Two penetration test quotes for what sounds like the same job can differ by a factor of five. Usually neither vendor is being unreasonable. They have priced different scopes, different depths of testing and different deliverables, and the quote rarely makes that obvious.
This guide sets out the ranges testing firms publish for 2026, explains what actually drives the number, and shows how to scope a test so you pay for what your customers, auditors or insurers are really asking for.
The figures below are market ranges from published rate cards, not a quote from us. Your scope decides your price.
Price Ranges by Type of Test
| Type of test | Typical 2026 range | Typical duration |
|---|---|---|
| External network — internet-facing systems | $5,000 – $20,000+ | Days to 2 weeks |
| Internal network — as an attacker already inside | $7,000 – $35,000+ | 1 to 2 weeks |
| Web application | $5,000 – $30,000+ | 3 days to 3 weeks |
| Cloud environment | $10,000 – $40,000+ | 1 to 3 weeks |
| Red team exercise | $50,000 – $150,000+ | Several weeks |
Most small and mid-sized businesses need the first two, and a web application test only if they build or host an application that handles customer data. Red team exercises are for mature security programmes and are rarely the right first purchase.
What Actually Moves the Quote
How much there is to test
The number of external IP addresses, internal subnets, applications and user roles. Scope is the biggest single driver, and the easiest place to overbuy by including systems nobody is asking about.
How much the testers are told
A black-box test starts with nothing, a grey-box test with a normal user account, a white-box test with documentation and access. Grey box is usually the best value because testers do not burn days on reconnaissance.
Whether fixes get verified
A retest after remediation proves the findings are closed, and it is often what an auditor or customer actually wants to see. Some quotes include it; many do not.
What you receive at the end
A readable executive summary, reproducible findings with evidence, compliance mapping and an attestation letter all take tester time. They are also the parts you will hand to other people.
The Quote That Is Too Low to Be Real
The cheapest “penetration tests” are often an automated scan with a new cover page. The output looks thorough, pages of findings sorted by severity, but no person has tried to exploit anything, chain weaknesses together or rule out false positives.
There are three quick ways to tell the difference before you sign. Ask for a redacted sample report and look for evidence of manual work: screenshots, step-by-step attack paths, findings that could only come from a human. Ask how many tester hours or days the price includes. And ask who will do the work and what hands-on credentials they hold.
If what you actually need is a prioritised list of weaknesses rather than proof of exploitation, that is a different service and a cheaper one. Our vulnerability assessments are built for exactly that, and many businesses do one before their first penetration test.
Who Is Asking You for One
Knowing why you need a test is the fastest way to scope it correctly, because each requester cares about different systems.
Card payments. PCI DSS requires penetration testing at least once every twelve months and after significant changes, covering the systems in its scope.
SOC 2 and customer security reviews. Not strictly mandated by the framework, but auditors and enterprise customers commonly expect an annual third-party test. Our SOC 2 work scopes it to the systems in the audit boundary.
Cyber insurance. Some carriers ask about recent testing on applications and renewals. It is one of several controls they weigh, alongside those covered in our guide to cyber insurance IT requirements.
How to Scope One Without Overpaying
- Start from the requester. Get the exact wording of what the customer, auditor or insurer asked for, and let that set the scope.
- List the targets precisely. External IPs and domains, internal networks, applications and user roles. Vague scope produces padded quotes.
- Choose grey box by default. Provide a standard user account and basic documentation so testing time goes on testing.
- Get retesting in writing. Confirm one round of retest is included, and the window for completing fixes.
- Compare like with like. Line up quotes by scope, tester days, retest and deliverables, not by the total at the bottom.
Penetration Testing Questions, Answered
Related reading: What Is EDR? · CCPA Compliance in 2026 · Dark Web Monitoring for Business
Want Help Scoping the Right Test?
Tell us who is asking for a penetration test and what they need to see. We will help you scope it tightly, coordinate the testing and fix what it finds.