$ cost --implementation

The cost around the pen-test invoice. Internal labour, tool licences, remediation engineering. For most buyers this is more than the test itself.

$ answer --question="What does pen-test implementation actually cost?"

Internal staff time on scoping, kickoff, mid-engagement coordination, and remediation engineering typically totals 80 to 200 internal hours per engagement at a mid-market scale. At a $100/hr fully loaded internal rate that is $8,000 to $20,000 of labour around a $15,000 to $30,000 test. Larger engagements have higher labour multipliers.

Last verified June 2026

$ stat --slot=1

80-200h

Internal hours per engagement

Mid-market, single engagement

$ stat --slot=2

$8-20K

Internal labour, $100/hr

Around the test itself

$ stat --slot=3

0.5-1.5x

Labour to invoice ratio

Heuristic, scope-dependent

$ stat --slot=4

30-90d

Remediation window

Before retest

$ cost --map

step 1Pre-testScoping + creds
step 2ActiveDaily checkpoints
step 3ReportTriage findings
step 4RemediateEng cycles
step 5RetestVerify fixes
step 6Post-mortemUpdate controls

$ ledger --illustrative

Implementation cost worked example: mid-market 350-person SaaS

Illustrative example, not a real company

Pre-test internal hours (scoping, asset prep, kickoff): 30h
Active-engagement coordination: 20h
Findings triage and prioritisation: 40h
Remediation engineering (estimated): 100h
Retest coordination + post-mortem: 20h
Total internal hours: 210h
Internal labour at $100/hr fully loaded: $21,000
Pen-test vendor invoice (mid-band, two assets): $28,000
All-in engagement cost: ~$49,000

Illustrative example, not a real company. Vendor invoice and internal labour roughly equal in the mid-market; internal labour pulls ahead as scope grows.