“How much does a pen test cost?” is one of the first questions we’re asked, and the honest answer is: it depends on what you need tested. Two tests that look similar on paper can differ hugely in the work involved. Understanding what drives the price helps you compare quotes fairly and avoid paying for the wrong thing.
Why there’s no single price
A penetration test is priced on the time skilled testers need to explore your systems properly. That time depends on size, complexity and how your environment is built. A five-page brochure website and a customer portal with multiple user roles are both “a website”, but they’re very different jobs.
What drives the cost, by type of test
Web applications and websites
- The number of dynamic pages (pages that change based on user input or data)
- The number of static pages
- The number of input parameters, such as form fields and search boxes
- The number of user roles in scope, because each role means testing different permissions
- Whether we test production or a staging environment
APIs
- How many endpoints there are, and which HTTP methods each one uses
- Whether authentication is needed to communicate with the endpoints
- How many parameters each endpoint accepts
- Whether a test harness is available, such as a Postman collection
Mobile apps
- The number of screens and input parameters
- Whether certificate pinning or jailbreak and root detection are in place, and whether we can test a version without them
- Whether testing covers Android, iOS or both
- How many API endpoints the app relies on
Infrastructure and wireless
- For external tests, the number of live, internet-facing IP addresses
- For internal tests, the number of live hosts, servers and workstations, and whether Active Directory is in scope
- For wireless tests, the number of networks and unique SSIDs
Other factors that affect the price
Testing outside working hours, tight deadlines and particular reporting needs (for example a board summary alongside the technical report) can all affect effort. So can the provider’s accreditation: a CREST-accredited test follows a recognised methodology and standard of reporting, which is why many procurement teams, insurers and regulators ask for it. You can read more in our guide to what CREST accreditation means.
Beware of “pen tests” that are really scans
An automated vulnerability scan is useful, but it isn’t a penetration test. Scanners find known, catalogued weaknesses; testers find the ways those weaknesses can be chained together, the business logic flaws scanners miss, and how far an attacker could actually get. If a quote looks remarkably cheap, check whether it includes manual testing by qualified people.
How to get an accurate quote
The quickest way is to answer the scoping questions above for your environment. Our AskQ Scope Builder walks you through exactly those questions for web, API, mobile, infrastructure and wireless tests, and our team comes back with a tailored proposal. If you’re in the Midlands, our Birmingham penetration testing team can also scope it with you in person.
What you should get for your money
Whatever the price, a professional penetration test should include more than the testing itself:
- A scoping conversation to understand your systems, risks and objectives
- Agreed rules of engagement, covering what’s in scope, when testing happens and who to contact
- Manual testing by qualified people, supported by tools
- A report with an executive summary for leadership and detailed technical findings for your team
- Evidence for each finding, a risk rating and clear remediation advice
- A debrief to walk through the results and answer questions
If any of these are missing, you’re not comparing like with like.
How often to budget for testing
Most organisations test at least once a year, and again after significant changes such as a new application, a major release, a cloud migration or a new connection to a partner. Between tests, continuous vulnerability management keeps known weaknesses under control, so each penetration test can focus on the issues only a skilled tester will find.
Ready to scope your test?
Tell us what you need tested and we’ll come back with a clear, fixed proposal and no surprises.
