Pricing, fixed and
published

Every engagement is fixed-scope and fixed-price, agreed in writing before we start, so you know the total up front. A focused web application test starts at $5,200 and an external network test at $4,200, while a full red team engagement covering external, internal, phishing, and adversary simulation starts at $12,500. The figures on this page are starting points for each size band; your exact fixed price is confirmed once we have your scope, from the short form or the questionnaire, with no sales call required.

Scope size is the main driver: the number of applications, API endpoints, IP addresses, user roles, or devices in scope. After that, testing depth (black, grey, or white box), whether authenticated testing is required, compliance mapping needs, and turnaround time all affect the number. The section on why two quotes for the same test differ shows how to check that two quotes cover the same work.

Because many of them are automated vulnerability scans presented as penetration tests. A genuine manual assessment involves multiple days of senior tester time, and the economics simply do not allow a few hundred dollars. If a quote is dramatically below market, ask what percentage of the work is manual and who performs it. Our guide to choosing a penetration testing company covers the questions worth asking. If the budget is closer to $1,500, buy an honest vulnerability scan labeled as one: ours is $1,500 for up to 250 devices, validated by an analyst. It will not mislead your auditor or your customers about what was done.

Yes. Every penetration test includes a free retest of remediated findings (phishing campaigns, which have no findings to retest, are the exception) and the final report reflects the verified fixes. Many firms bill this as a second engagement, so it is worth confirming when you compare quotes: a cheaper initial price can end up higher once retesting is added.

Neither. Every engagement is fixed-scope and fixed-price, agreed in writing before work starts. You know the total cost up front, and the number does not move because testing took longer than estimated. If the scope genuinely changes mid-engagement, we agree that with you before anything proceeds.

Yes, for manual testing. Bundled engagements, recurring test windows, and continuous testing programs are priced more favorably than a series of one-off tests, since scoping and onboarding are already done. Recurring vulnerability scans bill at the published per-scan price each cycle. If you expect more than one assessment a year, ask about the continuous testing or enterprise program models above.

Yes. The penetration testing cost calculator adds up the published starting prices for the tests and sizes you pick. It is an estimate before scoping, with no bundle discount applied. Send the scope and the written fixed price is the number you pay.

Compliance-driven tests are priced on the same basis as any other engagement: the scope determines the number, not the framework. What changes is the reporting. Findings are mapped to the controls your auditor examines, and the report is formatted as evidence they accept, which is included rather than charged as an extra. See what SOC 2 penetration testing, PCI DSS penetration testing, and HIPAA penetration testing cover, or read the PCI DSS penetration testing cost by component.

Onboarding begins within 24 hours of a signed proposal, and testing typically starts within a week of scoping. A typical test runs about one week, followed by reporting. Larger or multi-component scopes take longer. If you have an audit deadline, tell us during scoping and we will work backwards from it.