How Much Does a Penetration Test Cost? A Buyer’s Breakdown

A one-off manual penetration test in 2026 typically lands somewhere between €5,000 and €30,000, and the honest answer to "how much does a penetration test cost" is that the spread is real — it's driven by what you're testing, how deep the tester goes, and how much of the work is a human versus a tool. A tightly scoped web app might quote at €5,000. A multi-week red-team engagement can pass €50,000. Both are called "penetration testing," and the price alone won't tell you which one you're actually buying.

I buy and review pentests for a living — for our own audits and for teams heading into SOC 2, ISO 27001, and PCI DSS assessments. The single most useful thing I can hand a buyer isn't a magic number. It's the map of what moves the number, so that when three quotes come back at €6,000, €14,000, and €31,000 for what looks like "the same test," you can see exactly where the difference is and decide what you're willing to pay for. That's what this breakdown is for.

Every figure below is a market estimate, not a quote. Real scoping produces real prices; anyone who quotes you before asking a single question is selling something else.

Last updated: 2026.

Penetration testing cost at a glance

Here's the quick version before the detail. For a single, clearly scoped engagement in the EU market:

• Automated vulnerability scanner (subscription) — roughly €1,000–€10,000/year. Useful, but this is not a penetration test.
• Autonomous AI black-box pentest — from €5,100 per test, full report in about 5 hours.
• Manual project pentest (single app or perimeter) — roughly €5,000–€20,000.
• Larger or multi-target manual engagement — €20,000–€50,000+.
• Full red-team / bespoke adversary simulation — €50,000 and up.

Those bands overlap because the labels overlap. The rest of this guide explains why, so you can place any quote you receive on that scale and know whether it's fair.

What actually drives penetration testing cost

Pentest pricing isn't arbitrary, even when it looks it. Nearly every euro on the invoice traces back to one of these six variables. Change one and the number moves.

Scope and attack-surface size

Scope is the biggest lever, full stop. A pentest is priced in tester-days, and tester-days scale with how much there is to attack. One marketing site is a couple of days. A single web app with 40 authenticated endpoints, three user roles, and a payment flow is a week or two. A whole external perimeter of 200 live hosts plus the apps behind it is a month.

The mistake buyers make is thinking "our whole environment" is a normal ask. It's the most expensive possible ask. Scope to where your risk actually lives — the assets that hold data, handle money, or sit exposed to the internet — and the cost of penetration testing drops without cutting anything that matters.

Type of test

Different test types carry different day counts because they demand different skills and setups. External network testing is comparatively fast. A web application pentest that has to reason about business logic — coupon abuse, tenant isolation, negative-quantity carts — takes longer because a human has to understand what your app is for. Cloud, mobile, and internal Active Directory testing each pull in specialist time. I break the per-type numbers out in the table below.

Depth: black, grey, or white box

How much you tell the tester changes both the cost and what you learn.

• Black box — the tester starts with nothing but a target, like a real external attacker. Cheaper to set up, realistic, but slower to reach depth because they burn time on reconnaissance.
• Grey box — the tester gets credentials and some context (user accounts, API docs). Usually the best value: you skip the recon tax and spend the budget on actual exploitation behind the login.
• White box — full source code and architecture access. The most thorough and the most expensive, because reading code and reviewing design is slow, senior work.

Most buyers over-index on black box because it "feels" like the real thing. For finding the bugs that hurt you, grey box usually gets more coverage per euro.

Seniority of who's doing the testing

This is the hidden multiplier behind two quotes that look identical on paper. A junior running a scanner and lightly triaging the output is one price. A senior who has actually chained an IDOR into full account takeover is another. Day rates for experienced testers commonly sit in the €800–€2,000 range (higher in the US, often quoted in dollars), and a serious engagement is 5–15 of those days. When a quote comes in suspiciously low, the seniority of the person on your target is usually where the cost was cut.

Methodology and reporting

A provider working to a recognized standard — PTES, NIST SP 800-115, OWASP for apps and APIs — is charging for systematic coverage, not a poke-around. Reporting adds real hours too: a report with an executive summary your auditor can read and an engineering layer your developers can act on takes a day or more to write well. Compliance mapping (aligning findings to SOC 2, ISO 27001, PCI DSS v4.0 Req 11.4, GDPR Art. 32) is more billable time — and worth it if the test exists to clear an audit.

The day-rate model

Underneath most project quotes is a simple equation: day rate × number of days + reporting. Once you know that, "pen testing rates" and "price list" requests stop being mysterious. There is no universal price list, because there's no universal number of days — a "web app pentest" is 3 days for one app and 12 for another. When you ask a provider for a price, you're really asking them to estimate days. Ask them to show the day count and the rate, and the quote becomes something you can actually compare.

If a provider can't tell you how many tester-days your quote is built from, they either haven't scoped it or don't want you to see the math. Both are reasons to ask again.

Typical 2026 penetration testing prices by engagement type

Below are market-estimate ranges for a single, clearly scoped engagement in 2026. Treat them as a sanity check on the quotes you receive, not as prices you can order from. The real number depends on the size and complexity of your target, and it always varies between providers and regions.

Engagement type	Typical 2026 market range	What moves it
Automated scanner (subscription, not a pentest)	€1,000–€10,000 / yr	Number of assets, scan frequency
Autonomous AI black-box pentest	from €5,100 / test	Flat entry; scope of target
External / network pentest	€4,000–€12,000	Number of live hosts and services
Web application pentest (single app)	€5,000–€20,000	Roles, endpoints, business logic
API pentest	€5,000–€15,000	Endpoint count, auth model
Internal network pentest	€6,000–€25,000	Host count, AD complexity
Cloud configuration + pentest	€6,000–€20,000	Accounts, services, IAM sprawl
Mobile app pentest (iOS/Android + backend)	€5,000–€18,000	Platforms, backend depth
Full red team / adversary simulation	€50,000+	Duration, objectives, evasion

Two things to read from this table. First, "external penetration testing cost" and "web application penetration testing cost" — the two most-searched by-type queries — sit in overlapping-but-distinct bands, because a web app pentest usually needs more human reasoning than a perimeter sweep. Second, the gap between the scanner subscription at the top and the manual pentest below it is the gap most buyers get burned on: it is entirely possible to pay a manual-pentest price and receive scanner-subscription work. More on that shortly.

Hidden costs nobody puts on the quote

The sticker price is rarely the total price. These are the line items that show up later, and the ones worth asking about before you sign.

Retest / remediation validation fees

You will fix things. Then someone has to confirm the fix actually holds — that you closed the auth bypass instead of relocating it. In a lot of traditional engagements, that retest is a separate invoice at a meaningful fraction of the original cost, and often it triggers a partial re-scope on top. Buyers who get surprised by a retest fee tend to under-test on purpose next time, which quietly defeats the point. Get the retest window and price in writing up front; a provider who bundles validation is invested in you being secure, not just in shipping a PDF.

Scoping and re-scoping

Scoping the engagement is real work, and on complex targets some providers bill for it. More common is the cost of change: add a microservice or a new user role mid-engagement and you can trigger a re-scope and a fresh quote. If your environment moves fast, this recurs every test, and it's a genuine part of the cost of penetration testing over a year — not a one-time line item.

Report gates, compliance exports, and travel

A few more hide in the fine print: the auditor-ready export you need for SOC 2 sometimes sits behind a higher tier; on-site internal testing adds travel and expenses; and a second round of retesting may not be covered by the first retest allowance. None are scams — just costs that belong in your budget model, where the only mistake is not knowing about them until the invoice lands.

The cheap-pentest trap: a scan sold as a pentest

Here's the red flag that costs buyers the most money, and it doesn't look like overpaying — it looks like a bargain.

A large share of "penetration testing" on the market is an automated scan with a company logo on the cover: nuclei or a commercial scanner run against your target, CVSS numbers copied straight out of the NVD, and findings that read possibly vulnerable with no proof attached. You pay a four-figure sum, wait two or three weeks, and receive a PDF you could have generated yourself. The tell isn't the price — it's the absence of evidence.

The difference between a scan and a pentest is validation. A scanner enumerates what might be wrong; a penetration test proves what an attacker can actually do. If that distinction matters for how you spend, we've written it up in full in vulnerability assessment vs penetration testing. For pricing purposes, hold onto this: paying pentest prices for scan output is the most expensive thing you can do, because you're buying false confidence and an audit finding waiting to happen.

Watch for these when a quote looks suspiciously cheap — or suspiciously fast to produce:

• A flat quote with no scoping conversation. Real scope needs questions. A price before any means a canned scan.
• Findings with no proof of concept. "Possibly vulnerable," no reproduction path, is a hypothesis, not a vulnerability.
• A report that's mostly a scanner export. Hundreds of un-triaged rows dumped on your engineers is not a deliverable.
• NVD CVSS scores with no environmental context. A base score pasted without reference to your setup means nobody thought about your risk.
• No named methodology and no named tester. "Our proprietary process" with nothing behind it.

Ask any provider for a redacted sample report before you buy. If they can't or won't show one, that tells you what you'd be receiving. Here's what a real one looks like — every finding with a working proof of concept, not a maybe.

How autonomous AI changes the price-and-coverage math

Full disclosure on where this is written from. BackDoor is an autonomous AI black-box penetration test: a swarm of AI agents attacks your target from the outside — no source code, no backend access — the way a real external attacker would. A complete pentest plus report lands in about 5 hours instead of the usual 4–6 weeks, starting at €5,100.

What that does to the pricing math is worth being plain about, because it changes two numbers, not one.

The first number is the entry price. €5,100 for a full black-box test with proven exploits is well below a manual project pentest, because the labor that makes manual testing cost €10,000–€30,000 — senior tester-days — isn't the constraint. Every finding still ships with a working proof of concept, a CVSSv3 score, and step-by-step remediation, and findings map to SOC 2, ISO 27001, NIST CSF, GDPR Art. 32, and PCI DSS v4.0 for audit readiness. Data handling is zero-retention, with NDA and DPA available.

The second number is the retest cost — and it's where the model quietly wins. Because there's no human crew to re-book and no fresh statement of work to negotiate, re-running the test after you've fixed things doesn't mean re-scoping and re-quoting. You fix, you re-run, you get an updated report. The retest fee that inflates the true cost of a traditional engagement mostly disappears, which means you can actually afford to test again — after every meaningful release instead of once a year. That's the penetration testing as a service promise (continuous coverage) delivered at a price that makes "continuous" real rather than aspirational.

I'll hold this to the same honesty guardrail I'd apply to any vendor. A 5-hour autonomous test is strong for coverage, speed, continuous testing, and pre-audit readiness, and it produces exploit-backed findings you can act on today. It is not a full substitute for a human red team on your single hardest, most bespoke engagement, and it is not a regulatory attestation like DORA TLPT — compliance mapping is mapping, not a certificate anyone issues by running a test. Where it fits, it changes the economics; where human red-teaming is warranted, budget for that separately. If you want the broader picture of engagement types and what each is for, our penetration testing services guide lays them out.

How to reduce your pentest cost without cutting corners

You can spend less without buying worse. Four moves, in order of impact:

1. Tighten the scope to real risk. The fastest way to cut cost is to stop paying for tester-days on assets that don't matter. Test what holds data, handles money, or faces the internet. "Everything" is the most expensive scope you can write.
2. Fix the low-hanging fruit before testing. Don't pay a senior tester's day rate to find your missing security headers and a default admin password. Run a scanner yourself first, clean up the obvious, and let the paid engagement spend its hours on the bugs a tool can't find.
3. Prefer grey box where it fits. Handing over credentials and context skips the recon tax and buys you more exploitation for the same budget. Reserve black box for when you specifically need to test what an outsider can reach cold.
4. Split cadence from depth. Run an affordable autonomous or continuous test on every release for coverage-over-time, and reserve one deep manual engagement a year for the assets that genuinely warrant a human. Paying human-red-team prices for routine per-release checks is how testing budgets get wasted — and skipping between-release testing entirely is how the July auth bug ships unseen until next March.

The goal isn't the cheapest pentest. It's refusing to pay premium prices for scanner output, and refusing to leave real risk untested to save money. Those are different disciplines, and you need both.

The bottom line

The real answer to what a penetration test costs is a range, not a figure: roughly €5,000–€30,000 for a manual project engagement, more for red-team work, and it moves with scope, test type, depth, tester seniority, and how much of the deliverable is genuine validation versus scanner output. Every quote you get is really an estimate of tester-days plus reporting — so ask for the day count and the rate, and compare providers on evidence quality, not just the number at the bottom.

Two rules survive every engagement I've bought. Don't pay pentest prices for a scan — demand a proven proof of concept for every finding, and ask for a redacted sample before you sign. And don't let cost talk you out of testing often enough to matter; a single test in spring says nothing about the code you shipped in autumn.

If you want a fixed starting price and a report you can judge on its merits, scan your target from €5,100 — a full black-box pentest with proven exploits in about five hours — or read a sample report first and decide whether the evidence is worth the price. Either way, buy the test that shows its work.

Last updated: 2026.