model we use: scope the engagement properly, then one number, no open-ended day rates.
The question that reveals the most about a quote: what happens if the tester finds something significant halfway through and following it takes longer than planned. If the answer is a change order, you were given an estimate, not a price.
Why the traditional number is what it is
None of this is vendors overcharging. A skilled application tester is genuinely expensive and genuinely scarce, and a thorough engagement is genuinely weeks of their attention. The price reflects the labour honestly.
The consequence is what deserves scrutiny. Because it is expensive, it happens rarely. Because it happens rarely, everything you deploy between tests is untested. And because it is priced by the hour, scope gets trimmed until the number fits - which is a decision about what will not be examined, made before anyone looks.
That is the constraint we set out to remove rather than discount: when the marginal cost of another test collapses, you stop rationing coverage and cadence. What that looks like in practice is on the platform page.
Getting an actual number
We do not publish a price list, for a reason that is not evasive: the number depends on the five factors above, and any figure quoted before looking at your application would be either padded or wrong.
What we do instead is scope it in about 45 minutes and send a single fixed price, so you know the full cost before any testing starts. That is a scoping call, not a sales sequence.