2026-07-19 · GUIDE · The Offensive Technology team

How much does a penetration test cost in 2026?

Short answer: A serious, scoped penetration test by experienced people usually costs from about $5,000 to $50,000, depending on scope. Published guides put web application tests at $5,000 to $50,000 and external network tests around $5,000 to $20,000, with tester day rates of $1,000 to $3,000. Automated scans are cheap but are not a pentest, and our $100 attack-surface check is a focused first look, not a full test.

Every pentest firm answers this question with "it depends," and then most of them stop, because vague pricing is good for the seller. It does depend, but the ranges are knowable, and if you are buying your first test you deserve to see them before anyone gets you on a call. Here they are.

The market ranges, from public sources

We did not invent these numbers, and you should not take any single vendor's word for them, including ours. Two publicly posted pricing guides from firms in this market:

Astra Security's pentest cost guide puts the average cost of a penetration test at $2,500 to $50,000, with web application tests running $5,000 to $50,000 depending on complexity. Bright Defense's pricing guide lands in the same territory: $5,000 to $30,000 for a web application test, $5,000 to $20,000 for an external network test, and day rates of $1,000 to $3,000 for the people doing the work.

Read enough of these guides and a consistent picture forms: a serious, scoped penetration test of one application or one external network, performed by experienced humans, starts around $5,000 and climbs with scope. Most of the market's quotes are some multiple of a day rate, and the day rate is high because the skill is rare.

What actually drives the price

Four things move a quote more than anything else:

Scope. One web app with two user roles is days of work. Five apps, an API, and a cloud environment is weeks. You are buying human hours, and scope is the hour count.
Depth. "Find what is exposed" is cheaper than "chain findings into demonstrated impact and prove what an attacker could take." The second is what a real pentest means.
Reporting requirements. A report that has to satisfy an auditor, an insurer, or an enterprise customer's security team takes senior time to write and defend.
Who does the work. A junior tester following a checklist and a senior operator who has broken into hardened environments bill very differently, and the findings differ more than the invoices do.

Where our pricing sits, honestly

Our entry product is a $100 attack-surface check. Let us be precise about what that is, because at that price you should be suspicious: it is not a penetration test. It is a focused, time-boxed look at your external surface, run against scope you have verified you own and authorized in writing, reviewed by a senior operator, and delivered as a ranked findings report plus a 30-minute readout with the human who reviewed it. It exists so that a company buying security testing for the first time can start without a five-figure leap of faith.

What the $100 check does not cover: deep manual exploitation, internal networks, business-logic abuse, social engineering, or an audit-grade report. If your customer contract or SOC 2 auditor says "penetration test," the check will not satisfy them, and we will tell you that before you pay, not after.

Full engagements are quoted per scope, because pretending one price fits every environment is how buyers get either overcharged or under-tested. When we quote one, the quote is built from the same thing every honest firm's quote is built from: how many days of senior human effort your scope genuinely needs.

What a full pentest does not cover either

Even the expensive tier has honest limits, and firms that skip this paragraph are selling something. A penetration test is a point-in-time exercise: it tells you about the systems in scope, during the testing window, against the techniques agreed in the rules of engagement. It is not a guarantee, it does not cover the app you ship next quarter, and it says nothing about assets nobody put in scope. That last one matters more than most buyers realize, which is why we think the cheapest useful security spend is knowing your exposed surface in the first place.

How buyers overpay

Two failure modes show up constantly. The first is paying pentest money for a rebranded vulnerability scan: an automated tool run, exported, and reformatted with a logo. If the deliverable arrives suspiciously fast and reads like a database dump, that is what happened. The second is taking the lowest bid without asking who is actually on the keyboard. The market's price floor for real senior work is set by day rates, so a quote far below it is telling you something about the seniority you are getting.

The defense against both is the same: ask what is manual versus automated, ask who performs and who reviews the work, and ask to see a sanitized sample report before you sign.

The short version

Real penetration tests start around $5,000 and scale with scope; the public guides above agree on that more than they disagree. Below that line live scans and checks, which are legitimate tools with honest uses, as long as nobody dresses them up as something they are not.

If you are not ready to spend $5,000 to find out whether you even need to, start where it is cheap. Our $100 check shows you what an attacker sees from the outside, with a senior operator on the readout, and if the result says you need a full engagement, we will say so with the evidence in front of you.

Penetration testing cost: quick answers

How much does a penetration test cost?

Most scoped tests by experienced testers run about $5,000 to $50,000 depending on scope. Published guides put web application tests at $5,000 to $50,000 and external network tests around $5,000 to $20,000, with tester day rates of $1,000 to $3,000.

Why is penetration testing so expensive?

The price is mostly skilled human time. Day rates are high because the skill is rare, and the total climbs with scope, so a larger or more complex target costs more.

Is a $100 pentest a real penetration test?

No. A $100 attack-surface check is a fast, focused first look at what an attacker sees from the outside, not a full manual penetration test. It is lighter than a full engagement, and we say so plainly.

What is the cheapest way to test my security?

Automated vulnerability scans are cheap or free and worth running regularly, but a scan is not a pentest. Use a scan for ongoing coverage, a check for a fast first look, and a full penetration test when you need depth.