Estimate
Penetration Testing Cost Calculator
Pick the tests you need and a size for each. The calculator adds up our published starting prices, so you have a budget figure before scoping. Send the scope and you get a written fixed price within one business day.
Every published price
Starting prices by service and size
The same figures the calculator adds up. A + means the size has no ceiling. Quoted sizes are priced from the scope.
| Service | Size | From |
|---|---|---|
| Web Application Penetration Testing | Small | $5,200 |
| Medium | $7,800 | |
| Large | $12,500+ | |
| API Penetration Testing | Small | $4,000 |
| Medium | $6,000 | |
| Large | $9,500+ | |
| Mobile Application Penetration Testing | Small | $6,000 |
| Medium | $8,500 | |
| Large | $14,000+ | |
| Red Team Assessment | Small | $12,500 |
| Medium | $17,000 | |
| Large | $29,000+ | |
| Cloud Penetration Testing | Small | $6,800 |
| Medium | $10,500 | |
| Large | $17,500+ | |
| External Network Penetration Testing | Small | $4,200 |
| Medium | $6,800 | |
| Large | $8,400 | |
| Internal Network Penetration Testing | Small | $6,000 |
| Medium | $9,200 | |
| Large | $14,500+ | |
| Secure Code Review | Small | $4,800 |
| Medium | $8,900 | |
| Large | $12,000 | |
| AI and LLM Penetration Testing | Small | $4,500 |
| Medium | $7,500 | |
| Large | $12,000+ | |
| Phishing and Social Engineering Testing | Small | $3,600 |
| Medium | $5,500 | |
| Large | $8,500 | |
| Hardware and IoT Penetration Testing | Small | $5,200 |
| Medium | Quoted | |
| Large | Quoted | |
| Vulnerability Scanning and Assessment | Up to 250 devices | $1,500 |
| 251 to 1,000 devices | $2,500 | |
| Microsoft 365 Security Assessment | Small | $4,200 |
| Medium | $6,800 | |
| Large | Quoted | |
| Physical Penetration Testing | Small | $6,800 |
| Medium | $10,500 | |
| Large | Quoted | |
| Wireless Penetration Testing | Small | $3,800 |
| Medium | $5,500 | |
| Large | Quoted | |
| Thick Client Penetration Testing | Small | $6,000 |
| Medium | $9,200 | |
| Large | Quoted | |
| Salesforce Penetration Testing | Small | $6,800 |
| Medium | $10,500 | |
| Large | Quoted | |
| AppExchange review prep | $5,200 |
- Active Directory security assessment: $6,000 for one domain, the same as the internal network Small tier, so it is not added separately above.
- Vulnerability scanning of more than 1,000 devices is quoted from the scope.
- Penetration testing as a service is one fixed annual price, built from the prices above.
- Smart contract and blockchain work is scoped and quoted. See blockchain penetration testing.
All figures are in USD. Prices current as of September 2026.
In every price
What the estimate already covers
- A fixed price agreed in writing before work begins, with no hourly billing
- An executive summary and a full technical report
- An attestation letter and findings platform access
- A free retest of remediated findings (phishing campaigns, which have no findings to retest, excepted)
- Onboarding within 24 hours of a signed proposal
FAQ
Questions about the estimate
01How accurate is the estimate?
It adds up the published starting price for each size you pick, so it is a sound budget figure for a typical scope of that size. Your written fixed price comes from your actual scope and can differ, for example when a target sits between two sizes. The written quote is the number you pay, and it does not move once testing starts.
02Does the calculator include a bundle discount?
No. It adds the published prices as they are. Multi-test engagements and recurring programs can be priced more favorably once scoped, because scoping and onboarding happen once. That shows up in the written quote, not in this estimate.
03Which size should I pick?
Each size lists what it typically covers, such as the number of roles, endpoints, hosts, SSIDs, or users. Pick the closest match. If you are unsure, pick the smaller size and say so when you send the scope. We confirm the size during scoping.
04Why do some sizes say quoted?
Some scopes depend on things we can only see during scoping, such as a complex device on the bench, several physical sites, or a large tenant. Those sizes add nothing to the total here, and the summary flags them so you know part of the scope still needs a number.
05Is the retest included in the estimate?
Yes. Every penetration test includes a free retest of remediated findings, with the report updated to show them closed. Phishing campaigns are the exception, because they measure behavior and produce no technical findings to retest.
06What happens after I send the scope?
You get a written fixed price within one business day, with no sales call required. Onboarding begins within 24 hours of a signed proposal, and testing typically starts within a week of scoping. See every starting price on the pricing page.
Turn the estimate into a fixed price
Tell us what needs testing. You get a written fixed price within one business day, and the number does not move once testing starts. The "Add to the quote form" button in your estimate copies your picks into the message. Review it, then send.
Get your fixed price
Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.