Penetration Testing Cost in 2026: Prices by Scope

What does a penetration test cost by scope?

Scope sets the price. Testing one web application is a different job from testing an API, an internet-facing network range, a cloud environment or a mobile app, and each is priced on its own. The table puts Agency's posted price beside market prices for each scope: Agency's own opinion of the market where it has one, and public records of what government buyers paid or were quoted.

Read the public records in the right-hand column as individual records, not averages. The Mississippi figures are the per-application prices that 12 approved vendors list for a state contract, and they span two orders of magnitude. The UK figures are single contract awards, and most notices do not state how many applications, addresses or tester days were bought.

The figures marked as Agency's opinion of the market are Agency's own view of what the same scope costs elsewhere, not a published survey.

Three provider models sit behind those prices. A fixed-price product posts one price for a defined scope. A quote-based firm prices after a scoping call. An automated or AI testing service is sold by subscription, and the amount of human review varies by vendor. Compare them on who tests, what is in scope and what the report contains before comparing totals.

Agency estimates that more than 90% of its web app penetration test orders are for the web app alone, without the API add-on.

What is included in Agency's fixed price?

The product is the Web App Penetration Test for Compliance. Agency's pen testing page lists what the fixed price covers:

• One production web application, on one domain or URL route.
• Manual, authenticated testing with the test accounts you provide.
• Named individual testers holding OSCP+ and CREST certifications.
• A signed report that lists the testers who did the work.
• An attestation letter you can share in place of the full report.
• Follow-up questions and discussion about the findings.

Four add-ons carry posted prices. You select them on the order request.

Standard delivery is 21 days on average from start, and rush delivery is as little as 5 days from start, per the order page. Start is the day Agency has received payment, test credentials and the signed rules of engagement.

Mobile apps, network testing, cloud configuration review, source code review and social engineering are outside the product. Agency scopes those by quote.

What moves the price of a penetration test?

Six things change the amount of tester time, and tester time is what you pay for. On US federal schedules, the median ceiling rate for labor categories containing "penetration tester" was $156.24 an hour across 442 rate records on November 14, 2026, per GSA's CALC pricing data.

1. Number of targets. Each application, API or network range is tested separately. The PCI Security Standards Council's penetration testing guidance says engagements "may last days or weeks depending on the scope of the test and size of the environment to be tested." Define targets with the same care as your audit boundary; the glossary entry on in-scope systems explains how that boundary is drawn.
2. Authenticated or unauthenticated testing. Testing behind the login takes longer than testing the public surface. The same PCI guidance asks for testing "against all roles or types of access" when an application requires authentication, so each extra role adds work.
3. Manual or automated work. A person working through the application takes more time than a scanner run. NIST SP 800-115 calls penetration testing "labor-intensive" work that "requires great expertise," which is why a scan report is not a penetration test.
4. Tester qualifications. A report that names certified testers is easier to defend in an audit, so ask who will test and what they hold. Certifications also lapse: OffSec's OSCP+ designation expires three years from issuance. CREST's Registered Penetration Tester exam is recognized by the UK National Cyber Security Centre for its CHECK scheme.
5. Retest. Confirming your fixes is a second visit. Check whether it is included, priced or left out.
6. Speed. A short deadline means the provider reserves testers for you.

Agency's median web app test reports 6 to 8 findings, usually with 1 critical finding, which is the workload to plan remediation time around.

What should a penetration test statement of work include?

A statement of work fixes the scope and the price before testing starts. Use this sample as a checklist against any proposal. The figures are Agency's posted terms.

• Target: one production web application, named by URL, with the environment and the user roles to test.
• Method: manual, authenticated testing by named testers, with their certifications listed.
• Start condition: payment, test credentials and signed rules of engagement received.
• Delivery: the standard and rush dates, counted from the start condition.
• Deliverables: a signed report with proof of exploit, a severity rating, reproduction steps and remediation guidance for each finding, plus an attestation letter.
• Retest: how many retests, within what window, and whether the report is reissued.
• Exclusions: anything not tested, such as mobile apps, networks, cloud configuration or source code.
• Price: the base price and each add-on as a separate line. For Agency's product that is $5,000 fixed plus any posted add-on, per Agency pricing.

If a proposal leaves one of these blank, ask for it in writing. A missing retest clause or an unnamed tester is where quotes that look alike turn out to differ.

How should you budget the test into your audit year?

Buy the test for the framework that needs it, then reuse the report. One signed report can serve as evidence for a SOC 2 examination, an ISO 27001 certification audit and a customer security review in the same year. Agency answers the requirement question directly in do I need a pen test for SOC 2.

Schedule the test early enough to fix findings and retest before your auditor asks for the report. For where the test sits in a full first-year budget, see what SOC 2 costs. For timing it in year two, see the SOC 2 renewal calendar. ISO 27001 buyers can place it in the three-year view in ISO 27001 certification cost.

Agency's web app test is ordered online with no sales call: send the order request, sign the order form, pay and hand over test credentials.