What Moves the Price of a Penetration Test
Quotes for the same system arrive at wildly different numbers, and the reason is almost never margin. Testing is sold in tester-days, and the things that move the day count are knowable before you ask anyone for a price.
Ask four firms to quote for the same application and the numbers will not resemble each other. That is the most common complaint about buying security testing, and it is usually read as evidence that the market is opaque or that somebody is overcharging.
It is neither. It is that the four firms scoped four different engagements, and a price is downstream of a scope.
What you are actually buying
A penetration test is people's time. The deliverable is a report, but the cost is tester-days: how many days of skilled work the engagement takes, plus the review and reporting around it.
That single fact explains most of the confusion. Two quotes differ because they assume different day counts, and they assume different day counts because they read your scope differently. Comparing the totals tells you nothing. Comparing the day counts, and what each firm thinks it is testing, tells you everything.
So the first question to ask a quote is not "why is this more expensive" but "how many tester-days is this, and against what".
What moves the day count
The size of the thing, measured properly
Not pages. For an application it is the number of distinct functions and the number of roles that can reach them. An application with four user roles is close to four applications from a testing point of view, because the interesting question is what each role can reach that it should not.
For an API it is the endpoint and parameter count. For a network it is live hosts and exposed services, not IP ranges — a /24 with nine machines on it is nine machines.
Whether the tester has credentials
An unauthenticated test sees what the internet sees. An authenticated test sees what a logged-in user sees, which is where most serious findings live. Authenticated testing across several roles costs more because it is genuinely more work, and it is usually the version worth buying.
How much has to be done by hand
Automated scanning is cheap and finds known patterns. Business-logic flaws — the sequence of legitimate requests that produces an illegitimate outcome — are found by a person reasoning about your system. The proportion of manual effort is the single largest lever on both cost and value, and it is the one most often left unstated in a quote.
Whether retesting is included
A test that finds problems is half a project. Confirming the fixes worked is the other half. If one quote includes retesting and another does not, they are not quotes for the same thing — and the second will produce an invoice later, at a worse moment.
What the report has to be
A findings list is quicker to produce than a report carrying reproduction steps, remediation guidance, a prioritised roadmap and a mapping to the frameworks you answer to. If you need the last one because an auditor will read it, say so before the quote rather than after.
Constraints that are yours, not theirs
Testing windows outside business hours, a production environment that cannot be touched, a staging environment that does not match production, a change freeze in the middle of the engagement, or an environment reachable only through a VPN somebody has to provision. Each adds days without adding coverage, and each is knowable in advance.
Why we do not publish a price list
Because a day rate published here would describe somebody else's engagement. The number that matters to you is the day count multiplied by whatever the market charges when you ask, and only the first half is something an article can help with.
Any figure quoted as "a penetration test costs X" is answering a scope you have not described. Treat a published band the way you would treat a published price for building a house — informative about the market, useless for your building.
Making quotes comparable
Send every firm the same scope document, and ask each to return three things alongside the price:
- Tester-days, split between testing and reporting.
- The testing perspective — unauthenticated, authenticated, and if authenticated, how many roles.
- What is excluded, explicitly.
Quotes that arrive in that shape can be compared. Quotes that arrive as a single number cannot, and asking for the breakdown is itself informative: a firm that cannot decompose its own estimate has not built one.
The cheapest thing you can do before asking anyone
Write down the roles, the functions each role reaches, the environments, and the constraints. Most of the variance between quotes comes from firms guessing at exactly those four things, and each guessing differently.
Security Brigade publishes a pricing primer covering effort bands by engagement type and a worksheet for building an estimate you can hold any firm's quote against. It publishes no day rate, for the reason above.
Continue reading
All articles →VAPT When No Regulator Requires It
Unregulated companies still end up buying penetration tests. The requirement arrives through customers, contracts, insurers and investors — and each wants something slightly different.
Which Indian Regulators Require Security Testing
A map rather than a manual: which regulator binds you, what instrument sets the requirement, and where to read the detail that applies to your entity type.
Writing a VAPT RFP That Gets Comparable Quotes
Most VAPT tenders return responses that cannot be compared. Four ways an RFP causes that, and what to specify instead so three proposals answer the same question.