$ pentest --target=webapp

Single web-app pen test. The most common engagement type and the one with the widest published-band data.

$ answer --question="What does a web-app pen test cost?"

A single web-app pen test from a mid-market vendor runs $4,000 to $30,000 depending on app size, methodology depth, and authenticated-flow coverage. Sourced from vendor-published cost guides (Astra, Cobalt, Bishop Fox public ranges). The cheapest published PtaaS floor is Astra at $1,999 per year per target on Pentest Basic.

Last verified June 2026

$ stat --slot=1

$4-10K

Small app band

Single-feature, single role

$ stat --slot=2

$10-25K

Mid app band

Multi-role, authenticated flows

$ stat --slot=3

$25-80K+

Large app band

Multi-tenant SaaS at scale

$ stat --slot=4

$1,999

Astra PtaaS floor

Per target per year

$ drivers --price

App size
Number of routes, user roles, and authenticated flows. The biggest single driver.
Methodology depth
Black-box vs grey-box (creds supplied) vs white-box (source-code review). White-box costs more but finds more impactful issues per dollar.
OWASP coverage depth
Full OWASP Top 10 vs targeted categories. Full coverage is the default for compliance work.
Retest
Retest of fixed findings included or charged separately.
Attestation letter
Bundled or separately priced.