Published September 21, 2026
How Much Does a Penetration Test Cost? Pricing Factors & Current Market Ranges
Pentests are priced from a few hundred dollars to well over a hundred thousand — that range exists because the products genuinely differ. The factors that actually move the price, current market ranges with sources, and how to scope your own need.
“How much does a pentest cost” has no single answer, and that is not vendors dodging — the range is wide because the product differs end to end. What deserves suspicion is a quote that is too cheap: work that normally runs five figures offered for a few hundred dollars usually means an automated scan reported as a manual test. Competent testers’ time is scarce, and it cannot be sold at scanner prices.
This article covers the two things actually useful before you request a quote: how the price is computed (factors you control) and current market ranges with sources — no invented numbers.
Current market ranges (with sources)
These are published figures from vendors and market observers, quoted as-is with their dates — not our estimates:
| Source (date) | Stated range |
|---|---|
| Uproot Security (2026) | Web app tests $4,000–$30,000, averaging ~$12,500 |
| Blaze Information Security (2026) | Tightly scoped web/API/external network $5,000–$10,000; larger cloud, internal network, red team $25,000–$150,000+ |
| BrightDefense (2026) | Basic web app pentest ~$5,000–$15,000; HIPAA-focused ~$10,000–$50,000 |
| VikingCloud (accessed Sep 2026) | Most organizations: $5,000–$30,000 depending on scope and methodology |
For the Indonesian market, published local figures run from roughly Rp10 million to Rp100 million+ depending on scope (Widya Security, Oct 2025, among others) — a fraction of Western rates, explained mostly by cost of living rather than an automatic quality gap.
The pattern consistent across every source: the narrower the scope, the smaller the number — and no serious provider sells a genuine web application pentest below a few thousand dollars.
Six factors that actually move the price
1. Scope — the biggest one. One web app with twenty pages and one API is different work from a platform with five apps, fifty API endpoints, and payment integrations. Before asking for a quote, count: how many applications, roughly how many endpoints/functions, any public APIs.
2. Methodology: manual vs automated. Automated scans are cheap because a machine tests hundreds of targets at once. Manual testing costs more because a person reasons about your business logic: “can user A view user B’s invoice?” — a question no scanner can ask. Most of a pentest’s value lives in the manual portion; tools are the floor, not the building.
3. Access level (blackbox/greybox/whitebox). No access (blackbox) means more time spent on reconnaissance; with code and test-account access (whitebox) the tester goes straight to the risky parts. Whitebox usually costs less for the same scope — and covers more — because time isn’t burned guessing.
4. Environment & complexity. A multi-role application (admin, staff, customer) has a bigger surface than a brochure site. Third-party integrations (payment gateways, messaging APIs, SSO) add real work.
5. Retest. A good quote states whether retesting after fixes is included. Retesting is real work — even if billed separately, it should appear on the quote, not vanish.
6. Report format & formal requirements. A report meant for your developers to fix things differs from one written for an ISO auditor or regulator. More formality means more documentation hours.
Red flags in a pentest quote
- Below-market price with no scope explanation. The fair counter-question: “exactly what gets tested, for how long, and what percentage is manual?”
- No sample report (sanitized). The report is the product.
- “Guaranteed to pass” / “guaranteed secure.” An honest pentest finds something in nearly every system; a zero-findings guarantee is a promise nobody will actually look.
- No written scope. Without a written target list, “pentest” can mean scanning a homepage.
How to scope your own need before asking for a quote
Three questions narrow the price in one conversation — and a good vendor will ask them of you first:
- What are you protecting? A company brochure site, a system holding customer data, and an app processing payments carry different risk — and warrant different testing depth.
- Who consumes the results? Internal (developer remediation) vs formal (bank partner, ISO, tender) determines format and depth.
- When was it last tested? Never tested + holding sensitive data = start with a full audit; tested regularly = lighter change-focused testing.
Frequently asked questions
Why is a pentest expensive when scanning tools are free? The tools are free; you’re paying for the person who knows where systems like yours usually leak, interprets results (tools flood you with false positives), and writes fixes your developers can execute.
How often should a pentest be done? Most organizations need one thorough assessment, then lighter testing after major changes or annually — unless a compliance requirement (bank partner, regulator) mandates a specific frequency.
Is a pentest one-time, or a subscription? One-time is a legitimate product — security changes when your system changes, not when the calendar says so. Subscriptions make sense for teams shipping features routinely; if your system rarely changes, a subscription is cost without value.
If you’d rather discuss scope before discussing numbers — that is the right order — tell us about your system via the security audit service or the contact page. Also useful: the self-service security checklist, and a real example of an audit that ended in fixes in the IAC infrastructure case study.