Cost guide
Salesforce Penetration Testing Cost
A Salesforce org penetration test starts at $6,800, and AppExchange security review prep for ISVs is $5,200, both fixed in writing before work begins. The org test covers sharing rules, profiles, Experience Cloud guest exposure, custom Apex, and connected apps, with a full report and a free retest.
Small
Org test: one production org or full-copy sandbox, up to about 50 custom objects, one Experience Cloud site, and up to about 10,000 lines of Apex, Visualforce, and LWC.
Medium
Org test: two or more Experience Cloud sites, up to about 30,000 lines of custom code, more integrations and connected apps, or Agentforce and Einstein features in scope.
Large
Org test: several orgs, a large custom codebase, or complex sharing across business units, quoted from the scope.
AppExchange review prep
For ISVs: a Code Analyzer scan with triage and a false-positive document, a manual review of the managed package, and a DAST report on its external endpoints.
What moves the number
What drives the cost of Salesforce penetration testing
Custom objects and sharing model
Org-wide defaults, sharing rules, profiles, and permission sets decide who reads what. More custom objects and a more complex sharing model mean more access paths to test by hand.
Experience Cloud sites
Every customer or partner site exposes records to guest and external users. Each site is tested for what an anonymous or low-privilege user can pull through Aura and GraphQL endpoints.
Custom code
Apex, Visualforce, and LWC are reviewed for SOQL injection, classes that skip sharing, CRUD and field-level security gaps, and XSS. Up to about 10,000 lines fits Small, up to about 30,000 Medium.
Connected apps and integrations
Connected apps, OAuth scopes, integration users, and installed packages all hold access. More integrations mean more permissions to check for excess reach.
AI features
Agentforce and Einstein features add prompts and actions that can reach records. When they are in scope, the org test moves to the Medium tier.
Org test or AppExchange prep
An org test checks your own Salesforce org. AppExchange prep readies an ISV's managed package for Salesforce's security review. They are separate engagements with separate prices.
In the price
What every Salesforce penetration testing price includes
- ✓Org-wide defaults, sharing rules, profiles, permission sets, and session and login policies, tested by hand
- ✓Guest and external-user record exposure on Experience Cloud sites, tested through Aura and GraphQL endpoints
- ✓Apex, Visualforce, and LWC review for SOQL injection, sharing bypass, CRUD and field-level security gaps, and XSS, plus connected apps and OAuth scopes
- ✓A fixed price agreed in writing before work begins, with no hourly billing
- ✓An executive summary for leadership and a full technical report with reproduction steps (see a sample penetration testing report)
- ✓A free retest of remediated findings, or a recheck of the fixes before your AppExchange submission
- ✓An attestation letter and findings platform access at no extra cost
- ✓Senior in-house testers, no subcontractors or crowdsourced testers
Keep it tight
How to keep the price down
- 01Test in a full-copy sandbox. It mirrors production data and sharing, and it lets us test harder without touching live records.
- 02Provide a read-only admin and a test user for each profile and external role. Access testing is the core of the work, and ready accounts save days.
- 03Scope to the Experience Cloud sites that face customers or partners first. They carry the guest exposure risk, and internal-only features can follow.
- 04For ISVs, book the review prep before your first submission. A failed security review means fixing and resubmitting, which costs more time than preparing once.
Timeline
Onboarding begins within 24 hours of a signed proposal. A Small org test takes 5 to 6 tester days, with the report in about 2 weeks. A Medium org test takes 8 to 10 days and about 3 weeks. AppExchange review prep takes 4 to 5 days over 1 to 2 weeks, finished before your submission. The free retest follows your fixes.
FAQ
Questions about Salesforce penetration testing cost
01How much does a Salesforce penetration test cost?
An org test starts at $6,800, fixed before work begins, with a free retest. Two or more Experience Cloud sites, more custom code, or AI features in scope is $10,500. Several orgs or a large codebase are quoted. AppExchange security review prep for ISVs is $5,200. Every price is on the pricing page.
02Do we need Salesforce's approval before testing?
No. Since January 31, 2023, Salesforce customers no longer need prior approval or advance notice to run a security assessment of their own org. The testing must follow Salesforce's Security Assessment Agreement, which sets the rules, and we work inside it. If we find an issue in the Salesforce platform itself, rather than in your configuration or code, it is reported to Salesforce as the agreement asks.
03Why not use a free automated Salesforce scan?
A scan reports settings. It does not prove what a guest user can actually read from your Experience Cloud site, whether a custom Apex class skips sharing, or what one connected app can reach. We test those by hand, with accounts for each role, and report what an attacker gets.
04Do you test production or a sandbox?
A full-copy sandbox is best, because it mirrors production sharing and data and we can test harder. Where production is the only option, we agree safe methods and windows in writing first and use test accounts, not real users.
05What does AppExchange security review prep include?
A Code Analyzer scan with the findings triaged and a false-positive document written, a manual review of your managed package for access control, injection, secrets, and OAuth handling, and a DAST report on any external endpoints the package calls. We recheck your fixes before you submit. The price is $5,200. Our guide on passing the Salesforce security review explains what reviewers look for.
06What about custom apps built outside Salesforce?
A web app or portal you host yourself is a web application penetration test, from $5,200. Its integration with Salesforce, the connected app and its OAuth scopes, is covered in the org test. Our article on malicious connected apps explains why those scopes matter.
Other cost guides
Web Application Penetration Testing Cost
From $5,200API Penetration Testing Cost
From $4,000Mobile Application Penetration Testing Cost
From $6,000Red Team Assessment Cost
From $12,500Cloud Penetration Testing Cost
From $6,800External Network Penetration Testing Cost
From $4,200Internal Network Penetration Testing Cost
From $6,000Secure Code Review Cost
From $4,800AI and LLM Penetration Testing Cost
From $4,500Phishing and Social Engineering Testing Cost
From $3,600Hardware and IoT Penetration Testing Cost
From $5,200Vulnerability Scanning and Assessment Cost
From $1,500Microsoft 365 Security Assessment Cost
From $4,200Physical Penetration Testing Cost
From $6,800Wireless Penetration Testing Cost
From $3,800Thick Client Penetration Testing Cost
From $6,000Get the exact number for your scope
Tell us what needs testing. You get a written fixed price within one business day, and the number does not move once testing starts.
Prefer the full scoping questionnaire?Get a Fixed-Scope Quote
Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.