The short answer
A penetration test is a hired expert trying to break into your systems, with permission. Most pentests are priced by effort: how many tester-days the scope needs. A small web app might take 3 to 5 days. A large platform with APIs, mobile apps and cloud can take several weeks. Day rates vary by country and seniority. So the clearest way to compare quotes is to ask each firm how many days they plan to spend and who will do the work.
As a rough market guide, many single web app or external network tests across the industry cost from a few thousand to around twenty thousand US dollars. Broad multi-system or red team engagements (realistic attack simulations) cost more. These are rough market ranges, not NextGarrison prices and not a price list. Your own quote depends on your scope.
What drives the price
- Size of the target: number of pages, user roles, API endpoints (points where other software connects to yours), IP addresses or cloud accounts.
- Complexity: SaaS shared by many customers, payment flows and custom business logic take longer to test properly.
- Testing approach: black box (no information) takes longer to reach the same depth as gray box (test accounts and documentation).
- Type of test: web, API, mobile, internal network, cloud, social engineering (tricking staff), AI features or a full red team exercise.
- Compliance needs: PCI DSS (the card payment security standard) or SOC 2 may require specific coverage and report formats.
- Retesting and reporting: whether a retest and a customer-shareable letter are included.
- Timing: rush jobs and out-of-hours testing usually cost more.
How to compare quotes
Two quotes for "a web app pentest" can describe very different work. Ask every firm the same questions:
- How many tester-days are included, and how senior are the testers?
- Is the testing mainly manual, or mainly automated scanning?
- What exactly is in scope, and what is excluded?
- Is a retest included after we fix the findings?
- Can we see a sample report?
- Will we get a summary or letter we can share with customers and auditors?
Red flags
- A very low fixed price with no questions about your app. That is usually an automated scan.
- A report full of scanner output with no proof, impact or fix for each finding.
- No named testers or no information about their experience.
- No retest, so you cannot prove the issues are fixed.
A scan is useful and cheap, but it is not a penetration test. Read vulnerability assessment vs penetration testing for the difference.
How to keep the cost down
- Choose gray box testing and give testers accounts and API docs. You get more depth per day.
- Fix the easy issues first with a scan, so paid tester time goes to the hard problems.
- Scope tightly around the systems that matter for the deal or audit.
- If you release often, compare an annual test with penetration testing as a service.
We send a fixed, scoped quote after a short call, with the tester-days and retest spelled out. Ask for one here.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.