How Much Does a Penetration Test Cost in 2026?

Most professional penetration tests in 2026 cost between $8,000 and $30,000 per engagement, with small external network tests starting around $4,000 and complex multi-tenant application or AI work reaching $40,000 and beyond. Where you land in that spread is driven by scope: how many endpoints, roles, and tenants are in play, whether a retest is included, and how much report you actually need. Anything priced around $2,000 is almost always a vulnerability scan with a cover page, which is a different product solving a different problem. Below are working ranges by test type, the levers that move each of them, and how the economics change when you shift from annual projects to testing as a service.

Ranges by test type

These reflect the US market for skilled, manual-led testing from an established firm. Boutique specialists and the big consultancies both exist outside these bands, in opposite directions.

• Web application: $8,000 to $30,000. A marketing site with one login form sits at the bottom. A multi-role SaaS platform with file uploads, payments, and an admin surface sits at the top, because authenticated testing across three or four roles is where the hours go.
• External network: $4,000 to $15,000. Priced mostly on live host count. A single office with a dozen exposed services is routine; hundreds of addresses accumulated through acquisitions is not.
• Internal network: $8,000 to $30,000. Usually run as assumed breach from an implant or a standard user account. Active Directory size, segmentation, and the number of sites drive the effort.
• API: $8,000 to $25,000. Endpoint count matters less than authorization complexity. Object level and function level access checks across roles and tenants are manual work, and they are where the serious findings live.
• Cloud configuration review: $6,000 to $20,000. Scales with account count and service sprawl. One production AWS account reviews quickly; forty accounts across three providers is a project.
• AI and LLM testing: $10,000 to $40,000. The widest band because the surface varies most: a chatbot wrapper is days of work, while an agent holding tools, credentials, and retrieval is weeks. The market is young, so scrutinize methodology hardest here.

What actually moves the price

Scope is the headline driver, but four specifics do most of the work. First, authenticated roles and tenants. Every additional role multiplies the authorization test matrix, and proper multi-tenant isolation testing requires at least two tenants under the tester's control. A quote that does not ask about roles is a quote for unauthenticated scanning. Second, retest inclusion. Verifying your fixes is either bundled, typically adding 10 to 20 percent, or sold back to you later at a day rate. Ask up front, because a finding you cannot prove you fixed is worth little in a sales cycle or an audit.

Third, report depth. An attestation letter for a customer costs less to produce than a full technical report with reproduction steps, evidence, and remediation guidance mapped to a framework, and some buyers need both plus a board summary. Fourth, logistics: production versus staging environments, testing windows outside business hours, compressed timelines, and compliance-specific methodology requirements such as PCI DSS or FedRAMP all add hours that show up in the number.

What does not move the price much is the tooling. Every competent firm runs comparable scanners. You are paying for the humans, which is exactly why the bottom of the market looks the way it does.

What changed for 2026

Three shifts are showing up in quotes this year. AI surfaces joined scope lists: anything with a model touching tools or customer data now gets its own line, priced the way early cloud testing was, wide and methodology-dependent. Buyers got stricter: enterprise customers and cyber insurers increasingly ask whether testing was manual, who performed it, and when the last retest happened, which pushes demand toward the credible middle of the market. And day rates crept up modestly with senior talent scarcity, single digit percentages year over year rather than anything dramatic. None of it changes the buying logic; it raises the cost of pretending a scan is a test.

Why the $2,000 pentest is a scan with a cover page

The arithmetic does not work any other way. A skilled tester bills out between $1,500 and $2,500 a day, and a real test of even a modest application takes five to ten tester days plus reporting and review. At $2,000 all-in, the vendor can afford a few hours of setup, an automated scan, and a templated report. That is not fraud, it is a scan, and scans are useful. The problem is the label, because a scan presented as a penetration test fails at the moment it matters: a customer's security team reads the report, or an attacker finds the authorization flaw no scanner can see.

Telling the two apart takes five minutes. Ask who is testing and what their certifications are. Ask for a sanitized sample report and look for findings a scanner cannot produce: authorization bypasses, business logic abuse, chained exploits. Ask how many manual testing days are in the quote. Vague answers to any of those are the answer.

The expensive version of this mistake is procedural. A customer requires a penetration test to close a deal, procurement picks the cheapest PDF, and the report sails through until an enterprise security team actually reads it. The deal stalls, the real test gets purchased in a hurry at rush pricing, and the total spend lands well above what the credible test would have cost in the first place. If the report's audience is a security team, buy for that reader.

Project versus PTaaS economics

The traditional model is a project: scope, test, report, retest, done for the year. It fits stable applications, annual compliance cycles, and point-in-time questions like an acquisition or a major release. The weakness is the calendar. A SaaS product shipping weekly gets tested on two of its releases and not the other fifty.

Penetration testing as a service converts the spend to a subscription, commonly $20,000 to $60,000 a year depending on asset count and cadence, with testing triggered by releases rather than by the calendar, findings delivered into your ticketing system as they are found, and retests on demand. For teams that ship continuously, the comparison is not really price. Two point-in-time projects with retests cost about the same money and leave roughly 350 untested days between them.

The honest caveat: PTaaS only makes sense when the underlying work is still manual and senior. A subscription to a scanner dashboard with quarterly human check-ins is the $2,000 pentest with recurring billing.

If you go the subscription route, read the contract for four things: named testers rather than a rotating anonymous pool, a defined process for adding scope mid-year, a service level on how fast findings reach your engineers, and retest turnaround measured in days. Those four clauses are the difference between a testing program and a dashboard subscription.

Budgeting your own time

The invoice is not the whole cost, and the internal side is predictable enough to plan. Expect a scoping call and a short questionnaire before the quote, then a few hours of preparation: test accounts across each role, a second tenant if isolation is in scope, credentials and documentation for the API, and a decision about production versus staging with test data ready. During the test, someone on your side fields tester questions and watches for impact. After delivery, engineering time to triage and fix is the real budget line, and it dwarfs the coordination effort. Plan the remediation window between report and retest before the test starts, because the retest deadline is what turns findings into fixes rather than into a backlog.

Buying this well

Start from the question you need answered, not from a product name. If a customer wants proof your platform protects their data, that points at a deep web application penetration test across every role. If your product is the API, buy dedicated API penetration testing with multi-tenant coverage rather than treating endpoints as an afterthought to a web test. If you ship weekly and findings need to flow into engineering rather than into a PDF, look at continuous penetration testing instead of stacking one-off projects.

Then scope accurately, budget for the retest, and reserve remediation time between test and retest, because the report is the midpoint of the exercise rather than the end of it. The full picture of what we test and how engagements are scoped is on our penetration testing services page, including how we price the roles, tenants, and report depth this article just told you to ask every vendor about.