You send the same paragraph to three firms and get back three proposals whose prices are nowhere near each other. All three say penetration testing services. One is a subscription to an automated scanner with a report template on top. One is two testers spending eight days on your web application by hand. One wants to phone your accounts payable clerk and try the side door of your office at seven in the morning.
None of them is lying. The phrase describes an exercise, not a product, and the exercise is defined entirely by the scope you wrote and the contract you sign. Buyers who get value from this purchase do one thing differently: they decide what question the test has to answer before they ask anyone to price it.
What Penetration Testing Services Include and Exclude
Federal regulation gives the cleanest definition anyone has written. Under the FTC Safeguards Rule, penetration testing means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems. Attempting to defeat is the operative phrase. You are buying an attempt, run by a person, inside a boundary you drew.
A standard engagement includes four things. Scoping, which is a conversation and a document rather than a formality. The testing window, usually one to three weeks of a named person's time. A written report with each finding rated, evidenced and reproducible. And a debrief where somebody walks your engineers through what happened, which is the part junior buyers skip and later regret.
What the fee does not include is where the surprises live:
- Remediation. The firm that finds it usually cannot be the firm that fixes it without a separate contract, and letting the tester sell you the fix creates the obvious conflict.
- Retesting, unless you bought it. This is the single most common gap in a signed statement of work, and it becomes visible at the worst moment, when a customer wants proof the critical finding is closed.
- Anything outside the scope you wrote. A test of your production web application says nothing about the marketing site, the staging environment or the laptop fleet.
- Systems you do not own. GSA's own penetration testing procedure puts it plainly: testing interconnections with third party entities is considered out of scope until the third party agrees to an assessment. Your cloud provider, your payroll platform and your customer relationship manager are somebody else's estate.
- Monitoring. A test is a photograph. Watching your systems continuously is a different purchase with a different economic model, which is what managed detection and response is for.
- A certificate. There is no penetration testing pass mark, no registry, and no badge that means anything. A firm offering one is selling reassurance.
The mechanics of the exercise itself, the phases, the legal authorization and the difference from a scan, sit in the explainer on what a penetration test actually is. This page is about the purchase.
Types of Penetration Testing Services You Can Buy
Providers all publish the same menu, and the menu is not the hard part. Choosing which item answers the question keeping you awake is the hard part.
| Service | What it answers | Buy it when |
|---|---|---|
| External network test | What can someone reach from the internet with no access at all | You have never had one. This is the default first purchase |
| Internal network test | How far a stolen laptop or a contractor's connection reaches | Your network is flat, or an outsider has any foothold at all |
| Web application and API test | Whether your product itself can be abused by its own users | You sell software, or the application holds customer data |
| Cloud configuration review | Whether one compromised workload or identity reaches the rest of the account | Your estate is mostly in AWS, Azure or Google Cloud |
| Wireless test | Whether the guest network is genuinely separate from the corporate one | You have offices with staff and visitors on the same premises |
| Physical test | Whether someone walks in, plugs in and walks out | You hold sensitive material on site and reception is the only control |
| Social engineering test | Whether your people can be talked into access | The rest is solid and you want the honest answer about the common route in |
| Red team engagement | Whether your detection and response notice a real intruder | You already have a security team whose work needs testing |
Two axes cut across that list and change the price more than the item does. The first is how much the tester is told. GSA runs gray box as its accepted standard, giving the test team a network diagram, the system security plan and one account per role, on the reasoning that this saves the tester time that a criminal would happily spend on research anyway. The second is whether your own staff know it is happening. A test your engineers can see is a training exercise. A test they cannot see is a measurement of your response, and it needs a named person who can stop a genuine incident call at two in the morning.
What a Penetration Testing Engagement Looks Like End to End
Nothing in the sales material tells you that a test bought in March cannot report in March. Scoping takes a week of back and forth, testers are booked weeks out, and the report is written after the window closes.
- Scoping call and a written scope. Asset list, exclusions, objectives, and how many days of testing that adds up to
- Statement of work and rules of engagement signed by someone with the authority to authorize testing on every asset listed
- The wait. Good testers are booked out, and a firm that can start tomorrow is telling you something about its bench
- Kickoff call. Contacts confirmed, source addresses shared with your team, escalation threshold agreed
- Reconnaissance, discovery, exploitation. One to three weeks, with critical findings reported as they are confirmed rather than saved for the report
- Draft report, then a debrief where your engineers can argue with the severity ratings
- Remediation, which is yours to do, then a retest against the original findings if the contract included one
The escalation path inside that window is worth settling before it is needed. GSA's procedure has the test team report a high-risk finding to the system owner immediately, and the system owner in turn agrees not to modify the system until the end of the assessment or until the test team approves it. That second half surprises people. Patching the hole the moment you hear about it sounds responsible and it destroys the rest of the test, because the tester is midway through proving how far that hole reaches.
The other stop condition is the one nobody plans for. If a tester finds evidence that somebody else is already inside, the engagement pauses and becomes an incident. GSA's rule is that testing halts immediately, the finding is reported, and testing resumes only once the incident is resolved. Name the person who takes that call in the contract, and make sure your incident response plan does not assume the only intruder that week is the one you hired.
How Penetration Testing Companies Differ From Each Other
Firms selling this work fall into five shapes. They are not ranked here, because the right shape depends on what you are testing and what you can supervise.
| Provider shape | Strength | What to watch |
|---|---|---|
| Boutique specialist, 5 to 40 testers | Named senior people, deep in one domain, willing to argue with your engineers | Capacity. The person who sold you the engagement may be the person testing it, and they are booked |
| Large consultancy | Breadth, multi-country coverage, familiar to your auditors and your board | Who actually does the work. Ask whether the testers are employees, and how junior the bench is |
| Testing platform subscription | A portal, continuous scheduling, findings you can track and retest cheaply | The share of the work that is a scanner. Ask for the manual testing days in writing |
| Managed provider add-on | Convenience, and one supplier to manage | Independence. A firm testing the controls it also installed and monitors is grading its own homework |
| Scan reseller | Price | Whether a human tested anything. This is the category the market's bad reputation comes from |
Two questions separate any two proposals faster than a feature comparison. Who performs the test, by name, and what proportion of the days are manual rather than tool time. NIST's testing guide is direct about the qualifications that matter: assessors need expertise across network security, operating systems, programming and protocols, and operational experience is preferred to classroom or laboratory training. Certifications are a filter for that experience, not a replacement, and they belong to individuals rather than to firms. A proposal that lists the company's accreditations but will not name the testers is describing a sales team.
Independence is the other differentiator, and there is a workable definition to hold providers to. GSA defines independent testing as testers who are free from any perceived or actual conflicts of interest regarding the development, operation or management of the systems being tested. Read that against a proposal from the firm that built your application, and the problem is obvious without anyone being accused of anything.
What Drives the Price of a Penetration Test
The unit of this purchase is a tester day, and everything in a quote is a claim about how many of those days your scope needs. NIST puts the reason for the cost in one line: penetration testing is labor intensive and requires great expertise to minimize the risk to targeted systems. You are renting somebody's judgment, and judgment does not get cheaper at volume.
What moves the number:
- Days of manual testing, which is the whole line item wearing a costume. Two testers for eight days is sixteen days regardless of how the invoice is presented.
- The count of live things, meaning applications, user roles, external addresses, cloud accounts and physical sites. Roles matter more than people expect, because each one is a separate set of permission tests.
- Whether authenticated testing is included. Testing as a logged-in user of each type finds far more, and costs more, than knocking on the front door.
- Reporting depth and audience. A report your auditor and your enterprise customer will both read takes real writing time.
- Retest terms. Included, priced separately, or time limited to thirty days you will not meet.
- Compliance overhead. An engagement that has to satisfy a specific requirement carries evidence and attestation work that pure testing does not.
Anyone quoting a firm price before seeing your asset list is quoting a scan. The honest sequence is a scoping conversation, then a number.
Questions to Ask Before You Sign a Penetration Testing Contract
Seven questions do most of the filtering, and they can be sent as an email before anyone books a call.
That last question has a standard behind it. NIST notes that some organizations prohibit third-party assessors from having any access to assessment data once their final reports have been submitted, and that in such cases a qualified individual from the assessed organization should verify that the sanitization was actually carried out. Your engagement data is a map of exactly how to break in, and it is worth knowing where the copy lives.
Two answers should end the conversation. A firm that guarantees it will find vulnerabilities, or promises a clean report, is describing an outcome no honest tester controls. And a firm that will not put the scope in writing before invoicing is not selling an engagement.
Contract Terms That Matter in a Penetration Testing Agreement
The statement of work and the rules of engagement are where the money you spent turns into something you can use. GSA requires the rules of engagement to be completed and signed by key personnel before testing, so there is a common understanding of the limitations, constraints, liabilities and considerations on both sides. That is the right standard for a private buyer too.
The terms worth arguing over:
Scope and exclusions, itemized. Every address, application, account and site, and an explicit list of what is out. Ambiguity here is resolved in the tester's favor at the time and in nobody's favor afterwards.
Authorization by someone entitled to give it. Testing without it is a federal crime, and you cannot authorize testing on infrastructure you do not own. Cloud platforms publish their own rules for customer testing, and a partner network needs that partner's signature, not yours.
The window, in hours as well as dates. Overnight testing avoids disruption and delays your ability to reach anyone when something breaks. Pick deliberately.
Denial of service, in or out. GSA does not authorize denial of service testing in its standard exercises and requires separate approval where it is needed. Most commercial contracts should exclude it by default, because the finding it produces is rarely worth the outage.
The escalation threshold. Which severity triggers a call rather than a line in the report, who receives it, and the agreement about not remediating mid-window without the tester's sign-off.
The deliverable, defined. A report containing severity ratings, reproduction steps, evidence and remediation guidance, plus an explicit statement of what was not tested. GSA rates findings using CVSS, which is a reasonable requirement to write into a contract so that severities can be compared with everything else in your risk register.
Retest scope and deadline. What is retested, whether it is a fresh test of the finding or of the system, and how long you have.
Data handling and destruction, with a named verification step.
Liability and insurance. NIST's guidance is that external entities should be properly vetted for skills, experience and integrity, and asked to assume some of the risk in that they may be responsible for damages incurred by the organization being assessed. In practice that means professional liability cover you have seen a certificate for, and a limitation clause you read before signing rather than after an outage.
Do You Need a Penetration Test Right Now?
For some readers this is not a choice. Companies covered by the FTC Safeguards Rule, which includes mortgage brokers, finance companies, collection agencies, tax preparers and investment advisors among other non-banking financial institutions, must either run effective continuous monitoring or conduct annual penetration testing plus vulnerability assessments at least every six months. Merchants and service providers under PCI DSS requirement 11.4 test annually and after significant change. Nothing in a SOC 2 report demands one by name, and auditors and enterprise customers ask anyway.
For everyone else it is a judgment about sequence, and the case for testing sooner has gotten stronger. The 2026 Verizon Data Breach Investigations Report found that exploitation of a vulnerability is now the way into 31 percent of breaches, passing stolen credentials as the top entry point for the first time in 19 years. Exploited vulnerabilities are what an external test is designed to find.
How to Read a Penetration Test Report
Read the scope statement first, before the findings. It tells you what the rest of the document is entitled to claim, and a clean report on a narrow scope is a statement about that scope and nothing else.
Then check that each finding carries four things: what it is, how the tester proved it, what a real attacker gets from it in business terms, and what specifically to change. Severity ratings should use CVSS or an equally explicit scale, and the reproduction steps should be detailed enough that your engineer can reproduce the finding without emailing anyone. Where a report says "apply the vendor patch" and stops, you are reading a scan.
The tell for automated work dressed as an engagement is uniformity. Every finding is a version number matched against a database, no finding describes a chain of two or three weaknesses adding up to a route, and nothing in the document could not have been produced without logging in. A genuine report has at least one finding that only exists because a person got curious. Cross-check the findings against your vulnerability scanning output too: anything the scanner already reported months ago is a process failure worth more attention than the finding itself.
Key takeaways
- Penetration testing services cover scoping, a testing window, a report and a debrief. Fixing the findings, monitoring afterwards and anything outside the written scope are not included.
- You cannot authorize testing on systems you do not own, so cloud platforms, SaaS tenants and partner networks need their owner's permission.
- Plan six to ten weeks from first call to final report. Scoping, the queue for a good tester and report writing all take real time.
- Normalize competing quotes to manual tester days for the same asset list. Price per address rewards the provider planning to spend the least time.
- Ask who tests by name, what proportion is manual, which methodology, and for a redacted sample report. Those four answers separate the market.
- The rules of engagement carry the terms that matter: scope, authorization, window, denial of service, escalation threshold, retest, data destruction and liability.
- The FTC Safeguards Rule requires annual testing for covered financial institutions absent continuous monitoring, and PCI DSS requires it annually. SOC 2 does not, and buyers ask anyway.
- Read the scope statement before the findings. A clean report on a narrow scope says nothing about anything outside it.
Common questions
What are penetration testing services?
Engagements in which an outside specialist attacks your systems with written authorization and reports what they reached. The purchase covers scoping, a fixed testing window, a written report with rated findings, and a debrief. The FTC's Safeguards Rule defines the activity as assessors attempting to circumvent or defeat the security features of an information system.
How much do penetration testing services cost?
There is no published dataset worth quoting, so treat any confident single figure as marketing. The unit is a tester day, and the count of days is driven by manual testing effort, the number of applications, roles, addresses and sites, whether authenticated testing is included, reporting depth and retest terms. Normalize competing quotes to days before comparing them.
How long does a penetration test take?
The testing window is usually one to three weeks. The engagement around it is longer: a week or so of scoping, often several weeks of queue before good testers are free, then one to two weeks for the report and debrief. Six to ten weeks from first call to a report you can hand to a customer is realistic.
What should be in a penetration testing statement of work?
An itemized scope with explicit exclusions, the authorization and who signed it, the testing window in hours as well as dates, prohibited techniques such as denial of service, the escalation threshold for critical findings, a defined deliverable including severity ratings and reproduction steps, retest scope and deadline, data handling and destruction, and the liability terms.
How do I choose a penetration testing company?
Ask who will test by name and what they have done, whether they are employees or subcontractors, how many days are manual, which methodology they follow, and for a redacted sample report. Then check independence: a firm that built, runs or monitors the system has a conflict of interest in testing it.
What certifications should a penetration tester have?
OSCP and the CREST qualifications are the common filters because they require a practical exam rather than a multiple choice paper. Ask for the certifications of the individuals assigned to your engagement rather than the firm's accreditations. NIST's guidance is that operational experience counts for more than classroom training.
Is penetration testing required by law?
Not generally, but it is required by specific rules. The FTC Safeguards Rule requires covered financial institutions to run annual penetration testing and six-monthly vulnerability assessments unless they have effective continuous monitoring. PCI DSS requires annual testing for merchants and service providers. Most other obligations arrive through customer contracts.
Can a penetration test break something?
Yes, which is why the scope, the window and the prohibited techniques are negotiated in advance. Exploiting a vulnerability can cause instability, data corruption or an unintended outage. GSA excludes denial of service testing from its standard exercises for that reason, and most commercial contracts should too unless there is a specific reason to include it.
Do I need a retest after fixing the findings?
If you need to show anyone the findings are closed, yes, and the time to negotiate it is before signing. A retest clause included in the original engagement costs far less than a second engagement, and without one the verification becomes a new sale at the moment you have the least leverage.
Should I hire a local penetration testing company?
Only where the work is physically local: office testing, wireless assessment, or a regulator that expects an on-site presence. Network and application testing is done remotely by everyone. Time zone overlap during the testing window matters more than the distance, because escalation calls happen in real time.
Can the firm that tests us also fix what it finds?
It can, and it should be a separate decision and usually a separate contract. A provider that scopes the test, finds the issues, sells the remediation and then verifies its own work has an obvious conflict. GSA's standard for independent testing is testers free from any perceived or actual conflict of interest regarding the development, operation or management of the systems being tested.
On this page
- What Penetration Testing Services Include and Exclude
- Types of Penetration Testing Services You Can Buy
- What a Penetration Testing Engagement Looks Like End to End
- How Penetration Testing Companies Differ From Each Other
- What Drives the Price of a Penetration Test
- Questions to Ask Before You Sign a Penetration Testing Contract
- Contract Terms That Matter in a Penetration Testing Agreement
- Do You Need a Penetration Test Right Now?
- How to Read a Penetration Test Report
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.