$ penetration testing cost 2026

Vendor-neutral penetration testing cost reference for 2026. Twenty named vendors, every quote-only vendor flagged as such, every published price linked to its source and verified June 2026. No affiliate links, no sponsored placements.

$ answer --question="How much does a penetration test cost in 2026?"

Across the 20 vendors tracked here, the only fully published manual-pentest subscription floor is Astra Security at $1,999 per year per target. Detectify publishes a from-price (EUR 90 per month for one application) for its continuous scanning product, which is not a manual pen test. The remaining 18 vendors publish tier structures but no dollar figures, or are quote-only entirely. Typical project bands sourced from vendor-published cost guides sit at $4,000 to $30,000 for a single web app, $4,000 to $20,000 for an external network test, $8,000 to $50,000 for an internal network test, and $30,000 to $150,000 for a full red-team engagement.

Last verified June 2026

$ stat --slot=1

Vendors tracked

PtaaS, boutique, audit firm, platform

$ stat --slot=2

Publish a price floor

Astra plus Detectify from-price

$ stat --slot=3

Quote-only

Sales call required before any number

$ stat --slot=4

$1,999

Cheapest manual-pentest subscription

Astra Pentest Basic, per year per target (Detectify scanning starts lower at EUR 90/mo but is not a manual pen test)

$ chart --metric=cheapest-published-rate --sort=asc

Cheapest published rate, per vendor, US dollars

Verified June 2026

18 of 20 vendors are quote-only. Among the 2 with a published number, the spread is 22.2x from Detectify ($90) to Astra Security ($2.0k).

cheapest publisheddearest publishedquote-only vendorSource: each vendor pricing page, see vendor index for live URL.

$ scope --calculator

Pick scope, asset count, and depth. We return per-vendor bands where a price is published and label quote-only vendors as such. We never invent a number for a vendor that does not publish one.

$ estimate --scope=web-app --assets=1 --depth=standard

scopeassets in scopedepth

vendor	model	band	status
Astra Security	ptaas-subscription	$3.6k - $33k	Published
Cobalt.io	ptaas-credit	Quote only, contact vendor	Quote only
HackerOne	project-quote	Quote only, contact vendor	Quote only
Bugcrowd	project-quote	Quote only, contact vendor	Quote only
Synack	project-quote	Quote only, contact vendor	Quote only
NetSPI	project-quote	Quote only, contact vendor	Quote only
Rapid7	project-quote	Quote only, contact vendor	Quote only
Bishop Fox	project-quote	Quote only, contact vendor	Quote only
Trustwave SpiderLabs	project-quote	Quote only, contact vendor	Quote only
Coalfire	project-quote	Quote only, contact vendor	Quote only
Praetorian	project-quote	Quote only, contact vendor	Quote only
Mandiant	project-quote	Quote only, contact vendor	Quote only
CrowdStrike	project-quote	Quote only, contact vendor	Quote only
Secureworks	project-quote	Quote only, contact vendor	Quote only
Pentera	subscription-platform	Quote only, contact vendor	Quote only
Intruder.io	subscription-platform	Quote only, contact vendor	Quote only
BreachLock	ptaas-subscription	Quote only, contact vendor	Quote only
DeepSeas Red (ex RedTeam Security)	project-quote	Quote only, contact vendor	Quote only
Schellman	project-quote	Quote only, contact vendor	Quote only

Bands shown only for vendors with a published price floor. We do not infer rates for quote-only vendors. Bands scale a vendor's published floor across the scope band, asset count, and depth multiplier. Always confirm directly with the vendor before committing.

$ list --vendors

Twenty vendors, sorted into two groups: publishes a usable price, and quote-only. Each name links to the per-vendor page with tier matrix and source link.

$ vendor --slug=astra
published
Astra Security
PtaaS
$1,999 annual subscription, 1 target
PtaaS vendor with a fully published price card. One of the few firms in this index where the headline number does not depend on a sales call.
open page source
$ vendor --slug=detectify
published
Detectify
Platform
$90 Application Scanning, 1 domain, from EUR 90/month
Continuous external attack-surface and application-scanning platform. Not a manual pen-test firm. Published from-prices, scales with subdomain or API count.
open page source

$ vendor --slug=cobalt
quote-only
Cobalt.io
PtaaS
Quote only, contact vendor
PtaaS pioneer. Publishes a three-tier model (Standard, Premium, Enterprise) and a credit unit (1 credit = 8 hours of offensive testing) but routes every tier to a quote.
open page source
$ vendor --slug=hackerone
quote-only
HackerOne
Bug bounty
Quote only, contact vendor
Bug-bounty platform with a separately scoped Pentest line. Pricing is contact-sales only; tiers and starting figures are not published.
open page source
$ vendor --slug=bugcrowd
quote-only
Bugcrowd
Bug bounty
Quote only, contact vendor
Bug-bounty platform with a Pen Test as a Service product. No public pricing; every sizing path leads to a sales call.
open page source
$ vendor --slug=synack
quote-only
Synack
PtaaS
Quote only, contact vendor
Hybrid PtaaS plus managed-service vendor. Markets a 32% lower-cost claim against traditional pentest but publishes no rates.
open page source
$ vendor --slug=netspi
quote-only
NetSPI
PtaaS
Quote only, contact vendor
Enterprise PtaaS provider with delivery on the NetSPI Platform. No public pricing; every CTA is Contact Us.
open page source
$ vendor --slug=rapid7
quote-only
Rapid7
Boutique
Quote only, contact vendor
Pen-test service line within Rapid7 Security Consulting. Pricing is quote-based and not published.
open page source
$ vendor --slug=bishop-fox
quote-only
Bishop Fox
Boutique
Quote only, contact vendor
Premium boutique offensive-security firm. Engagement-only; no public pricing of any kind.
open page source
$ vendor --slug=trustwave-spiderlabs
quote-only
Trustwave SpiderLabs
Boutique
Quote only, contact vendor
Trustwave SpiderLabs offensive consulting. The Trustwave services URL now redirects to LevelBlue. Pricing remains quote-only.
open page source
$ vendor --slug=coalfire
quote-only
Coalfire
Audit firm
Quote only, contact vendor
Coalfire Offensive Security, an arm of an audit and compliance firm. Pen test is sold standalone or bundled into FedRAMP, PCI, and HITRUST engagements. No public pricing.
open page source
$ vendor --slug=praetorian
quote-only
Praetorian
Boutique
Quote only, contact vendor
Mid-large boutique with a managed offensive-security platform (Chariot). Pen test is engagement-only and quote-priced.
open page source
$ vendor --slug=mandiant
quote-only
Mandiant
Boutique
Quote only, contact vendor
Mandiant (Google Cloud) Consulting. Pen test sits inside the broader Mandiant offensive and advisory portfolio. No public pricing.
open page source
$ vendor --slug=crowdstrike
quote-only
CrowdStrike
Boutique
Quote only, contact vendor
CrowdStrike Services pen-test line, often bundled with Falcon EDR and IR retainers. No public pricing.
open page source
$ vendor --slug=secureworks
quote-only
Secureworks
Boutique
Quote only, contact vendor
Secureworks adversarial security testing. Now part of Sophos after the 2025 acquisition. Service pages now sit under sophos.com. Pricing remains quote-only.
open page source
$ vendor --slug=pentera
quote-only
Pentera
Platform
Quote only, contact vendor
Automated security validation platform. Not a manual pen-test service. Subscription-based, but pricing is not published.
open page source
$ vendor --slug=intruder
quote-only
Intruder.io
Platform
Tiered subscription, exact prices on application
Continuous vulnerability scanning platform with a four-tier plan map (Essential, Cloud, Pro, Enterprise). Tiers are public but exact dollar figures are not currently displayed.
open page source
$ vendor --slug=breachlock
quote-only
BreachLock
PtaaS
Three tiers published, prices on application
PtaaS vendor publishing a three-tier matrix (Standard, Extended, Extensive) of features but no dollar figures. Every tier routes to a discovery call.
open page source
$ vendor --slug=redteam-security
quote-only
DeepSeas Red (ex RedTeam Security)
Boutique
Quote only, contact vendor
RedTeam Security was acquired and rebranded as DeepSeas Red. Pen-test sits inside the DeepSeas managed-services platform. No public pricing.
open page source
$ vendor --slug=schellman
quote-only
Schellman
Audit firm
Quote only, contact vendor
Audit-led firm. Pen test is sold standalone or bundled inside SOC 2, ISO 27001, PCI, and HITRUST engagements. No public pricing.
open page source

Totals: 20 vendors tracked, 2 with a published price floor, 18 quote-only. Full quote-only context at /quote-only-vendors.

$ open --hubs

Three hub pages route to every individual page on this site. Every page is two clicks or fewer from here.

$ open --route=/vendors
All vendors
Index of all 20 vendor pages, grouped by published vs quote-only.
open
$ open --route=/compare
All compare pages
Side-by-side head-to-heads across the most asked vendor pairs.
open
$ open --route=/topics
All topic pages
Scope, compliance, day-rates, RFP template, buying guide, hidden costs.
open

$ read --buyer-guides

The most-read topic pages, linked direct from the homepage so they are one click in.

$ open --route=/penetration-testing-cost-2026
Penetration testing cost 2026: ultimate guide
End-to-end overview of what shapes the bill across scope, vendor, and country.
open
$ open --route=/hidden-pentest-costs
Hidden penetration testing costs
The line items that do not show up in the headline quote.
open
$ open --route=/how-vendors-price-pentests
How vendors price pen tests
Subscription, credit, project quote, day-rate. What each model actually charges for.
open
$ open --route=/pentest-vs-alternatives
Pen test vs alternative categories
Bug bounty, vuln scan, automated security validation. When each one substitutes for a pen test.
open
$ open --route=/pentest-cost-smb
Pen test cost: SMB
Under 100 staff, single web app, single AWS account. What to budget.
open
$ open --route=/pentest-cost-mid-market
Pen test cost: mid-market
100 to 1,000 staff, hybrid cloud, compliance triggers.
open
$ open --route=/pentest-cost-enterprise
Pen test cost: enterprise
1,000+ staff, multi-cloud, programmes not projects.
open
$ open --route=/pentest-buying-guide
Pen test buying guide
Stage-by-stage from scoping call to delivered report.
open
$ open --route=/pentest-rfp-template
Pen test RFP template
Twelve questions every quote-only vendor should answer.
open
$ open --route=/pentest-implementation-cost
Pen test implementation cost
What you spend before and after the test itself.
open

$ cross-link --siblings

Direct and adjacent sister sites from the same independent network. All are deployed and live. Cross-links target the bare domain.

$ sister --domain=pentestingcost.com
pentestingcost.com
Same head term, warm-cream editorial layout. Use as a second opinion on vendor coverage.
$ sister --domain=pentestcostcalculator.com
pentestcostcalculator.com
Calculator-led variant. Use when scope inputs matter more than vendor matrix scanning.
$ sister --domain=siemcostcalculator.com
siemcostcalculator.com
SIEM spend that pen-tests stress-test. Useful when scoping detection coverage alongside offensive validation.
$ sister --domain=edrcost.com
edrcost.com
Endpoint defence cost. Pen tests are how you prove your EDR actually catches the techniques you assumed it would.
$ sister --domain=xdrcost.com
xdrcost.com
Cross-stack detection cost. Pen-test scope sibling for buyers who already run XDR.
$ sister --domain=mdrcost.com
mdrcost.com
Managed detection cost. Many buyers compare annual pen test vs continuous MDR as risk-reduction spend.
$ sister --domain=wafpricing.com
wafpricing.com
WAF pricing. Web-app and API pen tests usually run against an asset already behind a WAF.
$ sister --domain=zerotrustcost.com
zerotrustcost.com
Zero-trust architecture cost. Network and red-team pen tests are the typical validation gate.
$ sister --domain=securityoperationscost.com
securityoperationscost.com
SOC programme cost. Pen-test reports feed purple-team exercises.
$ sister --domain=threatintelagents.com
threatintelagents.com
Threat-intel feeds shape red-team and adversary-emulation scenarios.
$ sister --domain=phishingcost.com
phishingcost.com
Phishing simulation cost. The cheapest form of social-engineering pen test.
$ sister --domain=databreachcost.com
databreachcost.com
Breach economics. The denominator behind pen-test ROI framing.
$ sister --domain=incidentcost.com
incidentcost.com
Incident response cost. Pen tests reduce both the rate and the cost.
$ sister --domain=incidentcost.com
incidentcost.com
Incident cost calculator. Pair with pen-test spend to model net risk reduction.
$ sister --domain=soc2cost.com
soc2cost.com
SOC 2 audit cost. Auditors expect (though do not strictly mandate) an annual pen test.
$ sister --domain=soc2certificationcost.com
soc2certificationcost.com
SOC 2 certification cost. Pen test usually bundles in.
$ sister --domain=soc2compliancecost.com
soc2compliancecost.com
SOC 2 compliance scope sibling.
$ sister --domain=iso27001cost.com
iso27001cost.com
ISO 27001 cost. Annex A.8.8 vulnerability management maps to pen-test evidence.
$ sister --domain=iso27001certificationcost.com
iso27001certificationcost.com
ISO 27001 certification cost sibling.
$ sister --domain=hipaacompliancecost.com
hipaacompliancecost.com
HIPAA risk-analysis cost. Pen test is one accepted input to the risk analysis.
$ sister --domain=pcicompliancecost.com
pcicompliancecost.com
PCI DSS cost. Requirement 11.4 mandates an annual pen test.
$ sister --domain=gdprcompliancecost.com
gdprcompliancecost.com
GDPR Article 32 testing measures cost.
$ sister --domain=gdprfine.com
gdprfine.com
GDPR enforcement context. ROI framing for pen-test spend.
$ sister --domain=fedrampcost.com
fedrampcost.com
FedRAMP cost. Annual pen test is a hard requirement.