Buying a penetration test for the first time is hard because the price range looks enormous. A quote of $3,000 and a quote of $40,000 can both be for "a penetration test." The difference is almost always scope and depth, not the quality of the tester. This guide explains what you are actually paying for.
Three things decide most of the cost.
Scope is the biggest factor. Testing one web application is a small job. Testing that application plus its API, its cloud infrastructure, and an internal network is several jobs. The more systems in scope, the more time the test takes, and time is what you pay for.
Depth is the second. A black box test simulates an outside attacker with no inside knowledge — it is faster and cheaper. A white box test gives the tester your source code and architecture, so they find deeper issues, but it takes longer. Most buyers start with black box and move to white box once they have a security budget.
Deliverables round it out. A report with reproduction steps, severity ratings, and remediation guidance takes real time to write well. A retest to confirm your fixes worked adds a little more. Both are worth insisting on.
These are directional, not a quote:
- A focused test of a single web application: the low thousands.
- A web application plus its API and authentication: mid thousands.
- A full external network, cloud, and application assessment: tens of thousands.
- A red team engagement (objective-based, models a real attacker): the top of that range and up, because it runs longer and across more surface.
Ask for a written scope before any testing starts. A good tester gives you a one-page statement of work that lists exactly what is in scope, what is out, what you will receive, and a fixed fee. If a quote is a single number with no scope attached, that is the warning sign — not the price itself.
Ask to see a sample report, too. It tells you more about quality than any sales call.
At SpidyOps, scoping is free: a short call, then a one-page statement of work with a fixed fee. Every finding comes with reproduction steps and a CVSS rating, and one retest is included. If you want to talk through what your app actually needs, get in touch.