Hiring guide
Penetration testing payment terms, from quote to final invoice
Penetration testing payment terms decide when money moves and what it covers. They are simple when the fee is fixed. However, a few details still matter: timing, milestones, the retest and changes to dates.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
Why penetration testing payment terms deserve a read
Finance teams often see a testing invoice without context. If the terms are clear, it is approved quickly. If not, it waits while someone asks what it covers.
In addition, unclear terms can create surprises. A retest billed separately, or a fee that grows with hours, is easy to miss in a proposal.
The parts of penetration testing payment terms
Check each part against the proposal. Every number should match, and nothing should be left as to be agreed.
Then share the terms with finance before signing. Because they will pay the invoice, they should see it first.
| Term | What to check |
|---|---|
| Fee basis | Fixed per scope, not hourly |
| Timing | Deposit, milestones or on delivery |
| Retest | Included, or priced in advance |
| Date changes | What happens if your side delays |
| Purchase order | Needed before work starts? |
| Due date | Number of days after invoice |
Penetration testing payment terms review
Tick what your draft already states.
Your result appears here as you tick, so you can see what is still open.
Fixed fees and penetration testing payment terms
A fixed fee means one number for the agreed scope. So the invoice should match the quote exactly. If extra work is needed later, it should be quoted separately as new scope.
As a result, finance can approve the budget once, and the number does not move during the project.
Purchase orders and timing
Many organizations need a purchase order before any work starts. Ask your procurement team about lead times early, because a late order can delay the start date.
Also check where invoices go. A named contact in finance saves a round of emails.
When dates change
If your side needs to move the window, the terms should say whether any fee applies. Similarly, if the firm moves the window, you should know what you can expect.
Because both cases are written, nobody negotiates them under pressure.
Our terms in short
No hourly billing and no change orders. One price for the agreed scope, confirmed after the scoping brief, with a free retest once your fixes are applied.
Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. One fixed number is agreed after the scoping brief, and it never moves during the project. The method follows the Penetration Testing Execution Standard.
Penetration testing payment terms questions
Are penetration testing payment terms usually fixed?
Many firms quote a fixed fee per scope. Check that hourly billing is excluded.
Is the retest extra?
Check the terms. Some firms include it, and some price it separately.
Do penetration testing payment terms need a purchase order?
That depends on your organization. Ask procurement early.
What if the window moves?
The penetration testing payment terms should say what applies in each case.
Related guides
Get our penetration testing payment terms in writing
Send a short brief. We reply with a written scope, our terms and one fixed number.
Get a fixed price