How Much Does Penetration Testing Cost?

Penetration testing cost is set by scope before anything else: what is being attacked, how deep the tester goes, and how much of the work is done by hand. An external test of a few public systems is a small engagement, and a full review of a custom application's source code is a much larger one.

NetSys does not publish a price list. Our Tier 1 external penetration test is free for any business, and our Tier 2 source code test is quoted per codebase after we look at what you have built. The rest of this guide explains what moves a penetration testing quote up or down, what a good quote should include, and how to compare two proposals that look nothing alike. You can request the free test on our penetration testing services page.

What moves the price of a penetration test?

Cost driver	What it means	Effect on the quote
Scope type	External network, web application, internal network, wireless, social engineering, source code	Each scope is its own engagement with its own hours
Size of the target	Public IP addresses, applications, user roles, API endpoints, lines of code	Hours scale with the size of the attack surface
Depth of access	Black box (no information), grey box (credentials and documentation), white box (source and architecture)	More access means more findings and more hours
Manual versus automated	A scanner run with a cover page, or an engineer chaining findings by hand	Manual work is what you are paying for
Retest	Verifying your fixes after remediation	Included, capped, or billed as a new engagement
Report quality	Executive summary, reproduction steps, evidence, ranked fixes	Writing time is engineer time
Compliance driver	PCI DSS, SOC 2, HIPAA, a customer's security questionnaire	Adds methodology and attestation requirements

How are external, web application, internal and source code tests priced differently?

An external test starts from the internet with no credentials. The tester maps what your domain and public IP addresses expose, checks logins and remote access, and looks at what public records and staff profiles give an attacker to work with. Hours scale with the number of hosts and exposed services. For most small businesses that is a short list, which is why external testing sits at the low end of the market and why NetSys can offer its Tier 1 version at no charge.

A web application test is priced by the application, and within that by user roles, forms and API endpoints. An application with a public login, a customer role, an administrator role and a mobile API has several times the ground to cover of a brochure site with a contact form. Testers work from the OWASP Web Security Testing Guide, and a quote should say which categories will be covered. Our web application penetration testing page explains how we test an application from its source code and how that work is scoped.

An internal test assumes the attacker is already inside: a phished laptop, a rogue device on the office network, or a contractor's account. The tester tries to move from that foothold to domain administrator. This is usually the most expensive network test because it touches the most systems, and because a careful tester avoids knocking over production while doing it.

A source code test is a different animal. The engineer reads the code, builds and runs it in an isolated environment, attacks the running application and its APIs, and scans dependencies and committed secrets. Cost follows the size and age of the codebase, the number of languages and frameworks involved, and how much of the build the tester has to reconstruct. NetSys quotes Tier 2 per codebase for exactly this reason: two applications with the same feature list can take very different amounts of work.

How scope grows with test type and company size

Test type	Smaller business: one office, a website and Microsoft 365	Larger or multi-site business	How NetSys prices it
External network	A handful of public IP addresses, the website, email and remote access	Several sites, cloud services and many more exposed logins and addresses	Tier 1: free, remote, within an agreed external scope
Web application	One application with one or two user roles	Several applications, many roles, APIs and a mobile back end	Scoped and quoted separately
Internal network	One office network and a few servers	Several sites and more paths from one system to the next	Scoped and quoted separately
Source code	One small codebase in one language	Several codebases, older code and more frameworks	Tier 2: quoted per codebase, under NDA

Headcount matters only through what it exposes: more sites, applications, user roles and code mean more engineer hours. NetSys publishes no price list, so compare quotes on the same written scope rather than on the headline number.

Is the retest included in the price?

A penetration test that finds twelve problems is only useful once those twelve are fixed and confirmed fixed. Some firms include one retest of the reported findings within a set window. Others cap the retest at a number of hours. Others treat it as a new engagement at full price. None of those is wrong, but you need to know which one you are buying before you sign, because a retest bought later at full rate can double the cost of the project.

Ask how long after delivery the retest window stays open, whether the retest covers every finding or only those rated high and critical, and whether a second retest is available if a fix introduces a new problem. Firms that include a retest are betting you will fix things, which is a good sign about who you are hiring.

Why does report quality change the price?

The report is the product. A cheap test tends to deliver scanner output with a logo on the front: hundreds of pages, most of it informational, with no indication of which items an attacker would use together. A good report has an executive summary a business owner can read in ten minutes, a ranked list of fixes with the effort each one takes, and a reproduction path with evidence for every finding, so your engineer or your IT provider can confirm the problem and later confirm the fix.

Writing that takes a meaningful share of the engagement hours, and it is one of the first things to go when a firm competes on price. When you compare quotes, ask for a sanitized sample report. If the sample would not tell you what to do on Monday morning, the price does not matter.

What do you get for free, and what should you pay for?

Free scanning tools and free external checks have their place. NetSys offers a free Tier 1 test because the external attack surface of a typical small business is bounded, the findings are usually fixable within days, and a business that has seen its own exposure makes better decisions about everything else. What the free tier does not do is test authenticated application logic, internal lateral movement, or your source code. Those take engineer time in proportion to the target, and any firm offering them at a flat rate without asking about the target is planning to do less than you think.

Compliance shapes this too. PCI DSS requires penetration testing on a regular cycle and after significant changes, and the PCI Security Standards Council publishes guidance on what that testing must cover. SOC 2 auditors and enterprise customers increasingly expect a recent report as evidence. When a test is being done for one of those reasons, the scope has to match the requirement, which is worth telling the tester up front.

What PCI DSS asks of a penetration test, and how it changes the quote

If you take cards and your PCI DSS assessment includes requirement 11.4, the standard sets much of the scope for you, and that scope is usually larger than a basic external test. Under PCI DSS v4.0.1, as the PCI Security Standards Council reproduces it in its SAQ D for merchants:

• A written methodology. Industry-accepted approaches; coverage of the entire cardholder data environment perimeter and critical systems; testing from inside and outside the network; application-layer testing for at least the vulnerabilities listed in requirement 6.2.4; network-layer testing; a review of threats and vulnerabilities from the last 12 months; and results kept for at least 12 months (11.4.1).
• Internal and external tests at least once every 12 months and after any significant infrastructure or application upgrade or change, by a qualified internal resource or third party with organizational independence. The tester does not have to be a QSA or ASV (11.4.2, 11.4.3).
• Fix and retest. Exploitable findings are corrected according to your own risk ranking, and the test is repeated to verify the corrections (11.4.4).
• Segmentation tests. If segmentation keeps systems out of scope, those controls are tested at least once every 12 months and after any change to them (11.4.5). Service providers have a stricter schedule.

Each of those moves the quote. Internal and external testing are two scopes, not one. Segmentation testing adds work for every boundary you rely on. The retest is required, so price it in rather than buying it later at full rate. Testing after significant changes means a business that changes its network or checkout often may need more than one test a year. The methodology, the 12-month threat review and a report your assessor can follow all take engineer hours. Not every merchant carries 11.4: SAQ A, B and C-VT do not include it, SAQ B-IP and C include only the segmentation test, SAQ A-EP includes the external test and segmentation testing, and SAQ D includes all of it. Our PCI DSS guide for small businesses explains which questionnaire applies, and the PCI SSC document library holds the standard and the Council's penetration testing guidance.

How do you compare penetration testing quotes?

• Same scope, written down. Compare the list of targets, roles and IP addresses, not the headline price. If one quote has no scope statement, it is not a quote.
• Named methodology. Look for references to the OWASP testing guide, the Penetration Testing Execution Standard, or NIST SP 800-115. It shows the firm follows a process rather than a checklist.
• Hours and who does them. Ask how many engineer hours are behind the number and whether the person doing the work is the person on the call.
• Retest terms. Window, coverage and limits, in writing.
• Deliverables. A sample report, a debrief meeting, and a letter of attestation if a customer or auditor will ask for one.
• Safety. Rules of engagement, testing windows, an emergency contact, and how production data is handled.

Frequently asked questions

How much does a penetration test cost for a small business?

It depends on what is tested. An external test of a small public footprint is the least expensive engagement, and NetSys runs its Tier 1 external test free for any business. Web application, internal and source code tests are priced on the size of the target and the depth of access the tester is given, so responsible firms quote after a scoping call rather than from a rate card. Treat a flat price offered before anyone has asked what you run as a sign that the scope will be thin.

How often should we run a penetration test?

Annually is the common baseline, plus after any significant change: a new public application, a cloud migration, a merger, or a new remote access method. Regulated businesses may have a set cycle; PCI DSS, for example, ties testing to a schedule and to significant changes. Between full tests, regular vulnerability scanning keeps the gaps short. Our comparison of penetration testing and vulnerability scanning explains where each one fits.

Is a vulnerability scan the same thing as a penetration test?

No. A vulnerability scan is automated software that lists known weaknesses. A penetration test is a person who tries to exploit them, chains them together, and shows what an attacker could reach. Scans are cheap and should run often. Tests cost engineer time and prove which of the scan results matter. Firms that sell a scan as a penetration test are the reason report quality is worth checking before you buy. Our glossary sets out what penetration testing is and how the main test types differ.

Do we need a penetration test for cyber insurance?

Many applications ask if you have had one, and some carriers require it above a certain policy size or for certain industries. Even when it is optional, a recent report with the findings fixed is strong evidence during underwriting and after a claim. If insurance is the driver, tell the tester, so the scope and the report format match what the carrier expects. Our guide to cyber insurance requirements covers the other controls carriers ask about.

What is included in a NetSys penetration test?

Tier 1 is a remote external test, free, limited to the information available to us and the domains and systems we agree with you before testing; the report states what was assessed, what was found and the limits of that scope. Tier 2 is a source code test: you provide the code under NDA, we build and run it in an isolated sandbox with no connection to your production systems, and we combine code review, testing of the running application and its APIs, and dependency, secret and configuration scanning. Each finding comes with its severity, reproduction steps and the fix, we retest once you have patched, and the code and sandbox are deleted when the engagement closes.

How does a penetration test engagement start?

With planning, before any testing. We agree in writing the authorization, the systems in scope, the testing window and the goals, and nothing is tested until that is signed. For a source code test there is a short technical call about the repository and the deployment model first, then the NDA and a repository grant or an archive. Internal and onsite testing are scoped as separate engagements.

What affects the cost of a source code test?

The size of the repository, the number of applications and APIs in scope, and the deployment model, which together decide how much work it takes to build, run and attack the code. That is why Tier 2 is quoted per codebase after the technical call rather than from a rate card. The retest of your fixes is part of a source code test, not an extra.

Who handles support and fixes after the test?

You decide who fixes the findings. An engineer verifies every finding before it is reported, and the report is written so your own IT team, your current provider or NetSys can act on it, with quick wins separated from fixes that need budget and a maintenance window. If NetSys does the remediation, it is quoted as a project or handled inside a month-to-month agreement, and a source code test includes a retest so each fix is confirmed rather than assumed. Testing itself stays inside the scope and window you signed.

Getting a quote for your environment

The fastest way to find out what a penetration test would cost for your business is to start with the one that costs nothing. NetSys runs a free Tier 1 external test that shows what an attacker sees from outside, and if you build or depend on custom software, we scope a Tier 2 source code test per codebase after an NDA and a look at the repository. Details and the request form are on our penetration testing page. To scope a broader test, book a call or call 845-203-3914 and ask for an engineer.

Sources and further reading

• OWASP Web Security Testing Guide, the reference most application testers work from.
• NIST SP 800-115, Technical Guide to Information Security Testing and Assessment.
• PCI Security Standards Council document library, including its penetration testing guidance.