Penetration testing pricing makes sense only after you know what the quote buys. Compare the same systems, access, testing depth, deliverables, and retest terms—not just the fee on the first page. A low starting price for a narrow assessment is not a discount on a broader engagement, and a subscription credit is not automatically an hour of human testing.
The practical approach is to build a common scope, request a breakdown of the proposed work, and calculate the payable total for that scope. Keep your own preparation and remediation work in a separate budget. If two proposals still describe different outcomes, they are not ready for a price comparison.
This guide supplies a comparison method, not a market-average cost estimate. Public-source research was checked on October 21, 2026. The worked dollar example below is hypothetical, not a vendor quote or a recommended budget.
What a published starting price actually tells you
A public price can help you understand a supplier’s commercial model. It cannot establish what your environment will cost without the underlying scope.
For example, Exploitr’s UK pricing page listed web application testing from £3,600 when checked on October 21, 2026. The page identifies its prices as indicative starting points excluding VAT, reviewed in October 2026, with the final fixed-price quote confirmed after a scoping call. That is a vendor-specific GBP starting offer, not a US-market estimate or an equivalent specification for your application.
A different unit appears on Cobalt’s pricing page: annual credits, with one credit described as the equivalent of eight hours of offensive security testing combining automation and human expertise. Do not convert that unit into eight human-only practitioner hours. Request the proposed allocation and coverage for your engagement.
Neither example ranks the provider or establishes testing effectiveness. Before saving a price in a budget, record the currency, tax treatment, billing period, minimum commitment, exact service, and date checked. Treat a promotional deadline as a condition to verify, not a reason to buy an unsuitable test.
Make the scope comparable before comparing the fee
NIST SP 800-115, sections 6.2–6.3, connects assessment resources to factors such as system size, complexity, selected techniques, and staff interaction. Its planning guidance is useful here, but the publication dates to 2008: it is not a current commercial rate card.
Use the following fields as a price-comparison attachment. The purpose is to expose differences, not to replace a technical scoping exercise.
- Boundary: Name the application, network range, cloud environment, or other agreed target. Identify connected services and explicit exclusions. Do not assume a web quote includes every API or a mobile client.
- Access: List the authenticated roles, tenant boundaries, test accounts, documentation, and other information available to the provider. Ask which assumptions the fee depends on.
- Work: Separate planning, automated activity, manual investigation, reporting, quality review, meetings, and retesting. Ask what the supplier means by a testing day and whether the number represents person-days or elapsed calendar days.
- Evidence: Specify the report, findings detail, coverage statement, exclusions, debrief, and any separate summary you need. Ask whether these are included or optional charges.
- Delivery conditions: Record the testing window, readiness requirements, location, pause rules, and proposed dates. Ask what happens commercially if access fails or the environment changes.
For the complete preparation document, use our penetration-test RFP and scoping checklist. If the uncertainty is which surfaces belong in the engagement, resolve that through the web, API, mobile, and cloud test comparison before seeking a binding fee.
Ask what the access model changes
A proposal described as black-box, gray-box, or white-box still needs a concrete explanation of what information is supplied and what work is performed. Those labels alone do not make quotes equivalent.
CREST’s 2022 procurement guide discusses how access to information can improve the use of a tester’s time. That does not mean adding source-code review must make the whole engagement cheaper. Better information and a larger assignment can occur together.
Ask the provider to explain the proposed trade-off: what work becomes more efficient, what additional analysis is included, and what remains outside the price. Choose the arrangement that answers your business question, not the label that sounds most thorough.
Separate the delivery method from the billing model
First establish how the assessment will be performed. Then establish how you will pay for it. Automation, human validation, reporting platforms, and subscription billing can appear in different combinations.
The OWASP Web Security Testing Guide v4.2 introduction explains limitations of automated application scanning, including the need for creative reasoning about bespoke applications. It also cautions against treating penetration testing as the only testing technique. This supports asking for a clear method; it does not prove the quality of any current product.
If your requirement is a human-led assessment, ask which activities a practitioner performs, how findings are validated, and how the report distinguishes tested, excluded, and untested areas. If the offer is automated or hybrid, have the provider describe that plainly. Compare it with your requirement rather than assuming the word “pentest” settles the question.
Fixed fee: define what makes the price fixed
Request the scope assumptions, deliverables, completion conditions, and change-control terms attached to the fixed fee. Establish whether an agreed coverage commitment or a time allowance governs completion, and how any unfinished work will be reported.
A useful clarification is: “If an additional user role or separately hosted API is discovered during preparation, who decides whether it changes this quote?” Require approval of a changed fee before additional billable work begins.
Time and materials: define the spending boundary
Request the rate, billing unit, estimated effort by activity, and a spending limit or escalation checkpoint. Specify who can authorize additional time. Decide what progress evidence you need before increasing the allocation.
Do not rank proposals by day rate alone. A rate without an effort estimate does not produce a total, and a larger number of days is not proof of better coverage. Review the work description and evidence commitments alongside the calculation.
Subscription or credits: price the commitment, not a theoretical unit
Request the minimum contract value, consumption rules, usable period, target limits, renewal terms, and treatment of unused capacity. Ask which activities consume credits and whether reporting, retesting, or platform access carries a separate charge.
Where marketing tables and FAQs differ, obtain one written answer for your exact plan. Our research found conflicting rollover language on Cobalt’s pricing page; we therefore do not treat either summary as a universal entitlement. Your purchase record should identify the applicable contract clause.
For your own decision, compare the full committed spend with the assessments you realistically expect to use. A low calculated cost per test depends on those tests actually fitting the contract and being completed within its usable period.
A worked quote comparison—with hypothetical numbers
Imagine you need one assessment of an owned SaaS web application and its agreed API boundary, with three named user roles available in two test tenants. Both proposals must include the same report and debrief. You also want one focused retest of the original findings within an agreed 60-day window. These are illustrative requirements, not a standard engagement specification.
The following figures are invented solely to demonstrate the arithmetic. All amounts are hypothetical USD, before taxes; they are not observed vendor prices, industry averages, or evidence that this scope can be purchased for these sums.
| Fee item | Proposal A | Proposal B |
|---|---|---|
| Base assessment | $8,000 | $10,000 |
| Required retest | $1,500 | Included |
| Comparable fee total | $9,500 | $10,000 |
The headline difference is $2,000; the comparable fee difference is $500 after adding the required retest. That arithmetic does not select a winner. First verify that both offers actually meet the same boundaries, evidence requirements, timing, and retest conditions.
If Proposal A excludes the API you need, do not invent a price for adding it. Mark the comparison incomplete and request a revised quote. Likewise, if Proposal B’s retest window cannot accommodate your repair schedule, “included” may not satisfy your requirement. Obtain an extension price or revise the plan before choosing.
Keep an unresolved amount marked “not quoted,” not zero. A comparable total is complete only when the required components and their commercial treatment are known.
Budget the work after the report
The supplier’s invoice is one budget. Your team’s work is another. Keep them separate so a lower assessment fee does not conceal an unfunded repair programme.
Create an internal work ledger with owners for account preparation, access troubleshooting, attendance at the debrief, finding triage, engineering changes, deployment, and arranging fix verification. Use your team’s own estimates; do not apply an unsupported industry percentage to predict remediation cost.
For retesting, request answers to five commercial questions:
- Which original findings and delivery types qualify?
- When does the eligibility window start and end?
- How many rounds are included, and what must be ready before booking?
- What happens if your deployment slips beyond the window?
- When does changed functionality require a new assessment rather than a focused retest?
Our penetration-retesting guide covers the verification distinction in more detail. Here, the purchasing decision is whether the quoted allowance matches the repair plan you can actually deliver.
Also request the commercial treatment of postponement, cancellation, travel if relevant, unavailable test accounts, and repeated setup. These are questions to resolve, not claims that every supplier charges each fee. Assign a named approver for any change and keep the revised amount with the scope revision.
Red flags that deserve a written answer
A warning sign is a reason to investigate, not proof that a provider is dishonest. Use these checks consistently across shortlisted proposals.
- A firm total with no meaningful scope assumptions. Ask what assets, roles, access, and depth the number covers. A menu price can start a conversation; it should not substitute for an agreed assignment.
- “Unlimited” without a boundary. Request limits on targets, practitioner involvement, concurrency, scheduling, and retest eligibility. If the provider cannot state the limits, you cannot establish the purchase.
- Ambiguous human involvement. Ask which work is automated, which is performed or reviewed by people, and what evidence supports findings. Do not infer a manual assessment from a PDF report alone.
- No usable sample deliverable. Request an appropriately redacted sample or another safe demonstration of report structure. Assess it against your needs using our guide to reading a penetration-test report.
- Qualifications without an assigned delivery explanation. Ask who is responsible for the engagement, what relevant experience is proposed, and whether subcontracting or staffing changes affect your agreement.
- Guaranteed security or automatic compliance acceptance. Ask for the exact deliverable and have its intended recipient confirm suitability. Do not buy a promise that the price alone cannot substantiate.
- Pressure to start before authorization and safety arrangements. Resolve authority, boundaries, contacts, data handling, and stop conditions first. Authorize only systems you are entitled to have tested, including any necessary third-party permissions.
Approve the purchase in three passes
Pass one: scope. Have the technical owner reconcile every inclusion and exclusion. Return material differences to each supplier for clarification against the same requirement. Preserve the response; do not silently assume a missing item is included.
Pass two: evidence and delivery. Check the proposed method, responsible people, report format, schedule, and retest arrangement. If a customer, auditor, or other recipient needs a particular output, obtain its requirements before signing. An impressive certificate or dashboard is not a substitute for the requested evidence.
Pass three: commercial total. Have the budget owner check the committed fee, required extras, taxes, currency, payment and renewal terms, and change-approval rules. Put internal repair work alongside the purchase without presenting it as a supplier charge.
If the budget is insufficient, request an explicitly phased or narrower proposal and record what is deferred. Do not describe reduced coverage as a full assessment. Finish with a decision record containing the accepted scope version, unresolved risks, final quote, owners, and next review date.
Research method, evidence, and limitations
This is a document-based buying guide, researched on October 21, 2026. Evaluation focused on comparable scope, delivery evidence, billing transparency, change terms, and retest usability. No penetration test, vendor demonstration, interview, private quote, or purchasing exercise was conducted. Independent technical review has not been completed.
| Evidence | Use in this guide | Limit |
|---|---|---|
| NIST SP 800-115 | Assessment resource planning | 2008 guidance, not fees |
| OWASP WSTG v4.2 | Testing-method questions | Not a product evaluation |
| CREST 2022 guide | Requirements-led procurement | Not a US price survey |
| Vendor pricing pages | Dated examples of offer structure | Verify current written terms |
Selected relevant sections were reviewed, not every page of each long publication. Public vendor offers are not a representative price survey. Unsupported averages, percentage surcharges, performance promises, and current compliance conclusions based on old supplements were excluded. Pricing and contract terms should be rechecked before purchase.
Disclosure: This article contains no affiliate links. The named vendors illustrate commercial terms, not endorsements. The comparison worksheet and hypothetical example are original editorial decision aids, not a validated procurement standard.
Buy a scope you can explain
The useful penetration testing pricing question is not simply “Which quote is cheapest?” It is “What will we receive, what remains untested, and what will it cost to reach the agreed outcome?”
Start with one common scope sheet. Obtain written answers for missing costs and limits, separate your repair workload, and choose only after the proposals are comparable. If a material boundary or price is still unknown, the next step is clarification—not a purchase justified by the lowest headline number.
