$ pentest --target=human

Phishing, vishing, in-person pretexting. The cheapest social-engineering category usually rolls into broader awareness platforms; bespoke campaigns sit higher.

$ answer --question="What does a social-engineering pen test cost?"

A bespoke phishing campaign from a pen-test vendor runs $3,000 to $15,000 per campaign in 2026. Vishing add-ons cost $2,000 to $8,000. In-person pretexting and physical-entry hybrid engagements clear $10,000 to $50,000. Continuous phishing-simulation platforms (Knowbe4 et al, outside this index) start much lower per-user per-month.

Last verified June 2026

$ stat --slot=1

$3-15K

Bespoke phishing campaign

Per campaign

$ stat --slot=2

$2-8K

Vishing add-on

Per engagement

$ stat --slot=3

$10-50K

Pretexting / physical hybrid

Per engagement

$ stat --slot=4

Per-target

Pricing axis

Recipient count drives band

$ drivers --price

Recipient count
More targets, more sending infrastructure, more results triage.
Pretext custom build
Bespoke lure tailored to your industry. Reusable templates cheaper.
Channel mix
Email, SMS, voice, in-person each adds cost.
Click-and-credential capture
Capture infrastructure required, often custom domains and TLS certs.
Out-of-band escalation
If a target falls for the lure and escalates internally, the vendor needs a handoff plan.