Penetration Testing Cost: What a Pen Test Really Costs

Search for what a penetration test costs and you get numbers immediately. They arrive with confidence, in tidy ranges, broken out by test type and industry, and almost every one of them was published by a company that sells penetration testing, compliance software, or an attack surface product. None of the pages that rank for this question cites a survey, a sample size, or a dataset, because there is not one to cite.

That is not a scandal. It is the shape of the market. There is no unit of penetration testing, no pass mark, and no public register of what anybody paid, so the ranges you read are list ranges from sellers rather than measurements of a market. What follows is every published figure this page could open and attribute, credited to the company that published it, and then the part that actually decides your invoice: the number of days, the seniority of the person spending them, and the size of the boundary you drew.

How Much Does a Penetration Test Cost?

The honest first answer is that nobody publishes an authoritative figure, and the second is that plenty of companies publish their own. Both facts matter, so here are the numbers as they were stated on 9 September 2026, each one credited to the page it came from.

Read that table as five opinions rather than five measurements. They overlap because the companies read each other, and they diverge because each one is describing the work it happens to sell. Do not average them. An average of five list ranges from five sellers is a number with no referent, and quoting it back to a provider will not get you a better price.

What you can take from the table is a shape. Small, tightly bounded engagements against a handful of internet-facing systems sit at the bottom. A single web application with several user roles sits in the middle. Multi-environment work, red teaming, and anything involving physical locations or a regulated industry's evidence requirements sits at the top and keeps going. That shape is consistent across all five publishers, and it is consistent because it follows from how many days the work takes.

Why Penetration Testing Prices Are So Hard to Compare

Three structural facts make this purchase resistant to price comparison, and none of them is going away.

There is no unit of work. A penetration test is not a quantity of anything. Two firms quoting the same application can propose 5 days and 12 days, and both proposals can be professionally defensible, because one is checking the authenticated application surface against a standard checklist and the other is chaining business logic flaws across user roles. The proposals look alike on the cover page and describe different exercises. Understanding what a penetration test actually is is the prerequisite to reading either one.

There is no pass mark and no certificate. Nothing external validates the output, so a provider cannot be held to a defined standard of thoroughness by anything except the contract you wrote. This is the difference between buying a penetration test and buying an audit: an audit has an opinion and a profession behind it, and a penetration test has a report and a reputation.

You write the scope, so you set most of the price. The provider prices what you named. If you name three IP addresses, you get a cheap test of three IP addresses, and the number will look excellent next to a competitor pricing your entire estate. Comparing those two quotes on price alone is comparing a coffee to a dinner.

What Drives the Cost of a Penetration Test

The best public account of what makes an assessment expensive was not written by anyone selling one. NIST's Technical Guide to Information Security Testing and Assessment sets out the scoping elements that determine how many resources an assessment consumes, and they map cleanly onto a quote.

Size. NIST counts it in components and in network size: a single database against all user systems against an entire architecture, and the number of network locations a tester physically has to plug into. Every physical site in scope adds travel and a day that produces no findings.

Complexity. NIST's language is that more heterogeneous environments generally require larger amounts of resources, because more diverse skill sets and tools are needed. This is why an estate running one cloud platform and one framework prices below an estate of the same size running four of each. Complexity is not a synonym for size, and it is the driver buyers underestimate most.

Whether sampling is feasible. NIST notes it may be much more efficient, and nearly as effective, to port scan a small sample of hosts rather than thousands, especially where those hosts are managed and similarly configured. If your fleet is genuinely uniform, say so in the scope document. It is a legitimate and substantial saving. If it is not uniform, sampling is how a cheap test misses the one machine nobody rebuilt.

The effort each technique demands. NIST is direct that some techniques cost substantially more than others because of the tools required and the hours of staff time needed, and that a skilled assessor can spend many hours simply reviewing a system's complete security documentation. On penetration testing specifically, the guide says it can be invaluable but that it is labor-intensive and requires great expertise to minimize the risk to targeted systems.

Two further drivers sit outside NIST's list and move real money.

How much the tester is told. GSA's published penetration test procedure names gray box as its accepted penetration testing standard, and gives the reasoning in cost terms: the gray box approach lets ethical hackers save time by working with developers and system administrators to understand how target systems function, while an attacker has to spend that time on research instead. Buying black box testing means paying a specialist to rediscover facts you already have written down. There are reasons to do it, and the honest one is that you want to measure the research phase, not that black box is more rigorous.

Whether your own staff know it is happening. NIST warns that covert testing is often time-consuming and costly because of its stealth requirements, since a team operating covertly has to slow its scans and other actions to stay under the radar of the organization being tested. That deliberate slowness is billable. A covert engagement measures your detection and response, and it costs more for the same coverage than an announced one.

Penetration Testing Cost by Type of Test

Test type is the dimension every publisher breaks out, and the ranges below are each one company's stated figures rather than a market rate. All five pages were read on 9 September 2026.

The pattern underneath those numbers is worth more than the numbers. External network testing is the cheapest per asset because the surface is small, enumerable and standardized, and a competent tester covers a modest address range quickly. Internal testing costs more for the same host count because the tester has to be placed inside the network, and because lateral movement across a domain is a research exercise rather than a checklist. Web applications and APIs price by the count of user roles and business logic paths rather than by the count of servers, which is why an application on a single host can cost more than a hundred machines on a flat network. Cloud work prices for identity relationships, since the question there is whether one compromised workload reaches the rest of the account.

The type nobody puts in the first scope is the one that most often decides an incident. A social engineering test prices low relative to network work and is routinely cut from a first purchase to protect the budget, which leaves the cheapest route in untested.

How Assessor Day Rates Set the Floor

Underneath every quote is a person and a number of days. The person's cost is the one figure in this entire market that a government statistical agency actually publishes.

A consulting firm does not bill payroll. It bills a rate that has to carry the salary, employer taxes, benefits, tooling, sales, insurance, unbilled time between engagements, and the training that keeps a tester employable. Professional services firms in this market commonly work to a multiple of two or more on direct salary cost, and utilization below 100 percent is a certainty rather than a risk, so the billed hour sits well above the paid hour. That arithmetic explains why a genuinely staffed week of senior testing is expensive, and why an engagement priced below the cost of the labor it claims to contain is either automated, offshored to a materially cheaper labor market, or staffed by someone at the bottom of that BLS distribution.

Use it this way, and only this way. Ask a provider how many testing days the quote contains and how many of those are manual rather than tool time. Divide the fee by the days. If the resulting day rate is far below what a skilled specialist's employer would need to charge, the quote is telling you something about the staffing that the proposal document is not. This is a test of internal consistency, not a price prediction, and it does not tell you what the work should cost in your market.

What Is Included in a Penetration Testing Quote

The line items below are what a complete engagement contains. A quote missing any of them is not cheaper, it is smaller, and the difference tends to appear at the worst moment.

What sits outside the fee is consistent across the industry. Remediation is yours: the firm that finds it usually cannot fix it without a separate contract, and letting the tester sell you the repair creates an obvious conflict. Your own engineers' time is the invisible half of the total and never appears on anyone's invoice. Anything outside the scope you wrote is untested and unreported. And a retest bought after the fact costs far more than a retest written into the original statement of work, which is the single most common gap when the purchase itself is rushed to hit a customer deadline.

Two quotes with identical totals can differ by thousands of dollars in real terms on retesting alone. Ask for it as a line item, priced separately, so you can see it.

Why the Cheapest Penetration Test Is Usually a Scan

SecurityMetrics puts a number on this and it is the most useful sentence on its page: anything under $4,000 is probably not a genuine penetration test. The reasoning is arithmetic rather than snobbery. Below that figure there is not enough labor in the engagement for a person to have done much, so what you are buying is an automated tool run with a report template on top.

That is a real product with a real purpose. It is just not the product you were quoted for. Vulnerability scanning checks for the possible existence of known weaknesses; NIST's guide draws the line precisely, noting that a scanner checks only for the possible existence of a vulnerability while the attack phase of a penetration test exploits it to confirm the vulnerability exists. Confirmation is the expensive part, and it is the part a customer or an auditor is asking for.

If the budget genuinely is not there this year, the honest alternative is not a cheap test. It is free scanning plus a plan. CISA states that its Cyber Hygiene services are available at no cost, covering vulnerability scanning of internet-facing assets and web application scanning, and that US federal, state, local, tribal and territorial governments along with public and private sector critical infrastructure organizations are welcome to enroll. CISA also conducts risk and vulnerability assessments at federal agencies, private organizations, and state, local, tribal and territorial governments. Availability is limited and the queue is real, but the price is zero and the findings are genuine.

How Often Do You Need a Penetration Test?

This is the question that turns a purchase into a budget line, and for many US companies the answer is written into regulation rather than chosen.

Where no regulation applies, NIST's position is a reasonable default and it is stated in cost terms: because of its high cost and potential impact, the guide says penetration testing of an organization's network and systems on an annual basis may be sufficient, and recommends less labor-intensive testing on a regular basis in between, describing a program of regularly scheduled network and vulnerability scanning interspersed with periodic penetration testing. The federal practice matches. GSA requires a full penetration test annually for FISMA High Value Assets and for FIPS 199 High systems.

GSA also publishes the scoping idea that saves the most money for anyone shipping software continuously. Its Delta penetration test is scoped to the changes made to an application rather than to the whole application, which is how you get meaningful testing after a release without repurchasing a full engagement every quarter.

Is a Penetration Test Worth the Cost?

The honest answer is that no one can compute this for you, and the pages that try are doing arithmetic on two numbers that do not belong in the same equation.

The number they reach for is real enough. IBM's Cost of a Data Breach research puts the global average cost of a data breach at $4.99 million, a 12 percent increase over the previous year and a record high. Setting a $15,000 test against a $4.99 million average produces an impressive ratio and no information. The average is drawn from breached organizations of every size across many countries, most of them far larger than the company reading this page, and a penetration test does not reduce breach probability by any measured amount that anyone has published.

What the money actually buys is narrower and easier to defend. It buys a list of confirmed, reproducible ways into a defined part of your estate, produced by someone who was trying, at a moment in time. It buys the evidence a customer's vendor risk team or a SOC 2 report reviewer is asking for. And it buys the internal argument: an engineering team that has watched a stranger walk through its authentication in an hour fixes things that a policy document has failed to get fixed for two years.

How to Compare Penetration Testing Quotes

Price comparison fails on this purchase. Structure comparison works, and it takes about an hour.