PRICING GUIDE 2026
How Much Does a Penetration Test Cost?
A manual penetration test at Pentestica costs $2,500–$5,500 for a web application or API, from $3,500 for a mobile app (iOS or Android), $5,000–$12,000+ for infrastructure and cloud (AWS and Azure), and from $15,000 for red teaming. A full DORA TLPT is quoted individually. Published US pricing guides quote higher ranges, and the table below compares both.
How we set these ranges
- Pentestica ranges are prices for manual testing of each test type’s standard scope (see what a $2,500–$5,500 web application test includes), quoted in tester-days with no hidden fees.
- US market ranges are aggregated from published US pricing guides: a market benchmark, not a quote. For a side-by-side view of these ranges by test type, see the average cost of penetration testing by test type.
- Where your quote lands inside a range depends on scope, complexity, testing approach and compliance reporting, explained in what drives the price of a pentest.
Last updated: October 2, 2026
Price ranges at a glance
- Web application / API$2,500–$5,500
- Mobile applicationfrom $3,500
- Infrastructure / cloud$5,000–$12,000+
- Red teamingfrom $15,000
Fixed scope, fixed tester-days, fixed price, agreed before testing starts.
Priced in tester-days. No hidden fees. Testing by OSCP, OSCE and CISSP certified pentesters.
Penetration testing prices by test type
Fixed scope, fixed number of tester-days, fixed price agreed before testing starts.
Web Application & API
$2,500–$5,500
5–10 tester-days
- Manual business logic testing
- Full OWASP Top 10 coverage
- API endpoints across all user roles
- Two-part report with exploitation evidence
- Re-test available after fixes
Mobile Application
from $3,500
for a mobile app (iOS or Android)
- Static and dynamic analysis of the binary
- API and backend communication
- Local storage and certificate handling
- Two-part report with remediation steps
Infrastructure & Cloud
$5,000–$12,000+
AWS / Azure, scope dependent
- External and internal network testing
- IAM, storage and network configuration
- Privilege escalation paths
- Findings mapped to your architecture
Red Teaming
from $15,000
red teaming; full DORA TLPT quoted individually
- Objective-driven adversary simulation
- External access, lateral movement and privilege escalation
- Techniques mapped to MITRE ATT&CK
- Detection and response assessment
- DORA-aligned TLPT reporting
External and internal network tests are scoped individually (see network penetration testing for what a network test covers). Ask for a quote and you get a fixed tester-day count and price.
US market rates
roughly two to five times Pentestica’s ranges, with tester-day rates of $850–$2,500.
What moves the price
Scope, complexity, testing approach (black, gray, or white box), compliance reporting, and retesting drive the final number more than the vendor’s logo.
Cheap is not always a scan
A low price is not automatically a scan in disguise. Ask who tests, what certifications they hold, and whether the sample report shows manual exploitation evidence.
Pentestica ranges versus the US market
Approximate EUR and GBP equivalents included for European buyers.
Penetration testing cost at Pentestica starts below the published US market range for every test type with a listed price, and the table adds typical effort in tester-days. Currency figures are rounded from ECB reference rates at the time of writing, so check current rates before budgeting.
| Test type | Pentestica range (USD) | Approx. EUR / GBP | US market range | Typical effort (tester-days) |
|---|---|---|---|---|
| Web application / API | $2,500–$5,500 | €2,100–€4,700 / £1,850–£4,050 | $5,000–$30,000 | 5–10 |
| Mobile app (iOS or Android) | from $3,500 | from €3,000 / £2,600 | $7,000–$40,000 per platform | 5–10 |
| Infrastructure & cloud (AWS/Azure) | $5,000–$12,000+ | €4,250–€10,200+ / £3,700–£8,900+ | $10,000–$50,000 | 8–15 |
| Red teaming (full DORA TLPT quoted individually) | from $15,000 | from €12,750 / £11,100 | $40,000–$150,000+ | 15–30+ |
| External network | Ask for a quote | – | $5,000–$25,000 | 3–8 |
| Internal network | Ask for a quote | – | $7,000–$35,000 | 5–10 |
The effort column is an illustrative estimate, not a quote. An application with many user roles can take twice as long as a small one, so every project is scoped individually. Regional markets differ too; see our guide to penetration testing in Dubai and the UAE for how local regulation shapes pricing there.
What drives the price of a pentest?
Six factors determine penetration testing pricing: scope, complexity, testing approach, compliance reporting, retesting, and tester seniority. All of them translate into the unit most providers bill: tester-days. Published US day rates run $850–$2,500 per tester-day, so the same five-day test can cost $4,250 with one provider and $12,500 with another.
Scope
The number of applications, API endpoints, user roles, hosts, or cloud accounts. This is the biggest multiplier.
Complexity
Multi-step workflows, payment flows, and custom authentication take longer to test by hand than a brochure site.
Testing approach
Black box spends days on reconnaissance. Gray box (credentials plus documentation) is the most efficient for most applications. White box (source code access) finds the most and takes the longest.
Compliance reporting
Mapping findings to PCI DSS, HIPAA, DORA, or NIS2 requirements adds reporting time.
Retesting
Verifying fixes is a separate round. Some providers bundle it, others charge extra.
Seniority
Testers holding OSCP, OSCE, or CISSP cost more per day than junior staff running tools, and find different classes of bugs.
How do pentest pricing models work?
Penetration testing is sold under four common pricing models: a fixed price per engagement, time and materials, a retainer or pool of tester-days, and subscription testing. The models differ in who pays if testing runs over and how predictable your budget is.
| Pricing model | How it works | What it means for you |
|---|---|---|
| Fixed price per engagement (how Pentestica quotes) | The provider fixes the scope, tester-days and total price in writing before testing starts. | Predictable cost. Adding systems later needs a new estimate. |
| Time and materials | You pay an agreed rate for the tester-days or hours actually worked. | Flexible for an unclear scope; the total is known only at the end. Ask for a cap. |
| Retainer or pool of days | You prepay a block of tester-days and use them across tests. | Suits recurring testing of several systems. Check what happens to unused days. |
| Subscription testing (PTaaS) | A monthly or annual fee covers recurring testing through an online platform. | Spreads the cost over time. Ask how much of the testing is manual. |
Compare quotes that use the same pricing model. Pentestica’s fixed price covers a set number of tester-days with no hidden fees, agreed in writing before testing starts.
What does a $2,500–$5,500 web application pentest cover?
A standard web application or API pentest at $2,500–$5,500 covers manual testing of business logic plus the OWASP Top 10, on one application with a defined number of roles and endpoints, and ends with a two-part report. It’s a manual engagement by certified pentesters, not an automated scan with a PDF wrapper.
Included in a $2,500–$5,500 test
- Business logic testing: privilege escalation between roles, broken object-level authorization (IDOR), race conditions, workflow bypasses, and abuse of pricing or transaction logic.
- OWASP Top 10 coverage: injection, broken authentication, session management, access control, and security misconfiguration, tested by hand and confirmed with proof.
- API endpoints tested against the same categories, including authorization across roles.
- A two-part report: an Executive Summary for management and a Technical Report for IT, with the vulnerability list, exploitation evidence, and step-by-step remediation.
- Methodology aligned with OWASP WSTG, PTES, and NIST SP 800-115.
Not included at this price
- Cloud infrastructure review (IAM, storage buckets, network configuration). That’s an infrastructure and cloud audit at $5,000–$12,000+.
- Mobile app binaries. Mobile testing starts from $3,500 for a mobile app (iOS or Android).
- Full source code review.
- Additional applications. Each major module adds days.
Why are Pentestica’s prices below US ranges?
Pentestica’s price sits below US ranges because of scope discipline and cost structure, not automation. The team works from the EU, and a tightly scoped gray box test of one application takes fewer days than the “typical” US engagement, which often bundles several applications and a wider perimeter. Our comparison of penetration testing vs vulnerability scanning spells out the technical difference.
Three pricing scenarios
These scenarios show how scope turns into tester-days and a price within the ranges above. Each mirrors a published Pentestica case study.
SaaS startup with one web app and a REST API
One web application, a REST API with about 40 endpoints, and three user roles fits a gray box test of roughly 5–7 tester-days, which lands in the $2,500–$5,500 web/API range. The team gets a test account per role plus API documentation and concentrates on authorization gaps and core business logic. For comparison, a larger engagement in our API penetration testing case study for a fintech platform ran with two senior pentesters over 10 days and surfaced a critical IDOR and a race condition that allowed double spending.
Medtech platform before a HIPAA audit
A medical SaaS platform preparing for HIPAA and GDPR review typically needs a white box test of the application and API plus a review of the cloud environment holding patient data, roughly 10–15 tester-days, priced in the $5,000–$12,000+ infrastructure and cloud range with the web/API work in scope. Findings are mapped to the relevant HIPAA safeguards so the auditor gets what they need in one document. Our GDPR and HIPAA penetration testing case study describes a comparable engagement with full source code access ahead of an investment round.
E-commerce store before Black Friday
A retailer with a web store, mobile API, and AWS infrastructure usually needs a black box test of the whole attack surface, around 10–15 tester-days in the $5,000–$12,000+ range, scheduled to leave time for fixes and a retest before peak season. In our Black Friday readiness case study, the team breached the perimeter within four days through an SQL injection and a public S3 bucket, and the retest confirmed PCI DSS requirements were met before the sale.
How long does a penetration test take?
A penetration test takes one to three weeks of active testing, plus a few days to write the report. Testing time follows scope; report time is where findings get verified, prioritized, and documented with remediation steps.
| Scope | Active testing | Report delivery |
|---|---|---|
| One web app or API, up to 3 roles | About 1 week | A few days after testing ends |
| Web app plus API plus mobile app | About 2 weeks | A few days after testing ends |
| Infrastructure and cloud (AWS/Azure) | 2–3 weeks | A few days after testing ends |
| Red teaming and TLPT | Scoped individually; a DORA TLPT includes at least 12 weeks of active red team testing | Agreed in the engagement plan |
How often do you need a pentest?
How often you need a pentest depends on the framework: PCI DSS and DORA’s TLPT rules set minimum intervals, while NIS2, SOC 2 and ISO 27001 leave the frequency to your risk assessment. Budget it as a recurring line item, not a one-off purchase. The wording varies by regulation:
- PCI DSS v4.0.1, requirement 11.4: external and internal penetration testing at least once every 12 months and after significant changes, with exploitable vulnerabilities corrected and verified by retesting (PCI Security Standards Council).
- DORA, Regulation (EU) 2022/2554, articles 26–27: financial entities identified by their TLPT authority must run threat-led penetration testing (TLPT), generally at least every three years, on top of regular testing (EUR-Lex).
- NIS2, Directive (EU) 2022/2555, article 21: essential and important entities must implement risk-management measures, including procedures to assess their effectiveness. No testing interval is named, so set the frequency from your risk assessment (EUR-Lex). Our NIS2 penetration testing page covers what supervisors ask for.
- SOC 2 and ISO 27001: neither standard prescribes a pentest frequency. In practice, auditors ask for evidence of testing at least annually.
For budgeting, a PCI-scoped e-commerce company would plan a yearly web/API test ($2,500–$5,500) plus an infrastructure and cloud audit ($5,000–$12,000+), roughly $7,500–$17,500+ per year at Pentestica ranges, before any tests triggered by major releases. A financial entity selected by its TLPT authority adds a TLPT, quoted individually, generally at least every three years.
What should a penetration test quote include?
A penetration test quote should state what will and won’t be tested, the approach, the number of tester-days, the dates, the deliverables, the retest terms and the total price. Without these details, you can’t compare quotes fairly or hold the provider to the agreed scope.
- Scope and exclusions: the applications, endpoints, user roles, IP ranges or cloud accounts covered, and anything out of scope.
- Test type and approach: what kind of test, whether black, gray or white box, and which methodology it follows.
- Tester-days: the effort the price is based on, which makes quotes comparable.
- Dates and testing window: start date, testing period, permitted hours and environment (production or staging).
- Deliverables: report format, exploitation evidence, remediation steps and delivery date.
- Retest terms: whether checking your fixes costs extra, and any time limit.
- Price and payment terms: total price, currency, invoicing schedule and what would change the price.
A penetration testing quote from Pentestica sets out the scope, the tester-days and a fixed price, all agreed before testing starts. A retest is available after fixes.
Is a cheap pentest a scan in disguise?
Sometimes, and the way to find out is to ask five questions rather than read the price tag. Price alone doesn’t reveal a scan: a low quote can buy careful manual work, and a high one can buy a scanner export with a cover page. Ask these instead:
- Who will test my system? Ask for certifications (OSCP, OSCE, CISSP, or equivalent) and years of offensive security experience. A vague “our security team” is a warning sign.
- Can I see a sample report? A real report contains reproduction steps, request/response evidence, and remediation guidance. A scanner export lists CVEs with generic text. You can download our sample report to compare.
- Will you show exploitation evidence? Manual testers demonstrate impact: the data accessed, the account taken over, the funds moved in a test environment. Scanners report “possible” issues.
- Do you test business logic? No scanner knows that a manager shouldn’t approve their own expense report. Ask how they handle authorization across roles and multi-step workflows.
- Is retesting included or offered? A provider confident in its findings will verify your fixes.
If the answers are specific and the sample report shows manual work, the price is fair wherever it lands on the market range.
Is AI replacing pentesters?
No. AI is changing how pentesters work, not whether they’re needed. Language-model tools speed up reconnaissance, triage scanner output, and draft parts of reports. What they don’t do reliably is chain three medium findings into a critical business impact, spot that a discount code can be applied twice through a race condition, or judge when further exploitation would put production data at risk. Those calls still need an experienced person with written authorization, so the price of manual testing stays tied to tester-days.
Frequently asked questions about pentest pricing
How much should a penetration test cost?
At Pentestica, a penetration test costs $2,500–$5,500 for a web application or API (published US pricing guides quote $5,000–$30,000), from $3,500 for a mobile app (iOS or Android), $5,000–$12,000+ for infrastructure and cloud, and from $15,000 for red teaming. Scope, complexity, testing approach and compliance reporting set the tester-days, which set the price.
How much does a penetration test cost per hour?
Roughly $100–$300 per hour in the US market, derived from the published $850–$2,500 tester day rate over an eight-hour day. Few providers bill hourly, because testing is planned in days. Pentestica quotes per project in tester-days, so the total is fixed before testing starts.
How much does penetration testing cost per month (PTaaS)?
Penetration testing as a service spreads the cost of repeated testing over monthly payments, and the price depends on how much manual testing the plan includes. Some plans are mostly automated scanning, so the five questions above apply. Pentestica prices per engagement and offers retesting after fixes.
Is pentesting illegal?
Penetration testing is legal when the system owner authorizes it in writing before testing begins. Without that authorization, the same activity is unauthorized access under laws such as the US Computer Fraud and Abuse Act or the UK Computer Misuse Act, regardless of intent. A professional engagement starts with a signed scope and rules of engagement.
Do I need a pentest for SOC 2?
SOC 2 doesn’t list a penetration test as a mandatory control, but auditors routinely expect one as evidence that vulnerability management works, and enterprise customers ask for the report during vendor review. Budget for at least one test per year covering the systems in your SOC 2 scope.
Request a pentest quote
Send the application type, the number of endpoints and user roles, your deadline and any compliance requirement. You get a scope, a tester-day estimate and a price.