$ cost --segment=smb

Under 100 staff, single web application, single AWS account, no on-site network test. The cheapest band in the index.

$ answer --question="What should an SMB budget for a pen test in 2026?"

An SMB with one web app, one API, and one cloud account can land in the $2,000 to $8,000 band per year on a PtaaS subscription (Astra starts at $1,999/yr per target). A one-off project pen test at the SMB scope runs $4,000 to $12,000 from a mid-market boutique. Add $1,000 to $3,000 for a retest cycle if not included.

Last verified June 2026

$ stat --slot=1

$1,999/yr

Astra PtaaS Basic floor

Per target, source-linked

$ stat --slot=2

$4-12K

Project quote band

Vendor cost-guide mid-market

$ stat --slot=3

1-2

Assets in scope

Typical SMB engagement

$ stat --slot=4

1 wk

Test duration

Typical SMB engagement

$ fit --by-stack

For an SMB on a single web app plus API, the published-floor PtaaS vendors (Astra) and the continuous-scanning platforms (Detectify, Intruder) cover most of the field. Quote-only enterprise boutiques are usually overkill at this scale.

step 1DecidePtaaS or project?
step 2Scoping1 call, 30 min
step 3SignClick-through
step 4KickoffSchedule + creds
step 5Test1 week
step 6Report1 week

$ ledger --illustrative

Worked SMB budget: 50-person SaaS, one web app + API

Illustrative example, not a real company

Astra Pentest Basic, 1 target (the web app): $1,999
Astra Pentest Basic, 1 target (the API): $1,999
Retest cycles: Included
Auditor attestation letter: Included
Annual cost: $3,998

Illustrative example, not a real company. Sourced from getastra.com/pricing, verified June 2026.