How Much Does a Penetration Test Cost?

There is no single honest answer to "how much does a penetration test cost," because the range genuinely spans from a few thousand dollars to well into six figures for the same phrase. What matters is understanding which variables move that number.

Scope size is the biggest single factor

A single web application with a handful of user roles costs meaningfully less to test thoroughly than a sprawling environment spanning dozens of applications, an internal network, and cloud infrastructure across multiple providers. Cost scales with how much ground actually needs to be covered, not with how impressive the final report sounds.

Testing approach changes the effort required

A black box engagement typically costs more per finding than a white box one, since the tester spends real time on reconnaissance a white box engagement skips entirely. See our comparison of black box, white box, and gray box testing for how that tradeoff actually plays out.

Depth of exploitation matters

A detection-only engagement, or one where exploitation is limited to careful, non-destructive confirmation, is generally less time-intensive than a full red team exercise aiming to achieve a specific objective through the environment. See red team versus penetration testing for why those two engagement types carry different effort profiles.

Reporting and retesting add real cost too

A thorough, well-structured report, one that actually holds up to scrutiny and maps cleanly to whatever compliance framework you need, takes real time to produce well. A retest to confirm fixes actually worked is a separate deliverable, and whether it is included in the original price or billed separately is worth confirming before you sign.

The cheapest option is rarely the cheapest overall

A shallow test that misses a real, exploitable vulnerability has not actually saved money, it has deferred a much larger cost to whenever that vulnerability is eventually found by someone else. See the real cost of skipping a penetration test for the fuller version of that argument.