$ guide --penetration-testing-cost --year=2026

Everything that shapes a pen-test bill in 2026: scope, vendor model, compliance trigger, country. Every dollar figure here is either source-linked or labelled illustrative.

$ answer --question="What does a penetration test actually cost in 2026?"

The headline answer for a single web-app pen test from a mid-market vendor is roughly $10,000 to $25,000, sourced from vendor-published cost guides. The cheapest fully published manual-pentest subscription floor in this index is Astra at $1,999 per year per target. A full red-team engagement runs $30,000 to $150,000. Eighteen of the twenty vendors we track are quote-only, so a confident vendor-by-vendor price grid is not honest in 2026.

Last verified June 2026

$ stat --slot=1

$4K-30K

Single web-app pen test

Vendor cost-guide bands

$ stat --slot=2

$8K-50K

Internal network pen test

AD depth and segments drive band

$ stat --slot=3

$30K-150K

Red team engagement

Multi-week, multi-vector

$ stat --slot=4

18 / 20

Vendors that are quote-only

In this independent index

$ what --drives --price

Five levers move a quote more than any other factor. Each one is independently negotiable.

Scope size
Asset count, endpoint count, AD-segment count, cloud-account count. The single biggest cost driver.
Methodology depth
Black box, grey box, white box. White box (with source and creds) is most expensive per asset but usually highest-value.
Researcher seniority
Senior consultants cost more per day; senior reports tend to find more impactful issues per dollar.
Retest cycles
Whether retest is included or charged separately. Two retests can double a one-off engagement's price.
Reporting depth
Executive summary, full technical report, attestation letter. Bundle vs unbundle varies by vendor.

$ buying --timeline

step 1TriggerCompliance or risk event
step 2Scoping call1-2 weeks
step 3SOW + PO2-3 weeks
step 4KickoffSchedule + creds
step 5Testing1-4 weeks
step 6Report1-2 weeks after
step 7Retest30-90 days later

$ cat --quote

“A penetration test should answer one question: if an attacker with the same resources spent the same time on us as they did on our peers, what would they reach? Anything less is a vulnerability scan with a person on top.”

Editorial framing from pentestcost.com, June 2026

$ worked --example

$ ledger --illustrative

A 200-person SaaS scoping a compliance pen test

Illustrative example, not a real company

1x web-app pen test, mid-band project (cost-guide): $15,000
1x API pen test, mid-band project (cost-guide): $10,000
1x external network test, mid-band (cost-guide): $8,000
Retest cycle (one round, both apps): $6,000
Attestation letter + executive briefing: Included with most vendors
Project-model annual total: ~$39,000

Illustrative example, not a real company. Bands sourced from vendor-published cost guides; actual quote varies.

$ deeper --reads

Hidden costs
Travel, retest, attestation, change orders.
How vendors price
Subscription, credit, project, day-rate models.
Day-rate index
Region and speciality bands, sourced.
Buying guide
Stage-by-stage from scoping to delivery.