A one-off penetration test typically costs between $5,000 and $50,000, depending on scope and type. Automated platforms start lower, around $3,000 to $4,000 a year. US enterprises with more than 3,000 employees spend an average of $187,000 per year on pentesting. The price tells you less than what the vendor actually tests and how they validate it.
- Published prices vary widely: $5,000–$30,000 for a web application, $10,000–$50,000 for a cloud environment, starting at $3,500 for an automated scan. US enterprises average $187,000 a year on pentesting (Pentera, 500 CISOs, 2025).
- The biggest cost driver is scope: how many applications, how deep the tester goes, and whether the test includes the supply chain, mobile apps and cloud infrastructure.
- Six questions tell you more about a vendor than the price tag. They reveal whether the vendor tests what attackers actually target.
- 96% of organizations change their IT environment at least quarterly, but most test once a year. That gap is where breaches start.
- 52% of CISOs expect to run continuous offensive testing within a year (a16z, October 2026, 100 CISOs).
How much does a penetration test cost?
It depends on the type of test, the scope, and how much of the work is done by a human versus a tool. The table below uses published vendor data only.
| Type | Typical range | Source |
|---|---|---|
| Network penetration test | $5,000–$25,000 | CyCognito |
| Web application | $5,000–$30,000 per app | CyCognito |
| Mobile application | $7,000–$35,000 per app | CyCognito |
| Cloud environment | $10,000–$50,000 | CyCognito |
| API penetration test | $5,000–$25,000 per API | CyCognito |
| AI-powered web app test (automated) | From $3,500 per test | Intruder |
| Managed pentest platform (annual) | $2,999–$9,999+ per year | Astra |
At the enterprise end, Pentera surveyed 500 US CISOs and senior security executives at companies with more than 3,000 employees and found that the average annual spend on penetration testing is $187,000 — roughly 11% of the IT security budget.
These numbers are useful as a sanity check. A quote well below the range for your scope usually means something is being skipped. A quote well above it should come with a clear explanation of what the extra money buys.
What drives the price of a penetration test?
Scope, methodology and the depth of human involvement. Seven factors come up in nearly every engagement we scope:
- Scope and complexity. A single web application is a different engagement from a web app plus its mobile clients, APIs, cloud infrastructure and CI/CD pipeline. More components, more time.
- Test type. A network scan costs less than a full red team engagement that chains findings across the external surface. A red team simulates a real attacker end to end; a focused pentest validates a specific application.
- Manual versus automated. Fully automated tools cost the least but miss business-logic flaws, access-control errors and anything that requires understanding the application's context. A skilled tester finds what tools miss, and validates that a finding is actually exploitable — not just theoretically vulnerable.
- Tester experience. There is a measurable difference between a junior analyst running a scanner and a senior operator who has spent years attacking production systems. The latter costs more and finds more.
- Compliance requirements. PCI DSS, DORA, SOC 2 and industry frameworks each have specific testing requirements. Meeting them adds structure and deliverables to the engagement.
- Remediation support and retesting. Some vendors hand over a PDF. Others retest after the fixes are deployed and confirm the issue is closed. A finding reported but not verified as fixed is a finding that's still there.
- Location. Vendor rates vary by geography. A firm with senior operators in the US or Israel charges differently from an offshore team running automated tools.
The bottom line: you can't compare prices without comparing scopes. A $5,000 engagement that scans your perimeter and a $50,000 engagement that attacks your production environment from the outside — including your mobile apps, your CI/CD pipeline and your employees' personal GitHub accounts — are not the same product.
Is an annual pentest enough?
For compliance, often yes. For security, usually no. The UK's National Cyber Security Centre puts it plainly: a penetration test gives confidence only "at the time of the test," and it is "not uncommon for a year or more to elapse between penetration tests."
What changes in between? Pentera's data says 96% of organizations make changes to their IT environment at least quarterly. New deployments, new APIs, new vendors, new credentials. Each change can open a path that wasn't there during the last test.
The compliance picture sets a baseline:
| Framework | Minimum testing requirement |
|---|---|
| PCI DSS 11.4.3 | External penetration test at least every 12 months |
| DORA Art. 26(1) | Threat-led penetration testing at least every 3 years |
| SOC 2 (Type II) | Annual testing is the norm for Trust Services Criteria |
| ISO 27001 | Periodic testing; frequency not specified |
These are floors, not recommendations. A PCI audit won't ask whether you tested when a new API went live in February. An attacker will find that API regardless.
The market reflects this. In a16z's October 2026 survey of 100 CISOs at companies with 1,000 or more employees, 83% said more frequent offensive testing matters. Only 18% run continuous testing today. But 52% expect to within a year. The question isn't whether testing should be continuous — it's how to get there without multiplying the cost.
How do you choose a penetration testing vendor?
Ask what they actually test, not how many certifications they carry. In our practice we've found that six questions reveal more than any sales deck. They're adapted from a checklist we built for organizations evaluating their software vendors' security, and they apply just as well when you're the one buying the test.
1. Does the vendor test what's actually on the internet, or only what you hand them?
The best engagement starts from your company name alone. The vendor maps the attack surface independently. If they only test the IP range you provide, they'll miss the staging server someone left up, the vendor's SaaS that a subdomain points to, and the personal repository where an employee pushed internal code to give their AI coding tool context.
2. Does the vendor prove exploitability, or just report vulnerabilities?
A vulnerability scan produces a list. A penetration test proves a path. The difference is whether you see the request and the response at every step, or a CVSS score and a recommendation. If the vendor's report doesn't show you exactly what they reached and how, you're paying for a list, not a test.
3. Does the vendor hunt for leaked credentials and secrets?
In most engagements we run, the root cause is a credential: a token in Slack, an API key compiled into a mobile app, a service-account key in a git history that someone deleted from the code years ago and never rotated. If your vendor doesn't look for these, they're skipping the step where most real attack chains begin.
4. Does the vendor touch the CI/CD pipeline and supply chain?
A compromised build pipeline doesn't need to attack you directly. It inserts its code into the version you install willingly, signed and approved. If the vendor considers the pipeline out of scope, that's where the highest-impact findings tend to live.
5. Does the vendor check what your AI tools can access?
Every internal AI assistant that searches across Slack, wikis and code repositories does what it's designed to do. The question is whether it also finds the secrets. If nobody has tested that, you're trusting a system that indexes everything to never surface anything dangerous.
6. What happens after the report?
Ask for: a retesting cycle after remediation, a clear SLA for critical findings, and an answer to the 24-hour question — a critical CVE drops on Saturday, and you need to know within hours whether you're exposed and exploitable. Who do you call?
The answers matter less than the response. A vendor who answers question 4 confidently and in detail has a process. A vendor who points you to an ISO certificate doesn't. Ask before the contract is signed — the same questions are worth far more as a requirement than as a request.
- Compare scope: what does the vendor test versus what the six questions cover?
- Request a sample report — look for request/response evidence, not just CVSS tables
- Confirm retesting is included, not an add-on
- Verify coverage of mobile apps, APIs, cloud, CI/CD and leaked credentials
- Check whether the vendor tests your internal AI tools and code-generation workflows
- Ask the 24-hour question: critical CVE on Saturday, what's the SLA?
What we find in practice
The same patterns, at organizations that never expected them. These are from recent engagements, with client names removed:
A retail platform's public Android app shipped a plaintext source-control password. It opened 232 private repositories. In the git history of one sat a cloud service-account key deleted in 2018. It still worked. It gave write access to the storage bucket serving checkout-page JavaScript to 156 live retail sites.
A public Grafana instance had anonymous access on. The "Viewer" role was enough to read the database connection string and send arbitrary SQL through its proxy. The only thing preventing data extraction was that the database happened to be down. Not a permission — luck.
At a financial services company, internal and external code ran on the same CI runner. One pull request exfiltrated the token that signs and publishes software. From pull request to signed release: under an hour.
None of these needed a zero-day. Each is what a thorough external test finds, and what a price-driven automated scan misses.
None of these needed a zero-day. Each is what a thorough external test finds, and what a price-driven automated scan misses.
FAQ
How much does a basic penetration test cost?
Automated web application tests start around $3,000 to $4,000 per year (Astra, Intruder). A manual, focused web app penetration test typically runs $5,000 to $30,000, depending on scope and complexity (CyCognito).
How often should we run a penetration test?
At minimum, follow your compliance framework: PCI DSS requires at least every 12 months, DORA at least every 3 years. Beyond compliance, test after every significant change. 52% of CISOs expect to run continuous offensive testing within a year (a16z, 2026).
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan runs automated checks against known databases and reports what might be vulnerable. A penetration test has a human — or an AI agent supervised by a human — try to exploit the findings, chain them, and prove what an attacker would actually reach. The scan finds the lock; the test picks it.
Should we choose the cheapest vendor?
Not unless the scope is identical. A lower price usually means a narrower scope: fewer assets tested, no manual validation, no retesting. Compare what each vendor tests against the six questions above, and check whether they cover CI/CD, mobile apps, leaked credentials and AI tools.
What is continuous penetration testing?
An ongoing engagement where AI agents and human operators test the external attack surface continuously. Findings are reported as they're validated, not in a quarterly PDF. The model matches the speed at which your environment changes and attackers operate.
The bottom line
The cost of a penetration test matters. It just matters less than what the test actually covers. A $10,000 engagement that skips your CI/CD pipeline, your employees' personal repositories and your AI tools leaves the paths attackers walk through today untested.
Ask the six questions. Compare the scope, not just the price. And if you're still testing once a year in an environment that changes every quarter, the gap between tests is where the risk lives.
My question for you: when was the last time you compared what your pentest vendor covers against what an attacker would actually try?
Sources
- CyCognito, How Much Does a Penetration Test Cost? (2026)
- Pentera, The State of Pentesting 2025 (May 2025, 500 US CISOs at companies with >3,000 employees)
- Intruder, AI-Powered Pentesting (2026, pricing page)
- Astra, Pricing (2026, pricing page)
- NCSC (UK), Penetration testing
- PCI Security Standards Council, PCI DSS v4.0 §11.4.3
- EU, Digital Operational Resilience Act (DORA), Art. 26(1) (2025)
- a16z, The New Security Agenda (October 2026, 100 CISOs at companies with 1,000+ employees)
- Bain & Company, via a16z: attack timeline from ~4 weeks to ~18 hours