How Much Does a Penetration Test Cost? (2026 Pricing Guide)

## How Much Does a Penetration Test Cost? "How much does a penetration test cost?" is the single most common question we get before a scoping call — and the honest answer is that price is a function of scope, not a fixed catalogue number. This guide explains exactly what you are paying for, so you can compare quotes properly instead of picking the cheapest line item. ## What Actually Drives the Price Every credible quote is built from the same inputs: - **Scope size** — number of applications, APIs, IP ranges, cloud accounts, or mobile builds in test. - **Application complexity** — user roles, workflows, integrations, and authenticated surface area. A 5-role multi-tenant SaaS takes far longer than a brochure site with a login. - **Testing depth** — automated-assisted testing versus fully manual, exploit-driven testing by experienced testers. - **Methodology and reporting** — OWASP/PTES-aligned testing with a report auditors accept costs more than a scanner export. - **Retesting** — whether remediation verification and an attestation letter are included or billed separately. - **Compliance driver** — SOC 2, ISO 27001, PCI DSS, or an NRS integration review each add specific evidence requirements. In practice, the unit of pricing is **tester-days**. Ask any vendor how many days of manual testing your quote includes — that single question separates real engagements from automated scans with a PDF wrapper. ## Typical Ranges by Engagement Type These are the ranges we see across the market in 2026. Treat them as planning figures, not quotes. | Engagement | Typical effort | Indicative range (USD) | |---|---|---| | Small web app (single role, limited features) | 3–5 tester-days | $4,000 – $8,000 | | Mid-size SaaS web app + API | 6–10 tester-days | $9,000 – $18,000 | | External network (up to ~50 hosts) | 3–6 tester-days | $4,000 – $10,000 | | Internal network / Active Directory | 5–10 tester-days | $8,000 – $20,000 | | Cloud configuration review (AWS/Azure/GCP) | 3–6 tester-days | $5,000 – $12,000 | | Mobile app (iOS or Android) | 4–7 tester-days | $6,000 – $13,000 | | Red team / adversary simulation | 15–25 tester-days | $25,000 – $60,000+ | For Nigerian businesses, local-market engagements are typically priced in naira and sit meaningfully below US ranges for comparable scope, largely because of delivery-cost differences — not because the testing is lighter. What must not vary is methodology, tester certification, and reporting quality. ## Why the Cheapest Quote Is Usually the Most Expensive A low-cost "penetration test" is often a vulnerability scan with light triage. You find out at the worst possible moment: when a customer's security team or an auditor reads the report. Warning signs to check before you sign: - No named tester-days or effort estimate in the proposal - Findings with no proof-of-exploitation, only scanner severity ratings - No manual business-logic or access-control testing - Retest quoted as a separate full-price engagement - No sample report available for review ## What Should Be Included in the Price A complete engagement should cover scoping and rules of engagement, manual exploitation aligned to OWASP/PTES, business-logic and access-control testing, a prioritised report with reproduction steps and remediation guidance, a developer debrief, one round of remediation retesting, and an attestation letter you can share with customers or auditors. If any of those are missing, the quote is not comparable to one that includes them. ## How to Reduce Cost Without Reducing Value - **Scope precisely.** Test what is exposed and what matters; exclude static marketing pages. - **Provide credentials and documentation early.** Authenticated testing finds more in less time than black-box guessing at logins. - **Fix the obvious first.** Patch known issues and run your own scanner before the engagement so paid tester time goes to deep findings. - **Plan an annual cadence.** Recurring or PTaaS-style programmes usually price better than one-off, last-minute tests. - **Bundle related scope.** Testing the web app and its API together is cheaper than two separate engagements. ## Budgeting by Compliance Driver - **SOC 2 Type II** — annual application and external network testing is the common baseline. - **ISO 27001** — testing supports Annex A control evidence; scope follows your statement of applicability. - **PCI DSS** — annual testing plus after significant change, with segmentation testing where applicable. - **NRS integration** — API, webhook, and data-protection focus for certified System Integrators and Access Point Providers. ## Frequently Asked Questions **How long does a penetration test take?** Most engagements run 1–3 weeks from kickoff to report, with testing itself taking 3–10 days depending on scope. **How often should we test?** At least annually, and after any significant architecture, authentication, or infrastructure change. **Is a vulnerability scan enough?** No. Scans find known issues; penetration testing finds chained, logic, and access-control flaws that scanners cannot reason about. **Do you charge for retesting?** Our engagements include one round of remediation retesting and an attestation letter. ## Get an Accurate Number for Your Scope Pricing only becomes real once someone looks at your actual attack surface. Our OSCP-certified testers scope in a 15-minute call and quote in tester-days, so you can see exactly what you are buying. **Ready to get a figure you can budget against?** [View our penetration testing service](/penetration-testing) or [check your security maturity first](/security-scorecard). **Related reading:** [Network penetration testing: what it is and how it works](/blog/network-penetration-testing).