Penetration Test Cost: What Moves the Number and Why Two Quotes for the Same Scope Can Differ by 5x
Penetration test cost for a professional, human-led engagement typically runs $5,000 to $15,000, and can exceed $30,000 for complex environments. Test type, network size, depth of methodology, tester experience, and whether retest is included drive the final number. A quote under about $4,000 is likely not a real penetration test.
Two vendors, the same network, the same "external web app plus internal network" scope, and two invoices a factor of five apart. In scoping calls, we regularly see this: one quote in the low single-digit thousands, the other in the mid five figures, both describing what the buyer believes is the same test. When we put the two scope boxes side by side, the gap is almost never the rate. It is what is inside the box.
The price question is real, and it has stakes. The global average cost of a data breach reached a record $4.99 million in 2026, up 12 percent over the prior year [3]. Buyers are under pressure to spend well on security testing, and the penetration test is one of the line items where the price range is widest and the least explained.
This post takes the number seriously. It names the five drivers that actually move the penetration test cost, gives you the cost by test type so you can sanity-check a quote, and hands you the 5-line check that separates two quotes for a scope that sounds identical. The goal is simple: you should be able to read any penetration test quote and say, within a band, whether it is priced for the scope it claims.
Clone Systems' position: a penetration test quote is a readout of scope, not a rate. Two quotes for the "same" scope are almost never the same scope, and the difference shows up in the number of in-scope systems, the authentication scenarios, and whether retest and remediation support are included. Price without scope is not a comparison. It is two different engagements wearing the same label.
How Much Does a Penetration Test Cost in 2026?
A professional, human-led penetration test typically costs $5,000 to $15,000, and can exceed $30,000 for complex environments [1]. Broader 2026 pricing guides place the typical engagement between $5,000 and $30,000, with large-scale or specialized tests reaching $60,000 or more [2].
That is a wide band, and the width is the point. Unlike a commodity, a penetration test is priced on effort and judgment, and both scale with the environment. The range you should expect depends on the type of test:
- Network penetration testing: $5,000 to $20,000 per test, covering internal and external network vulnerabilities [2].
- Web application testing: $5,000 to $30,000 per test, assessing public-facing portals and applications [2].
- API penetration testing: $5,000 to $20,000 per test, covering exposed APIs and integrations [2].
- Cloud penetration testing: $10,000 to $40,000 per test, examining cloud infrastructure and configuration [2].
- Mobile application testing: $12,500 to $40,000 per test, covering iOS and Android apps and their backends [2].
Two caveats on the low end. First, a penetration test listed for less than about $4,000 is probably not a real penetration test, and more often a vulnerability scan sold under a different name [1]. Second, the type matters more than the total. A $15,000 cloud test and a $15,000 external network test are not buying the same work, even at the same price.
The category itself is also shifting. NetSPI and Synack completed their merger on October 5, 2026, combining a bench of 350 in-house pentesters with a red team of more than 1,500 researchers under a single continuous-testing platform [5]. The direction is clear: testing is becoming a standing service rather than a one-off, and the cost conversation is moving from a single invoice to an ongoing program.
What Actually Moves the Number?
The five drivers below account for most of the spread in any penetration test cost. They are listed in roughly the order of how much they move the price.
1. Environment size and complexity
The size and complexity of your environment is the biggest factor in most penetration test quotes [1]. A small environment can be tested in a few days, while a large one can take several weeks, and the tester's hours are the base of the price [1]. Complexity, not just size, is what matters: a 500-asset network with segmented zones, multiple authentication models, and a mix of cloud and on-prem systems takes longer than a 500-asset network that is one flat segment.
2. Number of in-scope systems
Within a given test type, the count of in-scope systems, domains, and applications sets the floor. This is where two quotes for a "same" scope usually first diverge. One vendor scopes "the public web app," and the other scopes "the public web app, its API, and the two backends it calls." Same label, very different surface.
3. Depth of methodology and authentication
An unauthenticated, black-box test covers less than a credentialed, gray-box test. The more login scenarios, roles, and environments the tester must cover, the more effort the test requires [1][2]. This is the driver buyers most often miss, because it is invisible in a one-line scope description.
4. Tester experience and credentials
Penetration testers with more experience, and with credentials behind their names such as OSCP, CISSP, or GIAC, charge more and generally deliver better results [1]. You are paying for the judgment that decides which finding to chase, which to chain, and which to stop at.
5. On-site work and retest
On-site visits, physical security testing, and social engineering add to the price [1]. Separately, whether the engagement includes remediation support and retest is a genuine cost driver: some testers include it, and others deliver the report and stop [1]. A quote that excludes retest is cheaper today and more expensive in practice, because you are paying again to confirm the fix.
Penetration Test vs Vulnerability Scan: Why the Prices Look So Different
The single most common source of "why is this so expensive" is a buyer comparing a penetration test to a vulnerability scan. They are different work. A vulnerability scan is automated and identifies known weaknesses, while a penetration test uses a human tester to chain and exploit those weaknesses to prove real impact [1][7].
The price gap follows from the labor gap. A scan can run in hours at a fraction of the cost. A test is a person, or a team, spending days or weeks trying to actually get in, and the cost tracks that effort [1]. Our comparison of the two approaches walks through exactly where each one leaves off: see penetration testing vs vulnerability scanning.
Why Do Two Quotes for the Same Scope Differ So Much?
This is the question the 5-line check answers. In scoping calls, we regularly see two quotes for what is described as the same scope differ by a factor of five. The gap is almost never the rate. It is the scope box, and the five lines below are where it hides.
The Clone Systems Pen Test Quote Sanity Check
Run the same five lines against both quotes, line by line:
- In-scope systems. List every IP, domain, application, and API in each scope. If the lists differ, the quotes are for different work.
- Authentication scenarios. Count the login paths, roles, and environments each test covers. More scenarios means more effort, and more price.
- Methodology depth. Is it black-box, gray-box, or credentialed? Does it include business logic, or only known CVEs?
- Retest and remediation. Is retest included, and is it unlimited or capped? Remediation support is a line item, not a courtesy.
- Deliverables. Does the report include evidence, prioritization, and remediation guidance, or just a findings list?
When two quotes look identical on price, run these five lines and you will almost always find the difference in scope, depth, or retest. When two quotes look very different, these five lines will tell you which one is actually buying more. That is the entire comparison.
How to Budget a Compliance-Driven Test
If your test is driven by a standard rather than by curiosity, the cost conversation changes slightly. PCI DSS expects both internal and external penetration testing under Requirement 11 [1][4], and the same is true of many SOC 2 and industry programs. That means the compliant scope is usually larger than the minimum a vendor will quote you, because it covers both sides of the network and the documentation the auditor will ask for.
Our post on the report your auditor actually checks explains what "compliant" looks like from the auditor's side, and why passing a retest is not the same as fixing the root cause is the practical reason to budget for retest from the start rather than add it later.
How Clone Systems Can Help
If you are budgeting a penetration test, or you already have two quotes that do not line up, our team will scope the work with you and walk through the numbers.
- Managed penetration testing. Manual, human-led testing across network, web application, API, and cloud, with the scope defined with you up front (Managed Penetration Testing Services).
- Quote comparison. Send us the two quotes and the five-line check, and we will tell you what you are actually buying in each.
- Retest and fix verification. After your team patches, we re-run the scope and confirm the fix, so the test pays off once, not twice.
- Vendor selection. If you are still choosing who will test you, our 5-signal vendor scorecard separates a test that asks real questions from one that simply runs a tool.
Frequently Asked Questions
How much does a penetration test cost? A professional, human-led penetration test typically costs $5,000 to $15,000, and can exceed $30,000 for complex environments [1]. Test type, network size, methodology depth, and whether retest is included all move the final number.
What is the cheapest a real penetration test should be? A penetration test quoted under about $4,000 is probably not a real penetration test, and more often a vulnerability scan sold under a different name [1]. Set a floor below which you should ask exactly what is being tested.
What is the difference between a penetration test and a vulnerability scan? A vulnerability scan is automated and identifies known weaknesses, while a penetration test uses a human tester to chain and exploit those weaknesses to prove impact [1][7]. The scan is a snapshot; the test is an attack.
How often should I do a penetration test? Most organizations test at least annually and after any significant change to the environment, so the findings stay current [1]. If you are in scope under PCI DSS, Requirement 11 expects both internal and external testing [4].
Why do two firms quote such different prices for the same test? Because the quotes are almost never for the same scope, with the gap showing up in the in-scope systems, the authentication scenarios, and whether retest and remediation support are included [1]. Compare the scope boxes, not the totals.
Conclusion
A penetration test is priced on scope, and the scope is the thing you control. The range is real, from a few thousand dollars for a tight external test to $60,000 or more for a large multi-environment engagement, but the spread is explained by five drivers you can read in any quote [1][2]. Run the 5-line check against every quote, scope the test with the vendor rather than accept the default, and budget for retest from the start. If you want a second set of eyes on the scope and the price, talk to our team about a penetration test that is priced for the work it actually does. clone-systems.com
References
[1] SecurityMetrics, "How Much Does a Pentest Cost?" 2026. https://www.securitymetrics.com/blog/how-much-does-pentest-cost [2] VikingCloud, "How Much Does Penetration Testing Cost?" 2026. https://www.vikingcloud.com/blog/how-much-does-penetration-testing-cost [3] IBM, "Cost of a Data Breach Report 2026." https://www.ibm.com/reports/data-breach [4] PCI Security Standards Council, "PCI Data Security Standard (PCI DSS)." https://www.pcisecuritystandards.org/standards/pci-dss/ [5] NetSPI & Synack, "NetSPI & Synack Are Now One." https://www.synack.com/netspi-and-synack/ [6] Clone Systems, first-person observation: in scoping calls, two quotes for a scope described as identical often differ by a factor of five; the gap is in the in-scope systems, the authentication scenarios, and whether retest and remediation are included, not in the rate. [7] Clone Systems, "Penetration Testing vs Vulnerability Scanning: Why the Difference Matters." https://www.clone-systems.com/blog/penetration-testing-vs-vulnerability-scanning [8] Clone Systems, "How to Choose a Penetration Testing Vendor: The 5 Signals That Separate a Test From a Report." https://www.clone-systems.com/blog/how-to-choose-a-penetration-testing-vendor [9] Clone Systems, "Why Passing a Penetration Test Retest Isn't the Same as Fixing the Root Cause." https://www.clone-systems.com/blog/why-passing-a-penetration-test-retest-isnt-the-same-as-fixing-the-root-cause [10] Clone Systems, Managed Penetration Testing Services. https://www.clone-systems.com/managed-penetration-testing-services/