How much does a penetration test cost?
Most penetration tests cost between $5,000 and $50,000. A focused test of one web application, API or external network usually sits at the lower end, while large internal, cloud or red team engagements cost more. The scope sets the price. This guide explains what moves it, and how we quote.
Typical price ranges in 2026
Published ranges from penetration testing firms and pricing guides. Use them for planning a budget, not as a quote.
| Type of test | Typical range (USD) | What moves the price |
|---|---|---|
| Web application (one app) | $5,000 to $30,000 | Driven by roles, features and integrations |
| External network | $5,000 to $20,000 | Driven by the number of live hosts and services |
| Internal network | $7,000 to $35,000 | Driven by network size and Active Directory complexity |
| API, web or mobile project | $15,000 to $40,000 | Typical for a standard multi-component scope |
| Large cloud, internal or red team work | $25,000 to $150,000+ | Multi-week engagements across many systems |
Sources: Bright Defense, “Penetration Testing Pricing in 2026”; Andersen, “How Much Does Penetration Testing Cost in 2026?”; Blaze Information Security, “Penetration Testing Cost & Pricing”. Synack reports an average of about $18,300 per engagement across all test types.
What sets the price
A penetration test is priced by the testing days it needs. These are the things that add days.
Size of the scope
The number of applications, user roles, API endpoints, IP addresses or cloud accounts. More surface means more testing days.
Depth of testing
A grey box test with accounts at every role finds more than a black box test, and takes longer. White box testing with source code adds review time.
Complexity
Multi-step business logic, multi-tenant data, payment flows and custom authentication all need careful manual testing.
Compliance reporting
Tests for PCI DSS, SOC 2 or ISO 27001 need specific scope statements and evidence, and PCI segmentation testing adds work.
Retesting
Confirming your fixes after the first report is extra work. Check whether a quote includes it.
Testing windows
Testing only out of hours, or on fragile production systems, slows the work down.
How we quote
We start with a free scoping call to understand what you want tested and why. Then we send a written quote, set out so you can compare it line by line with any other firm's.
Not sure which test you need? Read our guide to what penetration testing is, or see the full process.
Every quote states
- The exact scope: applications, endpoints, hosts or apps, by name
- The testing approach (black, grey or white box) and the standards we follow
- The number of testing days and the date the report is due
- What the report contains and who it is written for
- Whether a retest is included, and on what terms
- The price for that scope, and what would change it
Pricing questions
How much does a penetration test cost?
Published 2026 pricing guides put most penetration tests between $5,000 and $50,000, with typical engagements around $10,000 to $35,000. A small, tightly scoped web, API or external test sits at the lower end. Large internal network, cloud or red team work can pass $100,000. The scope decides the price, so the only reliable figure is a quote for your environment.
Why do quotes for the same test vary so much?
Usually because they cover different amounts of work. One quote may be for an automated scan with a short report, another for several days of manual testing with a retest. Compare the scope, the number of testing days, the approach and what the report includes, not just the price.
Is a cheap penetration test worth it?
Be careful. A very low price often means mostly automated scanning, which misses the access control and business logic flaws that cause real breaches. Ask how many days of manual testing are included and whether every finding is verified by a person.
Do you charge for the scoping call?
No. The scoping call and the quote are free, and you are under no obligation.
How can we reduce the cost?
Give testers accounts and documentation up front, so time goes into testing and not discovery. Test a staging environment so we can work freely. Group several applications into one engagement. And fix the issues from the last test, so the next one finds new problems instead of old ones.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.