How Much Does a Penetration Test Cost? Complete 2026 Pricing Guide

If you've asked for a penetration test quote recently, you know the answer is never a clean number. "Depends on scope" is the most common response — which is accurate but frustrating when you're trying to budget, compare vendors, or make a business case to leadership.

This guide breaks down what actually drives penetration testing costs, what different price tiers get you, and where automated scanning tools like Ironimo change the math significantly.

Penetration Testing Cost Ranges in 2026

Here are realistic price ranges for the most common engagement types, based on market rates across European and North American vendors:

These are project fees only — they do not include retesting after remediation, which most vendors charge separately at 25–50% of the original engagement cost.

What Drives the Price of a Penetration Test

Scope and Attack Surface Size

The single biggest cost driver is scope. Penetration testing is billed on consultant time, and larger attack surfaces take more time to test manually. An application with 200 API endpoints costs roughly 5–10x more to test than one with 20.

Scope factors that increase cost:

• Number of application endpoints — each endpoint is tested individually for injection, authentication bypass, authorization flaws, and more
• Number of user roles — role-based access control testing multiplies with each additional role (admin, user, support, guest)
• Authentication complexity — OAuth flows, SAML SSO, MFA, and complex session management add significant time
• Business logic depth — complex workflows (multi-step forms, payment flows, approval chains) require manual analysis that automated tools can't replicate
• Integration count — third-party integrations, payment processors, and external APIs each expand the trust boundary

Engagement Type and Methodology

The testing approach significantly affects price:

• Black box — tester has no internal knowledge; more recon time, typically lower cost but less thorough
• Grey box — tester has credentials and basic documentation; most common for web app tests, best value
• White box — tester has full access to source code, architecture docs, infrastructure details; most thorough, highest cost
• Red team — adversarial simulation with realistic attacker TTPs; significantly more expensive, longer timeframe

Vendor Type and Seniority

Not all penetration testing vendors price equivalently:

• Big-four consulting firms (Deloitte, PwC, KPMG, EY security practices) — premium pricing, €1,500–€3,000/day per consultant, strong compliance credentials
• Specialized security firms (NCC Group, Bishop Fox, Rapid7, Secureworks) — €1,000–€2,000/day, deeper technical expertise, better findings quality
• Boutique and regional firms — €600–€1,500/day, variable quality, often more flexible
• Freelance consultants (OSCP/CREST-certified) — €400–€900/day, highly variable, harder to verify quality
• Offshore vendors — €200–€500/day, significant quality variation, compliance risk for regulated industries

Compliance Requirements

Testing for compliance certification typically adds 20–40% to the cost because:

• The scope is defined by the standard (PCI DSS, ISO 27001, SOC 2) rather than risk prioritization
• Reporting must meet specific format requirements with evidence artifacts
• Some certifications require accredited testers (CREST, CHECK, TIGER)
• Retesting windows and documentation requirements add consultant time

Hidden Costs Most Buyers Miss

The quoted engagement fee rarely reflects the total cost of a penetration test. Common additional costs include:

Remediation Retesting

After your development team fixes the findings, you need to verify the fixes actually work. Most vendors charge 25–50% of the original engagement fee for a retest, or offer a fixed number of retest hours in the contract. For a €20,000 engagement, expect €5,000–€10,000 more for a single retest pass — and findings rarely all get fixed in one cycle.

Internal Preparation Time

Your engineering and security teams will spend time preparing for the engagement: scoping calls, setting up test environments, creating test accounts across all user roles, coordinating WAF and rate limit exceptions, and briefing the tester. This commonly runs 20–40 hours of internal engineering time before the tester starts.

Finding Remediation

The pentest report tells you what's broken. Fixing it is your engineers' time — time that's not free. A medium-severity web application test typically surfaces 15–40 findings. Remediation effort varies enormously by finding type:

• Dependency updates (CVE-based findings) — 1–4 hours each, including testing
• Missing security headers — 2–8 hours for full implementation
• Authentication flaws — 8–40 hours depending on complexity
• Business logic vulnerabilities — 16–80+ hours; requires architectural changes

Annual Frequency

A single penetration test is a point-in-time assessment. Most compliance frameworks (PCI DSS, ISO 27001, SOC 2 Type II) require annual testing at minimum. Some require testing after significant changes. If your development team ships features monthly, annual testing misses most of the year's attack surface changes.

What a Penetration Test Actually Delivers

Understanding the deliverables helps calibrate whether the price is justified:

The Report

Every penetration test delivers a written report. Quality varies substantially. A good report includes:

• Executive summary with business risk framing — written for the C-suite, not engineers
• Technical findings with vulnerability description, proof-of-concept reproduction steps, and CVSS scores
• Remediation guidance specific to your technology stack
• Attack narrative for findings that chain multiple vulnerabilities
• Evidence artifacts: screenshots, HTTP request/response captures, tool output

Lower-tier vendors often produce template-heavy reports with generic remediation advice. Premium vendors write findings specifically to your codebase with implementation-level guidance.

The Knowledge Transfer

Good engagement teams include a debrief call where findings are walked through with your engineering team. This is high value — live Q&A about specific findings is worth hours of engineering time spent interpreting the report.

The Certificate of Testing

For compliance purposes, you receive a letter or certificate confirming the test was conducted. This is what auditors and enterprise procurement teams often require.

When Penetration Testing Is Worth the Price

A manual penetration test delivers irreplaceable value in specific situations:

• Pre-launch security validation for applications handling sensitive data or significant financial flows
• Compliance certification — PCI DSS Level 1, ISO 27001, SOC 2 Type II, FedRAMP all have specific pentest requirements
• Complex business logic — multi-step financial workflows, permission models with nuanced trust relationships, or state machines that automated tools cannot navigate
• Enterprise sales requirements — large customers frequently require a dated penetration test report as a procurement condition
• Post-incident validation — after a breach or significant vulnerability discovery, a focused assessment verifies the blast radius and confirms remediation
• New acquisition security review — M&A due diligence often requires an independent security assessment of the target

Where Penetration Testing Delivers Poor ROI

There are common situations where the economics of manual pentesting work against you:

• Continuous delivery pipelines — if your team ships weekly or daily, an annual pentest is outdated before the ink is dry on the report
• Known vulnerability classes — OWASP Top 10 findings like SQL injection, XSS, and insecure direct object references are reliably detected by automated scanning tools at a fraction of the cost
• Pre-pentest baseline — going into a manual engagement with unpatched known vulnerabilities is expensive waste; automated scanning should clear the baseline before the tester starts
• Frequent architectural changes — new microservices, added endpoints, changed authentication flows all re-open the attack surface between annual assessments
• Cost-constrained environments — SMBs and startups paying €15,000+ for a one-time assessment often get less security value than €3,000/year in continuous automated scanning coverage

The Combined Model: Automated Scanning + Annual Pentest

The highest-value security programs use both tools in their appropriate contexts:

The pragmatic model: run automated scanning continuously to eliminate the knowable vulnerability surface, then invest manual pentest budget in the areas where human judgment adds irreplaceable value — complex business logic, chained attack scenarios, and compliance certification.

How to Reduce Your Penetration Testing Costs Without Reducing Coverage

Run Automated Scanning Before the Engagement

Go into a manual test with a clean baseline. Automated scanning typically surfaces 60–80% of OWASP-category findings before the tester starts. A penetration tester spending days on SQL injection and XSS findings that a scanner could have caught is expensive waste — those consultant hours should go toward business logic and chained attack research that actually requires human expertise.

Define Scope Precisely

Vague scope is expensive scope. Before engaging a vendor, produce a complete inventory of: endpoints tested, authentication flows included, user roles, any third-party integrations in-scope, and specific compliance controls that need evidence. Precise scope means accurate quotes and no mid-engagement scope creep.

Use Grey Box Testing

Unless you have a specific reason to test from a zero-knowledge position, grey box testing gives you significantly more finding depth for the same consultant time. Provide test credentials, basic API documentation, and your tech stack details. Time spent on enumeration is time not spent finding real vulnerabilities.

Negotiate Retesting Terms Upfront

Ask for retesting hours to be included in the initial contract rather than re-quoted. Many vendors include 1–2 days of retest time as part of a fixed-fee engagement if you ask during negotiation rather than after delivery.

Bundle Multiple Applications

If you have multiple applications that need testing, multi-application contracts typically carry 15–25% discounts over individual project quotes, and the tester benefits from understanding shared authentication infrastructure across the portfolio.

Questions to Ask a Penetration Testing Vendor

Before signing an engagement, ask these questions to calibrate quality and fit:

• "Who specifically will be testing our application?" — vendors sometimes use junior staff for execution; understand the seniority of the actual tester, not just the account manager presenting the proposal
• "Can you share a sanitized example report from a similar engagement?" — good vendors have these readily available; reluctance is a signal
• "What certifications do your testers hold?" — OSCP, CREST, GPEN, eWPT are relevant for web application testing
• "What automated tools do you use and how much of the test is automated vs. manual?" — honest vendors will tell you; be skeptical of "fully manual" claims
• "How many findings did your last 5 similar engagements produce?" — benchmarks for your industry and application size should be available
• "What is your retesting policy after remediation?" — get this in writing before signing
• "How do you handle critical findings discovered mid-engagement?" — responsible disclosure during the test, not just at report delivery