The price of a pentest depends on scope, the proportion of manual testing, the specialist's time, whether retesting is included, and the type of report delivered. That is why there is no standard price, and a quote given before understanding the scope probably describes another service.
The term penetration testing covers very different work: from an automated scan lasting a few hours to weeks of manual analysis of a financial institution's critical workflows.
Which variables affect the price?
The first is scope: how many applications, APIs, network addresses, and apps are included, and how complex each is. An application with authenticated areas, multiple user roles, and custom business rules requires more work than a set of corporate pages.
The second is visibility. With no prior information (black box), the test better simulates an external attacker but spends time discovering what the company could provide. With some access (gray box), the cost-to-result ratio is usually better. With access to code and architecture (white box), the analysis goes deeper.
Manual testing, duration, and seniority
Automated scans help identify signs of known flaws. Contextual investigation, manually or through autonomous agents, tests business rules and chains findings to demonstrate impact. It is worth asking how a proposal combines coverage, validation, and expert review.
For broad assessments, duration also matters. A Vultus Red Team Assessment runs for four or eight weeks, and the difference between the two options is the depth that only time can provide. The team's seniority and practical certifications complete the equation and are the hardest variable to compare.
Retesting, reporting, and follow-up
After remediation, someone needs to confirm that it worked. Some proposals include retesting, others charge separately, and others do not offer it. Reports also vary: a technical list of vulnerabilities serves the IT team, while an executive report with the attack chain and impact indicators allows results to reach budget decision-makers.
Post-delivery follow-up, including a platform for managing remediation and governance meetings, is another factor affecting cost. Vultus's Red Team service includes three months of follow-up after the report.
Fictional example: two proposals for the same scope
A fictional fintech receives two proposals to test its main application. The first, roughly one-third cheaper, includes three days of automated scanning with manual validation of findings and retesting charged separately. The second includes three weeks of manual testing with different user roles, an executive report, and retesting included.
The first tends to return a long list of medium- and low-severity items, such as missing headers and outdated versions. The second tends to find fewer items, including an authorization flaw: changing an identifier in the URL allows access to another customer's data. This type of flaw, described in the category OWASP API1:2023, can be demonstrated by specialists or autonomous agents testing business logic with users in different roles.
How to compare proposals
Before comparing prices, make sure you are comparing equivalent services:
- Scope: is the asset list the same in both proposals?
- Visibility: is the test type (black, gray, or white box) the same?
- Manual testing: how many hours does each proposal include?
- Retest: is it included, and within what timeframe?
- Report: is there an anonymized example to evaluate?
- Team: who performs the test, by name and certification?
- Critical findings: what happens if a serious issue is found during the test?
Proposals with different answers to these questions describe different services.
The market as a whole continues to expand. Gartner projects worldwide information security spending to reach US$240 billion in 2026, up 12.5% from 2025, with security services accounting for about US$93 billion of that total.
Cost per cycle and frequency
With autonomous AI pentesting, the cost per cycle tends to be lower because reconnaissance and enumeration take less time. The main advantage is the ability to repeat testing more frequently, the subject of the article on continuous pentesting and autonomous testing. Also explore the Vultus advanced pentesting and learn how to choose a pentesting company.
