How Much Does a Pentest Cost? An Honest Price Breakdown
Ask five providers what a web security audit costs and you will get five answers spanning two orders of magnitude, all of them defensible. That is not because the market is dishonest. It is because "audit" is not a unit of anything. This article explains what you are actually buying at each price point, with real published figures where they exist, and — importantly — when a cheap audit is the wrong purchase.
The unit of price is a tester-day
Almost every audit price is derived from one number: how many days a human spends on your application, multiplied by that human's day rate. The methodology, the report template, the platform — all of it is packaging around that number.
Some providers do publish. The French firm Acylia lists a freelance pentester day rate of €600–1,000 and three worked examples: a 3-day white-box web application test at €2,100, a 6-day black-box external test at €4,800, and a 15-day internal network test for a company with more than 500 workstations at €13,500. Treat that as one provider's rate card, not a market average — but the shape is right: days × rate, plus writing time.
Once you internalise that, the range stops being mysterious. A scanner costs almost nothing because no human is involved. A fixed-price audit costs a few hundred because human time is capped before work starts. A quoted pentest costs four to five figures because it buys one or two specialists for anything from a few days to three weeks.
Why almost nobody publishes a price
If you have tried to compare providers, you already know: public price lists are rare. Several established French providers have a page whose URL promises rates and whose content contains none — only a quote request form. Cobalt's pricing page shows exactly one public number, $3,500 for an autonomous pentest, and even that is flagged as a limited time offer; everything else routes to sales. Intruder publishes a free tier and "starting from $3,500 / test" for AI pentesting, but hides its Cloud and Pro figures.
There are legitimate reasons. Price genuinely depends on scope, and scope is only knowable after a conversation. There are also less noble ones: opacity makes comparison shopping hard, and enterprise buyers rarely resist a quote-only process.
The consequence for you: any headline figure you read online — including the ones in this article — is an order of magnitude, not a price. Anyone claiming a precise market average is estimating.
Tier 1: free and automated — real value, hard limits
You can do a great deal for nothing. OWASP ZAP is free and open source and will crawl and probe a web application. The MDN HTTP Observatory grades your headers and transport configuration in seconds. The OWASP Web Security Testing Guide is the full methodology, published under Creative Commons, that professionals actually work from.
Commercial scanners with public pricing sit just above: Pentest-Tools.com starts at $95/month on an annual plan for 5 assets, and Astra's DAST scanner starts at $69/month, $199 for the standard tier.
What this tier genuinely delivers: known CVEs in your dependencies, missing or misconfigured security headers, weak TLS settings, exposed admin panels and backup files, the most visible injection points with reflected XSS at the front, and — the underrated part — continuous regression checking after every deploy. What you can run yourself, and in what order, is laid out in where to start with no security team.
What it structurally cannot deliver: anything that requires understanding what your application is for. A scanner does not know that order #4192 belongs to another customer, that the role field in a signup payload should not be honoured, that a 12% discount coupon can be applied eleven times, or that skipping step three of your checkout ships the goods unpaid. These are authorisation and business-logic flaws, they are among the most damaging classes in the OWASP Top 10, and no scanner reports them. You also get raw output including false positives, which someone has to triage — that someone is you.
Tier 2: fixed-price audits
Between the scanner and the quote sits a small category: a manual review of one named application, delivered for a published, fixed amount. Astra's PTaaS tiers ($1,999 and $5,999 per year) are one version of it; a single-shot report from an independent developer at a few hundred euros is another.
The honest arithmetic matters here. At a €600–1,000 day rate, a €200 engagement does not buy a week of work. It buys a focused, time-boxed pass over one application's exposed surface — auth and session handling, access control between accounts, injection, exposed endpoints, server and header configuration, dependency exposure — with results reproduced by hand and written up.
That is a real product with a real limit. What you get is a prioritised written report you can act on and hand to a customer who asked about your security. What you do not get is depth over weeks, coverage of anything outside the named scope, or an attestation carrying regulatory weight. If a fixed-price provider implies otherwise, that is the tell.
Tier 3: quoted penetration tests
Above roughly €3,000–5,000 you are buying scoped tester-days. The same Acylia rate card puts a web application at €3,000–12,000, and well into five or six figures for internal networks, cloud estates and red team work — but see the previous section on why those numbers are soft.
What the money buys that the tiers below cannot: multiple testers, chained attack paths, authenticated testing across several roles, custom tooling for your stack, a retest cycle, and a named provider your customer's auditor will accept.
In France there is a formal marker for that last point. The ANSSI's PASSI qualification covers five audit scopes — architecture, configuration, source code, penetration testing, and organisational/physical — and qualified providers are listed in the state-run MesServicesCyber directory. If your contract or regulator requires a qualified provider, price is not the variable you are optimising.
When you should pay far more than a few hundred euros
Be blunt with yourself about which of these applies:
- You handle card data. PCI DSS v4.x requires internal and external penetration testing at least annually and after any significant change, under requirement 11.4, assessed against a documented methodology. See the PCI Security Standards Council. A cheap report does not satisfy an assessor.
- You handle health data in France. Hosting personal health data requires HDS certification, delivered by a COFRAC-accredited body over a documentary review and an on-site audit. That is a certification programme, not a pentest, and no audit substitutes for it.
- You fall under NIS 2. The ANSSI's guidance and its ReCyF framework define what essential and important entities are expected to implement. This is a security programme, not a one-off purchase.
- You need to satisfy GDPR Article 32. The text requires "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures" (Art. 32(1)(d)). Note the word process. One report, once, is not one.
- The application is genuinely complex or critical. Multi-tenant SaaS with cross-tenant isolation to prove, custom cryptography, money movement, industrial or medical systems. Days of work, not hours.
- A customer demands an attestation. If a procurement questionnaire names a qualification, only a provider holding it can close the deal.
Three questions that expose a bad quote
Three questions are enough to tell whether the number in front of you corresponds to work:
- How many tester-days, and who performs them?
- What proportion of the work is manual versus tool output?
- Is a retest included in the price or billed separately, and within what window?
The questions about what actually gets delivered — written scope, reproducible findings, attestation, what happens to the evidence — are collected in how to read a security audit report, which is where they earn their keep.
Two red flags worth naming. A "report" that is a scanner PDF with a logo on it: ask for reproduction steps and watch what happens. And pricing per vulnerability found, which quietly rewards volume over accuracy.
Budget the fix, not just the finding
The audit is the cheap part. In Cobalt's 2026 State of Pentesting report — a vendor publication, read it as such — the median organisation takes 39 days to resolve high-risk findings. The same report puts the half-life of those findings at 10 days for the best-performing organisations and 249 days for the worst. A report nobody has time to act on is money spent on anxiety. Decide who owns remediation before you decide who does the testing.
The honest comparison
| Automated scanner | Fixed-price audit | Quoted pentest | |
|---|---|---|---|
| Typical price | Free to ~$200/month | A few hundred to ~€2,000 | €3,000 to €50,000+ |
| Turnaround | Minutes to hours | Days | 2 to 8 weeks including scoping |
| Human analysis | None | Time-boxed, one tester | Scoped days, often several testers |
| Finds known CVEs, headers, TLS, exposed files | Yes | Yes | Yes |
| Finds broken access control and business-logic flaws | No | Some, within the time box | Yes, systematically |
| False positives filtered | No | Yes | Yes |
| Continuous / after every deploy | Yes | No | No |
| Retest after fixes | N/A | Sometimes | Usually |
| Attestation a regulator or auditor accepts | No | No | Depends on the provider's qualification |
| Covers internal network, source code, mobile, social engineering | No | No | If scoped and paid for |
| Best for | Continuous hygiene | A first real look at one application | Compliance, critical systems, depth |
The three are not competitors. The sane sequence for a small team is: run the free tools continuously — the list and the order are here — get one manual look at the application to find what tools cannot, and escalate to a scoped engagement when regulation, contracts, or genuine risk demand it. Before you sign anything, know what the document you are buying looks like.
If the middle row is where you are — one web application and its API, a written report, a price you know in advance — here is the offer, exactly.
That is what iwantreport.dev sells: one web application and its API, tested against the OWASP Top 10, the API Security Top 10, the CWE Top 25 and the OWASP ASVS — a scanner on the first pass, then every result reproduced by hand before it enters the report. Written report within 48 hours, one re-test included, 200 €, 30-day money-back guarantee: just ask by email within 30 days of delivery. Out of scope: internal network, source code review, phishing and social engineering, load or denial-of-service testing, and mobile applications.