Penetration testing cost is driven by scope, not company size. The biggest factors are the number and type of assets in scope, the test type, testing depth, environment complexity, compliance reporting needs and retesting. Fixed-fee, time-and-materials, per-asset and subscription models price the same work differently, so compare quotes on scope and deliverables, not the total alone.
What factors drive penetration testing cost?
Every pentest quote is an estimate of tester effort. Anything that adds hours adds cost. These are the factors that move the number most:
- Scope size. The count of live external hosts, internal subnets, applications, API endpoints or user roles in scope. More targets means more enumeration, testing and validation time.
- Test type. External network, internal network, web application, API, mobile, wireless and social engineering each use different methods and take different amounts of effort. Combining several types in one engagement is common and usually more efficient than buying them separately.
- Knowledge level (black, grey or white box). Black-box testing starts with no information and spends time on discovery. Grey-box testing provides credentials or architecture details so testers spend more time on exploitation. White-box testing adds source code or full documentation for maximum depth.
- Manual depth versus automation. Scanners find known issues quickly. Manual testing finds chained attacks, business logic flaws and access control failures that scanners miss. Manual work is what you are paying for, and it is where quotes differ most.
- Environment complexity. Multiple sites, segmented networks, Active Directory forests, legacy systems and third-party integrations all add testing paths.
- Compliance and reporting requirements. PCI DSS, SOC 2 and ISO 27001 evidence often needs specific scope statements, methodology references and attestation letters.
- Tester experience. Senior testers cost more per hour and typically find more in less time.
- Scheduling constraints. Rush starts, after-hours windows and change-freeze periods can add cost.
- Retesting. Verifying fixes after remediation is sometimes included and sometimes billed separately.
How do penetration testing pricing models work?
Providers package the same effort in four common ways.
| Pricing model | How it works | Best for | Watch for |
|---|---|---|---|
| Fixed fee (per engagement) | One price for a defined scope and timeline | Annual or compliance-driven tests with a stable scope | Scope creep clauses and what counts as a change |
| Time and materials (day rate) | Billed per tester-day or hour | Open-ended or evolving scope | No cost ceiling unless you set one |
| Per asset or per IP | Price scales with hosts, apps or endpoints | Large, easily counted external footprints | Low per-asset prices can signal scan-only testing |
| Subscription or retainer | Recurring fee for ongoing or periodic testing | Frequent releases and continuous testing programs | Testing depth per cycle and how retests are handled |
No model is cheaper by default. A fixed fee protects your budget. Time and materials gives flexibility. Per-asset pricing is easy to compare but can hide shallow testing. A retainer spreads cost and keeps testers familiar with your environment.
What does penetration testing cost for enterprises?
Enterprise penetration testing usually costs more in total because the environment is larger and more connected, not because the provider charges more for the brand. The cost drivers that grow with enterprise scale are:
- Multiple business units and locations, each with its own networks, applications and owners
- Network segmentation that has to be validated between zones (for example, cardholder data environments under PCI DSS)
- Identity complexity, such as multiple Active Directory domains, hybrid identity and federated access
- Change management, including approved testing windows, notification procedures and production safety controls
- Procurement and legal overhead, such as security questionnaires, NDAs and data handling terms
- Reporting for several audiences: executives, engineering teams and auditors
Many enterprises move from one-off tests to an annual testing program. A program groups external, internal and application testing under one contract, sets a testing calendar, and spreads retesting across the year. That often lowers the cost per test and gives leadership a consistent view of risk over time.
How should a 200-person company scope an external and internal network penetration test?
Headcount is a poor predictor of price. A 200-person company with a single office and a few internet-facing systems needs far less effort than one with ten branch offices and a large cloud footprint. A provider will base the quote on the answers to these questions:
External network test
- How many public IP addresses and domains are in scope, and how many are live?
- Which services are exposed (VPN, remote access, email gateways, web portals)?
- Are there web applications that need application-level testing, or only network-level checks?
Internal network test
- How many internal subnets, VLANs and sites are in scope?
- Is Active Directory in scope, and how many domains are there?
- Will testing start from an assumed-breach position (a standard user account or workstation) or from an unauthenticated network connection?
- Will testers work remotely through a deployed testing device or on site?
- Do segmentation controls between zones need to be validated?
Engagement terms
- Which compliance framework will the report support?
- Is a retest included after remediation?
- Are there testing windows or systems that must be excluded?
Having this information ready before you request quotes shortens the sales cycle and makes competing proposals directly comparable.
What do you get for the money?
A professional penetration test should include these deliverables. If a quote does not list them, ask.
- Scoping document and rules of engagement: targets, exclusions, testing windows, contacts and escalation procedures
- Executive summary: overall risk, key findings and business impact in plain language
- Technical findings: each vulnerability with severity rating (commonly CVSS), affected assets, step-by-step reproduction and evidence such as screenshots or request and response data
- Remediation guidance: specific, prioritized fixes your team can act on
- Debrief session: a walkthrough of findings with your technical and leadership teams
- Retest and updated report: confirmation that fixes work (check whether this is included)
- Attestation letter: a summary of the test that you can share with customers or auditors without exposing technical detail
The report is the product. A low price that produces rebranded scanner output costs more in the end, because your team spends time triaging false positives and auditors may question the evidence.
How do compliance requirements affect penetration testing cost?
Compliance frameworks set minimum expectations for scope and frequency, which shape the cost of the engagement.
- PCI DSS v4.0 (Requirement 11.4) requires internal and external penetration testing at least once every 12 months and after significant changes, along with segmentation testing. Service providers must test segmentation controls every six months.
- SOC 2 does not explicitly mandate a penetration test, but auditors commonly accept one as evidence that security controls are monitored and effective.
- ISO 27001:2022 requires management of technical vulnerabilities (Annex A 8.8) and security testing in development and acceptance (Annex A 8.29). A penetration test is a common way to provide that evidence.
A compliance-ready engagement may need defined methodology references, such as NIST SP 800-115 or the OWASP Web Security Testing Guide, plus scope statements that match the audit boundary. Tell your provider which framework the report supports before scoping starts.
How do you compare penetration testing quotes?
Use this checklist when you have more than one proposal:
- Is the scope identical across quotes (same IPs, applications, environments and test types)?
- How much of the testing is manual, and how much is automated scanning?
- Who are the testers, and what certifications and experience do they hold?
- Which methodology does the provider follow?
- Is a sample report available?
- Is retesting included, and within what time frame?
- Is an attestation letter included?
- What happens if testers find a critical issue mid-engagement?
- How is your data handled during and after the test?
The lowest quote is rarely the lowest cost. The right quote is the one that tests what matters to your business, produces evidence your auditors accept, and gives your engineers fixes they can act on.
Frequently asked questions
How often should you conduct penetration tests?
At least annually, and after significant changes such as new applications, infrastructure migrations or major releases. PCI DSS sets annual testing as a minimum. Organizations that release software frequently often test more often or move to a continuous testing program.
What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment identifies and ranks known weaknesses, mostly using automated tools. A penetration test goes further: testers actively exploit weaknesses to show what an attacker could actually reach. Vulnerability assessments cost less and suit frequent checks. Penetration tests prove real-world impact.
What am I losing if I choose a low-cost pentest for compliance?
Usually manual testing depth. Very low-cost tests often rely on automated scanning with little validation, which misses business logic flaws, chained attacks and access control issues. They can also produce reports that auditors or enterprise customers question.
Is retesting included in the price of a penetration test?
It depends on the provider. Some include one retest within a set window. Others bill retesting separately. Confirm this before signing, because retest results are often what auditors want to see.
Why does a red team engagement cost more than a penetration test?
A red team engagement simulates a real adversary over a longer period, tests detection and response rather than only vulnerabilities, and requires more planning and stealth. A penetration test aims to find as many vulnerabilities as possible within a defined scope and time frame.
Is penetration testing worth the investment?
For most organizations, yes. A penetration test shows which weaknesses an attacker can actually exploit, gives your team a prioritized fix list, and provides evidence for audits, customer security reviews and cyber insurance applications.
How Canary Trap approaches penetration testing pricing
Canary Trap does not publish fixed price lists, because no two environments are the same. Every engagement is scoped to your assets, risk and compliance needs, and priced on the value of the testing delivered rather than on being the cheapest option. Our testers combine manual exploitation with structured methodology, and our reports are written for both executives and engineers.
Ready to scope your next test? Book a scoping call with Canary Trap to get a quote built around your environment.
