$ compare --models=ptaas,project,retainer

Three procurement shapes for the same offensive-testing budget. The cheapest depends on how many assets and how often you re-test.

$ answer --question="Which pen-test cost model is cheapest?"

At one asset tested once a year, a project SOW is cheapest. At three or more assets with retests, PtaaS subscription tends to win. A retainer (block of pre-paid days) is cheapest where scope is unpredictable and you want vendor availability without per-test SOW friction. None of the three is universally cheaper.

Last verified June 2026

$ stat --slot=1

Project

Cheapest at 1 asset, once/yr

Quoted SOW

$ stat --slot=2

PtaaS

Cheapest at 3+ assets + retests

Subscription

$ stat --slot=3

Retainer

Cheapest at unpredictable scope

Pre-paid day pool

$ stat --slot=4

TCO 24mo

Right comparison window

Year-one specials wash out

$ model --map

$ heatmap --rows=6 --cols=3

Capability	PtaaS	Project	Retainer
Predictable annual budget	✓	◐	✓
Cheapest at 1 asset, once/yr	✗	✓	✗
Cheapest at 3+ assets / 2+ retests	✓	✗	◐
Retest included or discounted	✓	✗	✓
Senior consultant-led	◐	✓	✓
Workflow portal (Jira / SIEM)	✓	◐	◐

step 1Single assetProject SOW
step 22 assetsProject or PtaaS
step 33+ assetsPtaaS usually wins
step 4UnpredictableRetainer