The cost of a penetration test depends mainly on scope: how many IP addresses, applications, APIs, user roles and environments are tested. It also depends on the test type (external, internal, web app, cloud, social engineering), how much is manual testing versus automated scanning, and whether a retest and attestation letter are included. Two quotes for "a pen test" can differ several-fold because they describe different work, so compare scope and method, not just price.
Indicative market ranges
The figures below are indicative US market ranges for small and mid-size scopes. They are typical ranges across the market, not Defensible's prices; any quote depends on your scope.
| Test type | Typical scope | Indicative range |
|---|---|---|
| External network | Up to ~30 public IPs | $5,000โ$15,000 |
| Internal network | One site / one domain | $10,000โ$25,000 |
| Web application | One app, 2โ3 user roles, plus its API | $10,000โ$30,000+ |
| Cloud configuration (AWS/Azure/M365) | One tenant or account set | $8,000โ$25,000 |
| Social engineering / phishing | One campaign | $3,000โ$10,000 |
| Red team | Goal-based, multi-week | Significantly higher; scoped individually |
The 7 factors that drive price
- Size of scope: IPs, apps, endpoints, API routes, user roles.
- Depth: manual exploitation by experienced testers costs more than an automated scan labelled "pen test", and finds more.
- Test type: internal tests need access set-up; web apps need authenticated testing for each role.
- Environment: production, with careful testing windows, vs staging.
- Compliance requirements: PCI DSS, SOC 2, HIPAA or NYDFS may require specific coverage and reporting.
- Deliverables: executive summary, technical report, attestation letter, readout call.
- Retesting: whether verifying your fixes is included or billed separately.
How to scope a pen test (send this to vendors)
- Business goal: compliance evidence, a customer requirement, pre-launch, or post-incident.
- External IP ranges and domains; number of live hosts.
- Applications: URLs, user roles, API documentation, approximate number of pages or endpoints.
- Internal: number of sites, subnets, Active Directory or Entra ID.
- Cloud: providers and accounts in scope.
- Constraints: testing windows, systems that are out of scope, the deadline.
Red flags in a cheap quote
- No named methodology (PTES, OWASP, NIST SP 800-115).
- A report that's mostly scanner output.
- No retest, no readout call.
- The same vendor and the same tester every year with no fresh eyes. See why rotating perspectives matters.
Pen test vs vulnerability scan vs red team
A vulnerability scan lists known weaknesses automatically. A penetration test has humans exploit weaknesses to show real impact. A red team simulates a determined attacker against a goal, and also tests whether your team detects and responds. Our red team vs pen test guide covers when each fits.
What a good pen test report contains
- Executive summary: overall risk, the most important findings in business terms, and the trend versus last year.
- Scope and methodology: what was tested, when, from where, and with which standards.
- Findings: each with severity (e.g. CVSS) and business context, affected assets, reproduction steps, evidence and specific remediation.
- Attack narrative: how individual weaknesses were chained, which is the part scanners can't produce.
- Retest results: which findings were verified as fixed.
- Attestation letter: a short summary you can share with customers and auditors.
Planning an annual testing budget
| Testing | Typical cadence | Why |
|---|---|---|
| External network | Annually + after major changes | Internet-facing exposure changes constantly |
| Web application / API | Annually + before major releases | Customer and SOC 2 expectations |
| Internal network / Active Directory | Annually | Shows how far an attacker gets after a phish |
| Cloud configuration | Annually | Misconfiguration is a leading cause of cloud breaches |
| Continuous automated testing | Ongoing | Catches new exposures between manual tests (see red team as a service) |
Questions to ask every vendor
- Who will test, and what are their qualifications and experience?
- What percentage of the work is manual?
- Can we see a redacted sample report?
- Is a retest included, and within what window?
- How do you handle a critical finding found mid-test?
- What insurance and data-handling controls do you have for our data?
Frequently Asked Questions
How much does a penetration test cost?
It depends on scope and type. Small external tests cost a few thousand dollars; web application and internal tests usually cost more because they need more manual testing time.
How long does a penetration test take?
Testing commonly takes one to three weeks depending on scope, followed by reporting and a readout.
How often should we do a pen test?
At least annually and after significant changes. Regulations such as NYDFS Part 500 and PCI DSS require periodic testing.
Is an automated pen test enough?
Automated tools are useful for continuous coverage, but manual testing finds logic flaws and chained attacks that tools miss. Most buyers and auditors expect manual testing.
Get a fixed-price pen test quote. Send us your scope and Defensible will return a fixed quote with methodology and deliverables. Request a Pen Test Quote.
