Almost nobody in this industry publishes prices, including us, and the reason is not a conspiracy. A number on a page is either too high for a single small application or far too low for a banking group, and quoting one would mean most of the people who read it walk away with the wrong idea.
But what the number is made of is not a secret, and you should not have to take three quotes on trust to work it out. Here is what actually moves the figure.
The unit is tester-days
Everything else is a way of counting them. A penetration test is a person working on your systems for a number of days, plus the days spent writing it up. Any pricing model that cannot be converted back into days - per IP address, per application, per month, unlimited - is hiding how many days you are getting, and the answer is usually fewer than you think.
So the first question for any quote, ours included, is: how many tester-days, and how many of those are testing rather than reporting?
What adds days
- User roles. The single biggest multiplier on a web application and the one most often left out of a cheap quote. Access control has to be tested between every pair of roles, in both directions. Two roles is not twice the work of one, but five roles is a great deal more than two.
- Distinct applications. An admin portal on a different codebase is a second application, whatever the marketing site calls it.
- APIs. Counted separately from the interface in front of them, because they are tested separately. A mobile app with a large backend is mostly a backend engagement.
- Network size and Active Directory. An internal test of a flat 200-host network is not the same exercise as one across four sites with a domain that has been accumulating configuration since 2011.
- Depth of business logic. A brochure site has none. A trading platform, a lending flow or a claims system has a great deal, and that is where the findings that matter live.
- On-site work. Wireless testing has to be done in the building. Internal testing often does not, which is worth knowing before you pay for travel.
- Out-of-hours or production-only windows. Real constraints, and they cost real days.
Until somebody has attacked the fix, your risk has not changed - you only know about it. A quote that prices the retest separately is quoting you for half a job. Ask whether it is included before you compare two numbers, because that single line can be most of the difference between them.
What adds price without adding days
Travel and accommodation, obviously. Beyond that: a brand, an accreditation your buyer asked for by name, and the overhead of a firm with an account manager between you and the person doing the work. None of these are illegitimate - an accreditation your customer requires is worth paying for - but you should know which part of the invoice is testing and which part is not.
It is worth checking whether the accreditation is actually required or merely assumed. We went through the Gulf frameworks clause by clause in a separate piece; in most of the region it is not required by anyone.
What should make you suspicious
- A fixed price before a scoping call. Nobody can price work they have not been told the shape of. A number arriving within an hour of your first email is a number for a scan.
- “Unlimited” testing. There is no such thing. There is a number of days, and this phrasing exists to avoid telling you what it is.
- Per-IP pricing for a web application. One address can host one page or four thousand. Pricing by address for application work means the work is automated.
- A sample report that is tool output with a cover page. Ask for a redacted real report. How the executive summary is written tells you more than any certification on the proposal.
- No named testers. You are buying days of a specific person’s attention. Ask who, and what they hold.
How a normal web application test is built up
To make this concrete, without inventing a currency figure: a single web application with three user roles, an admin portal and a REST API behind it typically comes out at around nine to eleven tester-days. Roughly: one day mapping the application properly across all three roles; four to five days of manual testing against the OWASP Web Security Testing Guide, with access control between roles taking the largest single share; one day on the API; two days writing it up so both your board and your developers can use it; and one day for the retest after you have fixed things.
Take any quote you are considering and try to split it that way. If it will not split, that is the finding.
Why we still will not print a price list
Because the honest version of one would have so many conditions attached that it would stop being a price. What we will do is scope the work on a call, put the days and the scope in writing before anything is agreed, and hold the price to that scope. If the scope grows mid-test we tell you what it would add and you decide - we do not discover it in the invoice.
If you want a number for budgeting, tell us roughly what you have and we will give you a range on the call, for nothing, including the case where the answer is that you do not need us this year.
Comparing quotes
What is the first question to ask about any quote?
How many tester-days, and how many of those are testing rather than writing? Everything else in a penetration test price is a way of counting days. A model that cannot be converted back into days - per IP, per application, per month, unlimited - is hiding how few you are getting.
Why does the number of user roles matter so much?
Because access control has to be tested between every pair of roles, in both directions, and that is where the serious findings usually are. One role to two is not double the work, but five roles is far more than two, and a cheap quote has often quietly scoped a single role.
Should the retest be included?
Yes, and if it is not, you are comparing a whole job against half a job. Until somebody has attacked the fix your risk has not changed; you only know about it. That one line is often most of the difference between two quotes.
Can you give us a rough number before we commit to anything?
Yes, on a call, for nothing. Tell us roughly what you have and we will give you a range and a day count, including the case where the answer is that you do not need a test this year. What we will not do is put a figure in writing before we know the shape of the work, because that number would have to be wrong in one direction or the other.
Want this done on your own systems?
We scope the work in writing first, so you know exactly what will be touched and when.
Book a free consultation Back to the blog