.png)
Penetration Testing Cost Calculator: What Should Your Test Cost?
Quotes for the same test can differ by five times. Pick what is in scope and see an estimated range, the tester-days behind it and what pushes the price up. Then send every vendor the same scoping sheet.
What drives the cost of a penetration test
A pen test is priced in tester-days. The calculator estimates the days each part of your scope usually takes, adds reporting, review and an optional retest, and multiplies by a day-rate band of $750 to $1,250. The low end pairs fewer days with a lower rate, the high end the opposite. Typical is the middle of both.
Scope is what moves the number: how many internet-facing systems you have, how many people and locations sit on the internal network, how many applications and user roles there are, and whether you need proof the fixes worked. A test bought for PCI DSS also needs segmentation testing.
The tester-day estimates and the day-rate band are Cloudskope planning assumptions. The guides listed below explain how pen tests are priced. Your answers stay in your browser unless you ask for the scoping sheet.
2026 penetration testing prices by test type
These ranges come from the calculator above, run for one test type at a time at its default scope, with reporting and a retest included. They are Cloudskope planning estimates, not quotes. Your own scope will move them, so use the calculator for your number.
How we calculated these: each range is tester-days multiplied by a day rate of $750 to $1,250, where the low end pairs the fewest days with the lowest rate and the high end the most days with the highest rate, with reporting and a retest added as extra days, a $2,000 minimum, and every figure rounded to the nearest $500.
Several things add days: more locations on the internal network, more applications, PCI segmentation testing (1 to 2 days), a board-ready summary (half a day to a day) and phone pretexting in a phishing test. A rush start within two weeks adds about 20 percent. Two or more tests in one engagement cost a little less than buying each on its own, because reporting and the retest are shared. External network plus one web application, for example, comes to about $6,000 to $17,500.
Pricing models: fixed fee, day rate, subscription
Pen test vendors price the same work in three ways. Ask which one a quote uses before you compare numbers.
Fixed fee
One price for a written scope. You know the budget up front, and the vendor carries the risk if the work takes longer. The catch is that the price covers only what the scope lists. Anything left out, such as a second application or a retest, is extra, and a vendor quoting blind will pad for unknowns. Ask what is excluded and how many tester-days the fee assumes.
Day rate
You pay for each tester-day used. It is transparent and flexible, which suits work where the scope is unclear or follow-up testing after a fix. The risk is an open-ended bill. Ask for an estimate of days and a not-to-exceed amount in writing.
Subscription
An annual fee for a set number of tests, or for ongoing testing delivered through a platform. It spreads the cost, makes it easier to test after every major change, and keeps findings in one place. Some subscriptions lean heavily on automated scanning. Ask how many human tester-days a year are included, and whether the report you get once a year is one your auditor, insurer or customer will accept.
Red flags in a cheap pen test quote
A low price is not the problem. A low price for work nobody will do is. Check every quote for these before you compare totals.
A scanner run with a cover page. A full test for under about $1,500 is usually an automated vulnerability scan relabeled as a pen test. The report lists possible issues and severity scores, with no proof anyone tried to exploit them.
Unlimited scope for a small fee. "All your IPs and applications" for a few thousand dollars does not add up. At $750 to $1,250 a tester-day, $2,000 buys roughly 1.5 to 2.5 days of a person's time.
A price before any scoping questions. A real quote asks how many IPs, applications, user roles and locations you have. If nobody asked, nobody planned the work.
No named tester. Ask who will do the testing and what they hold (for example OSCP, GPEN or CREST). "Our team" is not an answer.
No rules of engagement. A professional test starts with written authorization, testing windows, systems that are off limits, how production is protected and who to call if something breaks.
No retest. Without one you cannot show an auditor, insurer or customer that the findings were fixed, and you pay again to prove it.
No executive report. If the only deliverable is a technical export, nobody on your board, deal team or audit committee can read it. Ask to see a redacted sample report before you sign.
Want a second opinion on a quote, or a fixed price on your own scope? Talk to an advisor, or see how we run manual penetration testing and vulnerability assessments.
Penetration testing cost questions, answered
Before you buy a test, get the scope right.
Since May 1, 2026, our forensic audits have prevented $2.2M in wire fraud, none of it flagged first by the client's IT team, managed service provider, bank or security tools.
Sources
Opened and checked on October 1, 2026. Further reading on how pen tests are priced. The figures on this page are Cloudskope planning estimates, not a quote.