How much a penetration test costs and what it depends on
Published:
Short answer: there is no single fixed price. The cost of a penetration test depends on what is tested (scope), the type of test, the size and complexity of the system, and the depth. That is why a serious quote is given only after a short scoping, not with a number out of thin air.
What does the cost depend on?
- Scope: one application, a network, the cloud, or all together — the larger the scope, the more time.
- Type: black box (no information), grey box (with a user account) or white box (with access and code).
- Size/complexity: number of systems, roles, integrations.
- Depth and frequency: a one-off test or recurring, with a retest of fixes.
What does a proper penetration test include?
A serious test is not just an automated scan. It includes manual investigation, controlled attempts to exploit vulnerabilities, and — most importantly — a report that explains what was found, how severe it is and how to fix it, with priorities. Ideally it also includes a retest after you apply the fixes.
What to ask for in a quote?
- A clear scope and test type, in writing.
- A sample report, to see the level of documentation.
- Whether a retest of the fixes is included.
- The team’s experience and certifications.
At ITHACA we start with a short scoping, give a fixed quote for the agreed object, and deliver a report with priorities and remediation advice.
Frequently asked questions
Penetration test or vulnerability assessment?
A vulnerability assessment finds and ranks vulnerabilities, mostly with tools. A penetration test goes a step further: it tries to exploit them in a controlled way to show the real risk. Many start with the former.
How often is it needed?
Typically once a year and after major changes (a new application, a migration). Some standards and customers require it annually.