Pricing guide
Penetration testing pricing: the ranges, and what moves them
Penetration testing pricing is usually hidden behind a contact form. So here are the bands our engagements actually land in, largest first. Also, here are the factors that place you in one of them.
- Signed scope before testing
- Fixed price agreed in writing
- OWASP and PTES methods
Penetration testing pricing by engagement shape
These are honest ranges, not a menu. Therefore the final number is fixed only after the scoping brief.
| Engagement | Typical fee | Typical duration |
|---|---|---|
| Red team | $95,000 and above | Six weeks or more |
| Full assessment | $45,000 to $90,000 | Three to five weeks |
| Focused test | $25,000 to $40,000 | One application or a small external estate |
| Focused Exposure Review | From $4,500 | Report within five business days |
What moves penetration testing pricing
Four factors decide most of the fee. So compare them across quotes rather than the totals alone.
- How many systems are in scope, and how complex they are
- Whether findings are chained into proven impact
- Whether detection and response are measured
- Whether a retest and written debrief are included
Estimate where your penetration testing pricing will land
Tick what applies. More ticks usually mean a larger band.
Your result appears here as you tick, so you can see what is still open.
Why fixed fees beat hourly penetration testing pricing
An hourly quote can only estimate. By contrast, a fixed fee commits to the scope, so the number never moves during the project. Also, there are no change orders, which keeps budget approval simple.
The bounded review, and its limits
The Focused Exposure Review covers up to five external hosts and one public web application. However, it is a review rather than a penetration test. So it does not cover internal networks, Active Directory or cloud roles. It is also not auditor-grade evidence for SOC 2 or PCI.
Its fee is credited in full if you commission a full engagement within ninety days of the report.
Budget smaller than the floor?
Tell us your figure in the form. We would rather scope honestly to what you have than quote work you did not ask for. Full engagements run from $35,000 to $120,000, and the floor is $25,000. The bounded Focused Exposure Review starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days.
Penetration testing pricing questions
Is penetration testing pricing negotiable?
The scope is. Where a budget changes, the scope changes, rather than the rate.
Why is penetration testing pricing so varied between firms?
Mostly because depth varies. A scan and a manual engagement can carry the same label.
Do you charge for the scoping brief?
No. You receive a written scope and one fixed number before deciding.
Is the review fee lost if we upgrade?
No. It is credited in full within ninety days of the report.
Related guides
Get a fixed quote
Tell us what you need tested and roughly what you have allocated. We reply with a written scope and one fixed number, usually within one business day.
Get a fixed price