Pentest Cost FAQ: Procurement Answers for 2026

A pentest costs between $4,000 and $50,000 for most web application and API engagements. Those bands are our own market synthesis. A few vendors publish real figures: Astra's pentest plans at $2,999 and $5,999 a year per target, Cobalt's Autonomous Pentest at $3,500 per test, Synack's packages from $4,181, and Bugcrowd's standard pentest units from $5,000. HackerOne, Bishop Fox, NCC Group, Trail of Bits and IOActive publish no prices. Enterprise red-team engagements can reach $100,000-$200,000+. The exact price depends on application type, endpoint count, authentication complexity, and data sensitivity.

$5,000-$15,000 for a first-time SOC 2-driven web app pentest at a Series A-B startup. A single small web app (1-15 endpoints) with OWASP Top 10 coverage costs $5,000-$8,000 from a mid-market consultancy; for comparison, Bugcrowd's published Small standard pentest unit is $5,000. Web + API coverage: $8,000-$15,000. Anything under $3,000 labelled 'pentest' is almost certainly automated scanning.

A $5,000 pentest covers a single small web application with up to 15 endpoints, OWASP Top 10 checks, light manual testing beyond automated scanning, a 5-15 page summary report, and basic retest within 30 days for critical findings. It will not include deep business-logic testing, authentication bypass chaining, or API depth beyond surface-level.

PTaaS (Pentest as a Service) is a subscription model where you buy credits redeemable for tester hours via a platform. Cobalt publishes its credit model (1 credit = 8 hours) but no price for its credit tiers; Synack and Bugcrowd do publish package and unit prices. At the same annual spend, PTaaS provides continuous coverage but shallower individual tests; traditional SOW provides depth once. PTaaS wins if you ship code continuously; SOW wins if you need a single compliance attestation.

Not for its credit tiers. Cobalt publishes its credit model (1 credit = 8 hours) and three tiers (Standard, Premium, Enterprise) on its pricing page, but every tier routes to a quote. Its one published dollar figure is the Autonomous Pentest at $3,500 per test, a limited time offer for tests initiated and completed before 31 December 2026.

A typical web application pentest takes 1-3 weeks of test execution plus 1-2 weeks for report production. A few vendors publish start times: Cobalt says 1 to 3 business days depending on tier, and Bugcrowd's standard units launch within three business days. Synack publishes assessment windows of 4-5, 5, and 14 or 365 days by package. The consultancies publish no lead times.

Retests typically cost 15-30% of the original engagement fee, bounded by a 30-90 day window. On a $20,000 engagement: $3,000-$6,000 for a retest. Some vendors publish their terms: Cobalt lists free retesting for 6 or 12 months depending on tier, Bugcrowd's standard web app, network and API units include 12 months of retesting with one report update, and every Synack package lists patch verification. Bishop Fox lists retesting as a deliverable without publishing terms.

Yes, for anything quoted. The usual levers are contract length, volume (more credits, units or targets in one order) and a competing quote for the same scope. None of the vendors we track publishes its discount terms, so we do not quote discount percentages. Agree retest terms in the original order rather than adding them later: some vendors publish them (Cobalt, Bugcrowd, Synack) and others leave them to the quote.

A vulnerability scan is automated and finds known CVEs against a signature database. A pentest is manual and finds business-logic flaws, authentication bypasses, and chained exploits that automated tools miss. Anything labelled 'pentest' under $3,000 is almost certainly the former. Real pentests require human testers who reason about your specific architecture, authentication design, and data flows.

Annually at minimum for compliance requirements (PCI DSS 11.4, SOC 2, ISO 27001 Annex A). After major releases or significant infrastructure changes. Continuously if you're a high-threat-profile company via PTaaS.

Define: (1) application type (web, API, mobile, cloud, network), (2) endpoint count, (3) authentication model (simple session, OAuth, multi-tenant), (4) data sensitivity (PII, PCI, HIPAA), (5) test type (black/grey/white box). Use the scope estimator on this site to map these inputs to a price band before your first vendor call.

$1,500-$3,500/day for mid-market consultancies (BSG, Deepstrike data). $4,000-$7,000/day for senior boutique / Big-4 firms. Independent contractors: $1,200-$2,000/day. PTaaS credits are not comparable without a quote: Cobalt defines a credit as 8 hours of testing but publishes no credit price. UK/EMEA rates are 20-35% lower for equivalent seniority.

Among published prices, Astra lists per-target plans from $699 a year for automated scanning and $2,999 a year for an autonomous pentest. Among the 8 vendors in our comparison, Cobalt's Autonomous Pentest at $3,500, Synack's Sara Pentest from $4,181 and Bugcrowd's $5,000 Small unit are the lowest published figures. For a single small app, mid-market consultancies (not included in the 8-vendor matrix) can deliver OWASP-level testing at $5,000-$8,000. Below $3,000, you are buying automated scanning, not a manual pentest.

Neither publishes a price, so there is no public answer. Bishop Fox publishes three application pentest packages (Baseline, Standard, Advanced) as well as custom-scoped testing; NCC Group offers traditional engagements or Continuous Penetration Testing. For the same scope, get quotes from both, ask each for the team size and days, and use the competing offer to negotiate.

Both sell pentesting as PTaaS. Cobalt publishes more: its credit unit (8 hours), three tiers with start times and retest windows, and a $3,500 Autonomous Pentest price, though its credit tiers are quote-only. HackerOne publishes no price for H1 Pentest or H1 Agentic Pentest and scopes each engagement individually. If you want a number before a call, Cobalt gives you one product with a price; HackerOne gives you none.