A penetration test for a regulated mid-market or enterprise company usually costs between 8,000 and 60,000 EUR per engagement, and the number moves based on scope, depth, and the skill of the people doing the work. A focused test of a single web application sits at the low end. A broad assessment that covers your external perimeter, internal network, a customer-facing API, and a cloud environment sits at the high end. Anything priced below a few thousand EUR is almost always an automated scan wearing a pentest label, and we explain why that distinction matters later in this post.
The price question is really a scope question. Two vendors can quote the same target and land 40,000 EUR apart because one plans 5 days of testing and the other plans 20. Neither quote is wrong on its own. The cheaper one tests less. Once you understand what drives the days, you can read any quote, compare vendors fairly, and decide how much assurance you actually need. We do offensive testing for finance, healthcare, technology, infrastructure, and government clients, and the breakdown below reflects how we scope and price the work. For a wider view of the service category, see our overview of penetration testing services.
What you are actually paying for
A penetration test is skilled human time. The deliverable is a senior engineer who attacks your systems the way a real adversary would, finds the paths that automated tools miss, chains weaknesses together into a working exploit, and writes up what they found in language your engineers and your auditors can both use. You are not paying for a tool license. You are paying for judgment, for the hours spent understanding your business logic, and for the experience that turns a low-severity finding into a full account takeover. The cost reflects how many days of that work the engagement requires and how senior the people on it are.
- Pre-engagement scoping, where the tester maps your assets, agrees rules of engagement, and confirms what is in and out of bounds before any testing starts.
- Hands-on testing time, which is the largest cost component and where the actual attack work happens against your in-scope targets.
- Exploitation and chaining, where the tester proves real impact by combining findings rather than listing isolated issues that may or may not matter.
- Reporting and evidence, including a written report with reproduction steps, severity ratings, and remediation guidance that your developers can act on.
- A remediation retest, where the tester verifies that your fixes actually closed the holes rather than moving them, which most serious engagements include.
- Project management and a debrief call, so your team understands the findings and your leadership understands the residual risk.
The factors that move the price
Scope is the single biggest driver, but it is not the only one. Depth, methodology, and the seniority of the testers all change the day count. A black-box test where the tester starts with nothing takes longer to reach the same coverage than a white-box test where you hand over architecture diagrams and credentials. A test that must run inside a production environment with change windows and careful pacing costs more than one against a clean staging copy. The factors below explain most of the variance between quotes.
- The number and type of targets, since a single marketing site is a fraction of the effort of a transactional banking platform with dozens of authenticated roles.
- Depth of testing, where a surface-level check costs far less than a deep assessment that probes business logic, authorization, and chained attack paths.
- Black-box, grey-box, or white-box approach, since the information you provide up front changes how fast the tester reaches meaningful coverage.
- Environment constraints, because testing in production with restricted windows and rollback plans takes more careful hours than testing in staging.
- Tester seniority and independence, since a senior offensive engineer who finds logic flaws costs more per day and is worth more than a junior running a scanner.
- Compliance and reporting requirements, where attestation letters, framework mapping, and audit-ready evidence add real work to the engagement.
- Retest scope, because verifying fixes properly requires the tester to re-run the original attack rather than glance at a changelog.
Typical price ranges by test type
The ranges below are realistic for the European mid-market and enterprise. Treat them as starting points, not fixed rates, because a complex application in any category can push past the top of its band. The day count is what matters. Most vendors, including us, price in engineer-days, and a serious test rarely fits into one or two days no matter what the target is.
- External network penetration test, roughly 6,000 to 20,000 EUR, covering your internet-facing infrastructure and the services exposed at the perimeter, as described in our network penetration testing guide.
- Web application penetration test, roughly 8,000 to 35,000 EUR depending on the number of roles and features, with the web application penetration testing guide explaining what drives the higher end.
- API penetration test, roughly 7,000 to 30,000 EUR, since modern APIs carry sensitive logic and need testing against the OWASP API Security Top 10.
- Internal network or assumed-breach test, roughly 10,000 to 40,000 EUR, where the tester simulates an attacker who already has a foothold inside your network.
- Cloud security assessment, roughly 9,000 to 35,000 EUR, covering identity, configuration, and exposed services across AWS, Azure, or GCP, as covered in our cloud security assessment post.
- Full-scope or red team engagement, often 40,000 EUR and up, combining external, internal, social engineering, and detection evasion over several weeks.
How the engagement runs, step by step
Understanding the process helps you see where the days go and why a real test cannot be compressed into an afternoon. Every credible methodology follows the same arc, whether the vendor cites the PTES, the OWASP testing guide, or maps activity to MITRE ATT&CK. The names differ. The work does not.
- Scoping and rules of engagement, where we agree the targets, the testing windows, the contacts, and the limits, then put it in writing before anyone touches a system.
- Reconnaissance and mapping, where the tester enumerates the attack surface and identifies the technologies, endpoints, and entry points worth attacking.
- Vulnerability discovery, which combines tooling with manual analysis to find weaknesses that scanners alone never surface.
- Exploitation and post-exploitation, where the tester proves impact by gaining access, escalating privileges, and chaining findings into realistic attack paths.
- Reporting, where every finding gets a severity rating, clear reproduction steps, and remediation guidance written for the people who own the fix.
- Debrief and remediation retest, where we walk your team through the findings and later verify that the fixes hold under the same attacks that broke them.
A cheap pentest is the most expensive thing you can buy, because you pay for it twice: once for the report, and again when the breach proves the report was wrong.
Penetration test versus automated scan
This is where most budget confusion starts. An automated vulnerability scan is cheap, fast, and useful for hygiene, and it costs a few hundred to a few thousand EUR per run. It checks for known issues against signatures and version numbers. It cannot reason about your business logic, cannot tell whether one user can read another user's records, and cannot chain three medium findings into one critical breach. A penetration test does all of that because a human is driving it. If a quote is suspiciously low, you are almost certainly being sold a scan. We cover the distinction in detail in pentest versus scan and the related breakdown of PTaaS versus pentest versus automated scanning.
Both have a place. A mature program runs continuous automated scanning for coverage and commissions periodic human-led penetration tests for depth. The scan tells you what changed. The pentest tells you whether an attacker can actually hurt you. If you only have budget for one, and you are a regulated firm holding sensitive data, choose the human test. For the broader picture of how these activities fit together, our VAPT explainer walks through where vulnerability assessment ends and penetration testing begins.
How often you should test, and what that costs over a year
A single test is a snapshot. Your code, infrastructure, and threat landscape change every week, so the value of any test decays from the day it ends. Regulated firms should plan for an annual cadence at minimum, with additional tests triggered by significant change. Budget for the program, not the single engagement, because that is how you actually manage risk and how auditors expect you to operate.
- At least once per year for any system that holds regulated or sensitive data, which most frameworks treat as a baseline expectation.
- After any major release, architecture change, or migration, since a new feature can reopen an attack path you closed last quarter.
- Following a merger or acquisition, because you inherit the security debt of whatever you just bought along with its assets.
- On a continuous or recurring basis for high-value targets, often through a PTaaS model that spreads testing across the year rather than a single annual push.
- Whenever a regulator, customer, or auditor requires fresh evidence, which in practice means many firms test more than once a year regardless of internal preference.
How penetration testing ties to compliance
Most regulated firms buy penetration testing because a framework or regulator expects it, and the cost is easier to justify when it satisfies several obligations at once. The frameworks rarely dictate a single price, but they do dictate scope, independence, and evidence quality, all of which affect what you pay. A test scoped to produce audit-ready evidence costs more than a quiet internal check, and that premium is usually worth it because it serves both security and the auditor.
- The NIS2 Directive pushes essential and important entities toward regular testing of network and information systems as part of their risk management duties.
- DORA, in force across the EU financial sector since January 2025, requires regular digital operational resilience testing and threat-led penetration testing for the largest entities.
- ISO/IEC 27001:2022, with its 93 Annex A controls across four themes, expects technical vulnerability management and assurance activity that penetration testing supports.
- SOC 2 reports against the Trust Services Criteria are stronger when backed by independent penetration testing evidence, which auditors and customers increasingly ask to see.
- Firms building or deploying AI systems face fresh testing expectations, which we cover in AI security and securing LLM apps alongside our AI security service.
If your goal is to satisfy more than one framework with a single program, our governance and compliance work helps you scope tests so the evidence maps cleanly to each obligation. The difference between NIS2 and DORA matters here, because the financial sector carries the heavier testing burden.
Common mistakes and red flags when buying
Most buyers overpay for shallow work or underpay and get a scan. The fixes are simple once you know the patterns. The biggest mistake is comparing quotes on price alone without comparing the day count and the methodology behind them. The second biggest is treating the report as the finish line rather than the start of remediation. Our guide on how to choose a penetration testing company goes deeper, but these are the signals we tell buyers to watch.
- A flat, suspiciously low price with no scoping call, which almost always means an automated scan dressed up as a manual test.
- A quote that hides the engineer-day count, since days are the only honest basis for comparing one vendor against another.
- No retest included, which leaves you paying separately to confirm that your fixes actually worked.
- A sample report that is a tool export with no exploitation, no chaining, and no business context, which tells you the testing was shallow.
- Testers who refuse to name a methodology or who cannot explain how they go beyond scanning, which is a sign you are buying signatures, not skill.
- Scope that conveniently excludes your most sensitive systems, so the report looks clean while your real risk goes untested.
Where the money is well spent and where it is not
Spend on senior testing time against the systems that would hurt most if they were breached. That usually means your authenticated application, your payment or data flows, and your cloud identity layer. Do not spend equal effort on a brochure website with no login. Match the depth to the impact. A well-scoped test concentrates its days where an attacker would concentrate effort, and a good vendor will tell you to cut scope that adds cost without adding assurance. Continuous coverage between tests belongs to scanning and to monitoring, which is why we pair offensive work with managed detection and response for clients who need eyes on their environment year round.
It is also worth knowing your own attack surface before you scope, because you cannot test what you have not mapped. Many firms discover forgotten subdomains and exposed services only when a tester finds them. Our post on external attack surface management explains how to get that inventory right, which in turn makes your test cheaper and sharper because no days are wasted on discovery you could have done yourself.
The honest answer to what a penetration test costs is that it depends on what you need to be sure about, and a good vendor will tell you that before quoting a number. If you want a price grounded in your actual systems rather than a generic band, look at our offensive security service and then book a scoping call. We will map your scope, tell you how many days the work takes, and explain exactly what each one buys you.