How much does a penetration test actually cost?

Pentest pricing feels opaque because almost every vendor hides it behind a sales call. But the market sorts into five clear tiers. Here’s what each one actually buys you — including where our own tier does and doesn’t fit.

• Scope — one marketing site vs. a multi-tenant platform with APIs and mobile apps can be a 20x difference in testing hours.
• Methodology — manual hours from senior humans are the expensive part, and the valuable part. Automation is cheap, which is exactly why it’s what cheap “pentests” quietly sell you.
• Reporting — a formal deliverable with evidence, severity ratings and remediation steps takes real time to write well.
• Compliance paperwork — accreditations, attestation letters and auditor-ready formats add cost that only matters if a framework requires them.

The cost-saving trick behind productized testing isn’t cutting the human out — it’s cutting the sales process, custom scoping and project management out. A fixed small-site scope with a repeatable methodology means the human hours go into testing, not meetings.

Under $500

Skip anything that calls a scan a pentest. Start with a genuinely free passive check, then buy productized manual testing — verify a human tests and a written report is included. At this level Bug Circuit’s $49 audit or $299 audit-plus-fixes is our own answer, and the report is written so you can share it with enterprise customers who ask for proof of testing.

$500–$3,000

You’re in freelancer territory. It can be excellent value or wasted money — vet references, ask for a redacted sample report, and confirm they carry out authorized testing with a written agreement.

$3,500 and up

Boutique firms make sense once your application is genuinely complex or a customer contract demands a named, established firm. Compare at least two proposals and check what retesting after fixes costs — it’s often a surprise line item.

• “Do humans do the testing, and who are they?” If the answer dodges into tooling talk, you’re buying a scan.
• “Can I see a sample report?” A real one shows evidence, plain-English impact and specific fixes — not a raw tool export.
• “Is retesting after fixes included?” Finding issues without verifying the fixes is half a service.
• “How do you authorize testing?” Legitimate testers verify you own the target and record an authorization before anything active — anyone who skips this is a red flag.
• “What happens if you find nothing?” The right answer: you still get a report documenting what was tested. That document has real value with customers.

Honesty cuts both ways, so here’s ours: if a compliance framework, cyber-insurance policy or customer contract mandates a test from an accredited firm, a $49 productized audit won’t satisfy it — you need the boutique or enterprise tier, and no discount changes that. The same is true if your product is a large custom application with complex integrations; a small-site scope simply won’t cover it.

But most small businesses aren’t in that position. They need to know whether their actual website is actually hackable, documented by someone who tested it by hand — and until recently the only honest option started at $3,500. That’s the gap productized testing exists to close. If you’re unsure which side of the line you’re on, ask us — we’ll tell you straight, including when the answer is “you need a bigger firm than us.”