Penetration Testing Pricing

It depends on scope. Our fixed-price tests start at $4,500 for a small web app or API, $7,500 for a full web application or API, and $10,000 for an external and internal network test. Phishing can be added from $3,500, and our full assessment (web app, network and phishing) is $20,000. Each includes a free retest. Larger environments and ongoing programs are priced after a free scoping call.

Scope is the biggest factor: the number of applications, API endpoints, user roles, IP addresses and locations. The type of testing, compliance requirements, social engineering and how many retests you need also affect the price. We scope every engagement on a free call and give you a fixed quote in writing.

Fixed price. Many firms bill by the day, so the final invoice can grow if testing runs over. We quote a fixed price after scoping, so the number you approve is the number you pay. If your scope changes, we agree any change with you in writing first.

Wireless testing is usually priced per site rather than per SSID, because most of the effort goes into testing each location's networks, segmentation and guest isolation. Several SSIDs at one site are normally covered by one site price. Tell us how many locations you have and we will quote a fixed fee.

No. Automated scanners produce high false-positive rates and no human validation. We use automation only to speed up routine discovery. A CREST CRT and OSCP certified tester performs the actual testing and validates every finding, including business logic flaws no scanner can catch.

So you know the cost before you commit. We scope the work on a free call, then quote a fixed price for that scope. You pay for hands-on testing by a CREST CRT and OSCP certified tester, not for account managers or a large sales team. If the scope changes, we agree any change in writing before doing extra work.

Yes. Reports are signed off by a CREST CRT and OSCP certified tester, follow OWASP and NIST methodologies, and are accepted for PCI DSS, HIPAA and SOC 2 audits. Each includes scope, methodology, risk-rated findings with evidence, remediation guidance and retest results.

After you fix the findings, we retest those specific issues to confirm they are properly resolved and update the report. The retest is included at no extra cost within 90 days of the original engagement, with no limit on how many individual findings we re-verify.

You can add or upgrade services at any time, and we credit any overlap toward the new scope. If your needs grow into an ongoing program, the Ongoing Partnership is usually the most cost-effective option, and we will walk you through it on a scoping call.

It is a 30-minute call with no pitch and no pressure. We ask about your environment, compliance requirements and timeline, then send a clear scope and a fixed quote in writing. If we are not the right fit, we will tell you and point you toward someone who is.