A focused web or API penetration test costs roughly $8,000 to $25,000 in 2026. Cloud and enterprise scopes run $25,000 to $75,000, and red team, DORA TLPT or agentic AI work starts around $60,000. Every one of those numbers is senior tester-days multiplied by a day rate, so that is the unit you should compare quotes on.
The short answer
- A focused web or API penetration test costs about $8,000-$25,000 in 2026.
- Cloud and enterprise scopes run $25,000-$75,000; red team, DORA TLPT and agentic AI or MCP testing run $60,000-$150,000+.
- Price tracks senior tester-days (about $1,500-$3,000/day US, €800-€1,800 EU), not the number of findings.
- Under about $1,200 per tester-day, or 2-3 days for a complex app, you are buying a scan.
Key takeaways
- A focused web or API pentest costs roughly $8,000-$25,000 in 2026; cloud and enterprise scopes $25,000-$75,000; red team, DORA TLPT and agentic AI work $60,000-$150,000+.
- Pricing is senior tester-days times day rate: about $1,500-$3,000 in the US and €800-€1,800 in the EU.
- Normalize every quote into productive hours, named seniority, retest terms and deliverables before comparing.
- Gray-box testing finds more real risk per dollar than black-box and should be the default.
- Below about $1,200 per tester-day, or 2-3 days for a complex authenticated app, you are buying a scan.
How much does a penetration test cost in 2026?
Most organizations pay between $8,000 and $150,000 for a penetration test in 2026. Where you land depends on the engagement type and on how many tester-days the scope genuinely requires. The bands below reflect market rates we see across US and EU quotes. They are not a published survey, so treat them as ranges with a stated basis, not list prices.
| Engagement | Typical tester-days | US range (2026) |
|---|---|---|
| Small web app / CRUD SaaS | 5-8 | $8,000-$20,000 |
| Authenticated web app with SSO and API | 10-15 | $20,000-$40,000 |
| Enterprise or multi-tenant platform | 20+ | $40,000-$80,000+ |
| Single REST or GraphQL API | 6-12 | $10,000-$25,000 |
| Mobile app (iOS + Android) | 6-15 | $10,000-$30,000 |
| Single-account cloud (AWS, Azure, GCP) | 8-20 | $15,000-$50,000 |
| Focused LLM chatbot assessment | 8-15 | $15,000-$40,000 |
| Agentic AI / MCP / RAG red teaming | 15-40 | $35,000-$100,000+ |
| Objective-based red team (3-6 weeks) | 30-60+ | $60,000-$150,000 |
The number of findings has no bearing on price. You are buying time from people who know where to look, not a quantity of bugs.
What is a typical penetration tester day rate in the US and EU?
In the US, expect roughly $1,200 to $2,000 per day for a freelancer, $1,500 to $2,500 for a boutique specialist firm, and $2,500 to $4,500 or more at a large consultancy or Big Four. In the EU, CREST-certified testers bill roughly €800 to €1,800 per day. UK rates sit around £700 to £1,500.
Geography moves the number by a factor of two inside Europe alone. The Nordics and Switzerland sit at the top. Poland, Portugal and Spain sit at the bottom. Offshore aggregators go lower still, and that is where you need to ask who actually touches your app and who signs the report.
The definition of a day also varies. A billed tester-day is usually 6 to 7 hours of hands-on work. Report writing, peer QA and the debrief typically eat 20 to 30% of total effort and should appear in the day count, not vanish into it. When comparing quotes, convert everything to productive hours. A vendor claiming 8 hours of pure testing per billed day is either very unusual or rounding generously.
How much does a web application penetration test cost?
A single web application typically costs $8,000 to $20,000 for a simple app and $20,000 to $40,000 for an authenticated app with SSO, multiple roles and a backing API. Price follows three variables: distinct user roles, authentication complexity, and how much manual business-logic testing you want.
Roles matter most. Every role pair is a matrix of authorization checks, and broken access control is still the bug that gets exploited. Three roles across two tenants is a very different job from one role in one tenant. SSO via OAuth 2.1, OIDC or SAML adds days because the token and redirect flows are their own attack surface.
A credible scope maps to OWASP WSTG for method and OWASP ASVS 5.0 for verification depth. A second app on the same stack and auth model is much cheaper than the first, so do not assume price scales linearly with app count. See our web application penetration testing scope for how we break this down.
How much does an API penetration test cost?
A single REST or GraphQL API surface typically costs $10,000 to $25,000. A large microservice or partner-facing API estate runs $30,000 to $60,000. Endpoint count sets the floor, but authorization complexity sets the ceiling.
The OWASP API Security Top 10 (2023) leads with BOLA for a reason: every object ID in every endpoint needs testing across every role. Fifty endpoints with two roles is manageable. Four hundred endpoints, five roles and per-tenant object scoping is weeks of work. GraphQL adds introspection, batching and per-resolver authorization checks that REST does not have.
The cheapest way to cut API cost is to hand over an OpenAPI or GraphQL schema and working tokens for each role. That turns days of discovery into hours. Our API penetration testing engagements start from exactly that input.
How much does a cloud penetration test cost?
A single-account AWS, Azure or GCP assessment covering IAM, storage and network paths typically costs $15,000 to $50,000. Multi-cloud enterprise work with real exploitation and lateral movement runs $50,000 to $100,000 or more.
The driver is account sprawl multiplied by IAM depth. Fifteen AWS accounts in an organization with cross-account roles, or Entra ID tenants with delegated admin and app registrations, produce privilege paths that tools like Prowler, ScoutSuite, Pacu and CloudFox surface but do not prove. Proving them is the manual, billable part.
Decide early whether you want a configuration review or an exploitation test. A config review against CIS benchmarks is cheaper and narrower. An exploitation test chains SSRF to instance metadata, metadata to role credentials, credentials to data. Both are legitimate, but they are not the same purchase. Our cloud and container penetration testing page lists both options.
How much should an LLM, RAG, or MCP agent penetration test cost?
A focused assessment of one chatbot against the OWASP LLM Top 10 (2025) runs roughly $15,000 to $40,000. Agentic, MCP and RAG red teaming with multi-step tool abuse, memory poisoning and cross-tenant retrieval testing runs $35,000 to $100,000 or more. This is the least settled band in the market. The sample is thin, dispersion is wide, and many buyers are still running these as pilots.
Per-day cost is higher for concrete reasons:
- Nondeterminism. The same prompt can succeed once in twenty runs. Testers must repeat attacks and report success rates, not single screenshots.
- Harness work. Tools like Garak, Microsoft PyRIT and promptfoo cover breadth, but agent testing usually needs custom harnesses for each tool chain.
- The real risk is not the prompt. Material findings sit in tool authorization, excessive agency, MCP confused-deputy paths, vector store access control and context poisoning. Mapping those takes application and cloud skills on top of LLM skills.
- Scarce supply. Few testers combine offensive web, cloud and LLM experience, and rates reflect that.
If a quote describes AI pentesting as a jailbreak sweep, it is pricing the cheapest and least consequential part of the problem. Methodology should reference MITRE ATLAS alongside the OWASP LLM list. Our AI agent penetration testing scope is built around tool-use abuse and privilege escalation for this reason.
How much does a red team or DORA TLPT engagement cost?
An objective-based red team of 3 to 6 weeks with 2 to 4 operators typically costs $60,000 to $150,000. Full-scope work that adds social engineering, physical access and assumed-breach starting points runs $100,000 to $250,000 or more.
Threat-led penetration testing under DORA, aligned with TIBER-EU, sits at the top of that curve. It requires a threat intelligence phase, a red team phase, a purple team or replay phase, and coordination with the regulator’s control team. DORA has applied since 17 January 2025, and designated financial entities face TLPT at least every three years. Budget for the threat intel provider and internal coordination time, not just the red team invoice.
Why do two quotes for the same scope differ by 5x?
Two quotes for the same scope differ by 5x because they are rarely for the same work. One is usually several senior days of manual testing. The other is a scanner run with light triage. Normalize both into tester-days, hours per day, named seniority, retest terms and deliverables, and the gap usually explains itself.
The cost drivers, roughly in order of impact:
- Number of applications, user roles and tenants
- Authentication complexity (SSO, MFA, OAuth flows, delegated admin)
- Access model: black, gray or white box
- Environment stability and realistic test data
- Depth: automated coverage versus manual authorization and logic abuse
- Tester seniority and certifications (OSCP, OSWE, CREST CCT, Burp Suite Certified Practitioner)
- Reporting and compliance evidence requirements
- Timeline: rush starts add roughly 15 to 30%, after-hours windows 10 to 25%
Access model deserves its own note. Black-box testing feels more rigorous but costs more per unit of coverage and misses more. Gray-box testing with credentials and architecture docs finds more real risk per dollar. It should be your default unless you are specifically measuring external attacker discovery.
Is a retest included in the penetration test price?
Sometimes. Retests are either included free within a 30 to 90 day window or priced at roughly 10 to 25% of the original fee. Ask which before you sign.
A quote with no retest is a compliance risk, not a saving. PCI DSS requires that exploitable findings be corrected and retested, and auditors increasingly ask for evidence that criticals were validated as fixed. Also budget for remediation engineering itself, which commonly costs a multiple of the test fee. Repeat testing of the same application the following year often prices 20 to 30% lower because reconnaissance and context carry over.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment runs scanners like Nessus or Nuclei and reports what they find. A penetration test has a human exploit, chain and validate issues, including authorization and business-logic flaws that scanners cannot see. Pricing reflects that gap, and so does compliance value.
| Option | Typical cost | Depth | Coverage predictability | Compliance artifact |
|---|---|---|---|---|
| Vulnerability assessment | $2,000-$10,000 | Known CVEs, misconfig | High, shallow | Partial |
| Automated validation (Pentera, NodeZero, XBOW) | $20,000-$100,000+/yr | Breadth, attack paths | High | Supporting |
| PTaaS subscription | $20,000-$100,000+/yr | Varies by credits | Medium | Usually yes |
| Bug bounty (HackerOne, Bugcrowd) | Platform fee + bounties, five to low six figures/yr | Opportunistic, can be deep | Low | No |
| Manual penetration test | $8,000-$150,000+ | Logic, authz, chains | High within scope | Yes |
A bug bounty complements a pentest but does not replace it. Researchers test what pays, not what your scope requires, and payouts do not produce the evidence a QSA or SOC 2 auditor wants. AI-assisted tooling is pushing the floor down for commodity scanning while raising the premium on senior manual work.
Do PCI DSS, SOC 2, ISO 27001, NIS2, or DORA require penetration testing?
Some require it explicitly and others expect it in practice. Check the current published text for your exact obligation.
- PCI DSS v4.0.1: internal and external penetration testing at least annually and after significant change, segmentation validation, and retesting of corrected exploitable findings.
- NYDFS 23 NYCRR 500.5: annual penetration testing for covered entities.
- FedRAMP: annual penetration testing as part of assessment.
- DORA: TLPT aligned with TIBER-EU at least every three years for designated financial entities, plus regular testing for everyone in scope.
- NIS2 Article 21: requires testing the effectiveness of security measures. It does not name pentesting, but a pentest is the usual evidence.
- ISO/IEC 27001:2022 Annex A 8.8 and SOC 2 Type II: no explicit pentest mandate, but auditors routinely expect one as evidence of technical vulnerability management.
Specify the CVSS version in the SOW. CVSS v4.0 has been out since November 2023, but some schemes and downstream consumers still expect v3.1.
What are the red flags in a cheap penetration test quote?
The clearest red flag is a price below roughly $1,200 per tester-day, or a 2 to 3 day quote for a complex authenticated app. At that point you are buying a scan. Other signs:
- No scoping call, or a flat fee for “unlimited scope”
- No named testers, no certifications listed
- Deliverable described as “automated scan plus report”
- No retest, or retest terms left vague
- No mention of Rules of Engagement, insurance or data handling
- Sample report withheld, or methodology not mapped to PTES, OWASP WSTG or NIST SP 800-115
- Offshore subcontracting with unnamed personnel
Ask for a redacted sample report. If it reads like Burp Suite or Nessus output with a logo on page one, you have your answer. A real report has an executive summary, scope and methodology, reproduction steps with evidence, business impact, CVSS with version stated, compliance mapping and a retest section.
What must a penetration test statement of work and rules of engagement contain?
The statement of work must list in-scope and out-of-scope assets explicitly, the tester-day count, the access model, deliverables and retest terms. The Rules of Engagement must define testing windows, source IPs, an emergency stop contact and prohibited techniques. Missing out-of-scope lists and emergency contacts is how tests take down production.
Around those, expect a master services agreement, an NDA, evidence retention and destruction terms, and professional indemnity or E&O insurance, commonly $1M to $5M. An uninsured tester who causes an outage turns a $15,000 test into a six-figure problem for you.
To avoid overpaying, provide a stable staging environment, architecture diagrams, an API schema and test accounts for every role before day one. Each missing input becomes billable discovery time.
FAQ
How much does a penetration test cost for a small business?
A small business with one web app typically pays $8,000 to $20,000 for a 5 to 8 day manual test. Quotes far below that are usually automated scans with a report attached.
How many days should a penetration test take for one web application?
A simple app needs about 5 to 8 tester-days. An authenticated app with SSO, several roles and an API needs 10 to 15. Multi-tenant platforms need 20 or more.
How much does a penetration test retest cost?
Retests usually cost 10 to 25% of the original fee, or are included free within a 30 to 90 day window. Confirm the terms in the SOW, since PCI DSS requires retesting of corrected exploitable findings.
Why are AI agent penetration tests more expensive per day?
Model behavior is nondeterministic, so attacks must be repeated and measured. Agent testing often needs custom harnesses, and the serious risks sit in tool authorization and data access, which requires application and cloud skills on top of LLM expertise.
Is a cheap penetration test ever worth it?
A vulnerability scan has value as hygiene, but it should be priced and labeled as one. A cheap test sold as a pentest will miss authorization and logic flaws and may fail an auditor's review.
Does a bug bounty replace a penetration test?
No. Bug bounty coverage depends on what researchers choose to test, and it does not produce a scoped compliance artifact. Use it alongside periodic pentests, not instead of them.
How often should you run a penetration test?
At least annually and after significant architecture changes. PCI DSS, NYDFS and FedRAMP set an annual floor, and DORA adds TLPT every three years for designated financial entities.
If you want a quote broken down into named tester-days, seniority, retest terms and deliverables so you can compare it line by line, start with our penetration testing services and we will scope it on a call.