Penetration testing cost depends on scope: how many websites, APIs or servers, how many user roles, and how deep the testing goes. My fixed prices start at $449 for a one-role website, $429 for a 20-endpoint API and $249 for a read-only Linux server audit, rising to $2,199-$2,499 for Premium plans that test several roles and tenants. Each includes a written report and a retest.
A penetration test is security testing in which an authorized tester tries to get past the defenses of a website, API or server, inside limits the owner signs, and writes down how far they got. The NIST glossary, quoting SP 800-115, describes evaluators who "mimic real-world attacks" to find ways around the security features of an application, system or network. A vulnerability scan is different: it lists likely weaknesses without proving that any of them can be used.
All prices are in US dollars. Other companies' figures were read on 3 November 2026.
What are you buying when you pay for a penetration test?
You are buying a person's time inside a written scope, plus a report that proves each finding and says how to close it. Other services get sold under the same name, so name the one you want first.
| Service | The question it answers | What it cannot tell you |
|---|---|---|
| Vulnerability scan | Which known weaknesses, outdated versions and missing headers are visible from outside? | Whether a flaw can actually be used, or whether one customer can read another customer's data |
| Penetration test | Can someone get past the login, roles and business rules, and how far? | Every line of code; it samples the system in a fixed window |
| Code security review | Where in the source are the injection, access control and secret-handling flaws? | How the live server and hosting are configured |
| Server audit | Is the host patched, firewalled, backed up and locked down? | Flaws inside the web application itself |
A scan is the cheap end of the market. Astra's pricing page lists its Scanner Lite plan at $69 a month on monthly billing for one target. In the United States, government bodies and critical infrastructure organizations can get CISA's Cyber Hygiene services at no cost, which include vulnerability scanning of internet-facing addresses and web application scanning. A scan is useful between tests. It is not a test, so watch for quotes that are scanner output with a new cover page.
Which scope do you need: website, API or server?
The scope is the list of things the tester may touch, and it decides most of the price. Small businesses usually need one of three:
- Website or web app. Logins, forms, account areas, admin panels, password reset, file upload and the flows where money or personal data changes hands. The main question is access control: can customer A open customer B's invoice?
- API. The endpoints your mobile app, frontend or partners call directly. The OWASP API Security Top 10 (2023) puts Broken Object Level Authorization first, which is the API version of the same question.
- Server. SSH, open ports, firewall rules, patch level and backups on a VPS, dedicated or cPanel/WHM server.
The second choice is how much the tester knows: only a URL (black box), test accounts per role and some documentation (gray box), or source code too (white box). For a small business, gray box usually gives the most findings per dollar, because the hours go into testing instead of guessing.
In words: no logins or customer accounts, start with a scan. Apps or partners calling an API directly, test the API. Three or more roles or separate tenants, buy a multi-role web app test. Running the server yourself, add a server audit; otherwise start with a single-role website test.
What drives penetration testing cost up or down?
Penetration testing cost follows the hours the scope needs, and a handful of variables decide those hours.
| Driver | Why it adds time | How to keep it down |
|---|---|---|
| Number of targets | Each domain, app or server is mapped and tested separately | Test the customer-facing app first; add others later |
| User roles and tenants | Every role is tested against every other role for access it should not have | Name the roles that touch money or personal data |
| API endpoints | Each endpoint is checked for authorization, tokens and excess data | Send an OpenAPI file or Postman collection |
| Business logic | Billing, invites, refunds and coupons need hand testing, not tools | List the flows that would hurt most if abused |
| Production only | Testing is throttled and limited to quiet hours | Provide a staging copy that matches production |
| Retests and extras | Each retest, walkthrough call or customer letter is extra work | Fix everything first, then book one retest |
Here is how those drivers turn into my own fixed prices on the security testing packages page:
| Test | Starter | Business | Premium | What changes between plans |
|---|---|---|---|---|
| Website and web app | $449 | $1,099 | $2,499 | 1, 2 or 4 user roles; Premium adds tenant and billing tests |
| API | $429 | $999 | $2,199 | 20, 50 or 120 endpoints; 1, 3 or 5 roles |
| Linux server | $249 | $599 | $1,299 | 1 server read-only, then firewall and mail checks, then up to 3 servers |
Extras: another user role on the website test is $199, another subdomain is $279, and 25 more API endpoints are $199. Anything outside a package I quote as one fixed price per scope, worked out from my $55-$65 hourly rate.
For a public comparison, Astra's pricing page, read on 3 November 2026, lists Pentest Auto, an autonomous test with one human re-scan, at $2,999 a year per target, and Pentest Expert, which adds manual testing by its pentesters and two re-scans, at $5,999 a year per target. I could not find a primary, method-backed survey of average penetration test prices. The "average cost" ranges that rank in search come from companies that sell tests and publish no sample, so I do not repeat them. Re-check these prices yearly, mine included.
Does PCI DSS or SOC 2 require a penetration test?
PCI DSS does for some online stores; SOC 2 leaves it to your auditor. The PCI DSS v4.0 SAQ A-EP covers e-commerce merchants whose website does not itself receive card data but does affect the security of the payment page. I read the April 2022 edition for PCI DSS v4.0, the one I could open. Its requirement 11.4.3 says external penetration testing is performed:
- at least once every 12 months, and after any significant infrastructure or application upgrade or change;
- by a qualified internal resource or a qualified external third party;
- with organizational independence of the tester, who is not required to be a QSA or ASV.
Requirement 11.4.1 asks for a documented methodology with application-layer testing, and for results to be kept at least 12 months. Requirement 11.4.4 says exploitable findings are corrected and the testing is repeated to verify the corrections, which is why a retest belongs in the quote. The PCI SSC document library now features PCI DSS v4.0.1 as the current version. I could not open the v4.0.1 text, so confirm the wording of requirement 11.4 in the current edition, and ask your acquirer or assessor which questionnaire applies to you.
SOC 2 is different. The AICPA's SOC page describes SOC reports as assurance reports CPAs provide on a service organization's controls. I found no fixed testing schedule in the AICPA material I read, so the need is agreed with your auditor and the customers asking for the report. On 26 October 2026 the AICPA posted exposure drafts of proposed 2027 SOC 2 Trust Services Criteria, so re-check this next year. Either way, a dated test report is evidence for your assessor, not a compliance attestation.
How do you compare penetration test quotes?
Hold every quote against the same written scope and ask each provider the same questions. Quotes thousands of dollars apart often describe different services.
- Which targets, roles and endpoints are in scope, in writing?
- How many hours or days of manual testing, and how much is tool output?
- Which method do you follow, such as the OWASP Web Security Testing Guide?
- How is severity rated, and will I see the proof for each finding?
- How many retests are included, and within what window?
- Who does the testing, and are they independent of the people who built the system?
- What happens if you find something critical halfway through?
Red flags: a price "per scan", no authorization form, no sample report, no retest, no list of exclusions, or a promise that the system will be "secure" afterwards.
What has to be signed before testing starts?
A written authorization from the system owner and agreed rules of engagement. Without them a security test can count as unauthorized access, whoever pays for it. NIST SP 800-115 is written to help organizations plan security tests as well as run them. The rules of engagement should name:
- the targets, environments and IP addresses in scope, and everything that is out;
- the test accounts, holding no real customer data;
- dates, allowed hours and a technical contact on each side;
- what the tester does on finding a critical issue, usually a same-day call;
- how proof and data are handled, and banned activities such as denial-of-service, load testing and phishing.
Your hosting provider's rules apply too. The AWS penetration testing policy lets customers test their own resources on listed services, such as EC2, RDS, CloudFront and Lambda, without prior approval, while denial-of-service and request flooding, including login and API request flooding, are prohibited. On shared hosting or a SaaS platform, read that provider's policy before signing.
What should the penetration test report contain?
A report your developer can fix from and your assessor can file. Ask for a sample and check it for these rows.
| Section | What it should say |
|---|---|
| Summary for owners | What was tested, the worst findings in plain words, what to fix first |
| Scope and dates | Targets, roles, environment and the testing window, matching the signed authorization |
| Method | The named method and which parts were manual |
| Findings with severity | A CVSS score and vector string per finding, plus the tester's note on real impact |
| Proof | The request, response or screenshot that shows the flaw, with personal data masked |
| Fix steps | The change that closes each finding, written for your developer |
| Not tested | What was out of scope or could not be reached, so nobody assumes it passed |
| Retest results | Each finding marked fixed or still open, with the retest date |
CVSS, the Common Vulnerability Scoring System, is maintained by FIRST, which publishes the v4.0 specification and keeps v3.1 as an archive. Ask which version the report uses, so scores line up with the ones your other tools produce.
How does retesting work, and what does it cost?
A retest checks each finding again, with the same requests that found it, once your fixes are deployed to the tested environment. It belongs in the price: requirement 11.4.4 in PCI DSS v4.0 says testing is repeated to verify the corrections, and a report of open findings proves little. My website and API plans include one retest within 30 days on Starter, one within 45 days on Business, and two within 60 days on Premium; the Linux server audit includes one retest on Starter and Business and two within 60 days on Premium. Findings still open stay in the updated report at their original severity.
Fixing is a separate cost unless the plan says otherwise. Its size depends on what the test finds, so I quote it once the report is out. Server findings can go to my server security hardening service, and WHMCS installs to a WHMCS security audit. Hosting companies can close the basics first with my WHMCS firewall and server hardening checklist.
When is a penetration test the wrong purchase?
When something else should come first:
- The site is already hacked. You need cleanup and incident response, then a test.
- Known basics are open. Outdated plugins and missing updates show up in a scan. Fix those first, so test hours go to flaws a scan cannot find.
- The app changes daily. Test at a feature freeze before launch, or the report describes a system that no longer exists.
- You do not control the target. Nobody can authorize a test of a platform they only rent space on.
- You want proof the system is safe forever. A test samples one version in one window. It lowers the risk you know about; it does not end it.
If the app was built with an AI tool, my guide to vibe coding security risks lists the checks to run before paying anyone.
What else do people ask about penetration testing cost?
How long does a penetration test take?
It depends on scope. My packages deliver in 5 days for a single-role website or a 20-endpoint API, and up to 15 days for the Premium plans that cover several roles and tenants. Production-only testing in quiet hours stretches the calendar.
How often should you get a penetration test?
At least once a year and after any significant change, which is the external testing rhythm in PCI DSS v4.0 for merchants it covers. Without PCI DSS, test before a major launch and when logins, roles, payments or hosting change.
Do small businesses need penetration testing?
Not all of them. The common triggers are card payments on your own pages, an enterprise customer's security questionnaire, a SOC 2 audit, or personal data behind logins. A brochure site with no logins is usually fine with a scan and prompt updates.
Can I run a penetration test on my own website?
You can test systems you own and control, within your hosting provider's policy. The value of a paid test is a second, independent person and a report others will accept, which is why PCI DSS v4.0 asks for organizational independence of the tester.
If you want a fixed price for your own scope, the security testing packages list every plan, and I answer scoping questions on a free call of about 30 minutes.
Last reviewed 3 November 2026. Disclosure: I sell penetration tests and security audits, so I am not neutral. I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI. Prices and the PCI DSS text were read on that date. Re-check yearly: my prices, Astra's prices, the PCI DSS version, the SOC 2 criteria and the CVSS version.
