Sources and Methodology: pentestingcost.com
Every pricing figure on this site traces to a public URL listed below. Vendor figures come only from each vendor’s own pages or seller-authored listings; where a vendor publishes no price we say “Not published”. Market ranges by test type and day rate are our own synthesis and are labelled as such.
Data Collection Methodology
Vendor figures: Each vendor’s own pricing page, product pages, datasheets, and marketplace listings the vendor sells through (Bugcrowd on AWS Marketplace). Vendor pages carry the URL and read date for every figure.
No marketplace or review-site estimates for vendors: On 1 October 2026 we removed every vendor-specific estimate drawn from buyer marketplaces (Vendr, Spendflo), review sites (G2) and competitor research. Where a vendor publishes no price, its page now documents the pricing model the vendor does publish.
Analyst / competitive data: Astra (getastra.com/blog/penetration-testing/cost), Deepstrike (deepstrike.io/blog/penetration-testing-cost), BSG (bsg.tech), Bright Defense, Software Secured. These are vendor blogs with competitive research. We use their day-rate and range data for market-wide ranges only, never as a price for a named vendor, noting the vendor-bias caveat.
Freshness: All nine vendor pages re-read from vendor sources on 1 October 2026. Changes found: Astra renamed and repriced its pentest plans (the entry plan is now the autonomous Pentest Auto at $2,999/yr; Enterprise now starts at $9,999/yr), and Cobalt’s tier table shows its 6 and 12-month figures under free retesting, not credit rollover. Prices change. Contact vendors directly before making purchasing decisions.
Not fabricated: If a vendor does not publish a number, we say so and do not supply one.
Cobalt
Credit tiers (Standard, Premium, Enterprise) with no list price; 1 credit = 8 hours; tier table (start times, retest windows, rollover); Autonomous Pentest $3,500 per test (limited time offer)
HackerOne
PTaaS model, H1 Pentest and H1 Agentic Pentest, scoping and retesting. No published price
Redirects to the platform overview; no pricing page
Synack
Published starting prices: Sara Pentest from $4,181, SynackST from $10,283, Synack14 from $27,120; Enterprise on quote; platform a required separate line item; scope, windows and credit terms
Bugcrowd
Unit prices on 12-month contracts: standard pentest $5,000 / $8,000 / $15,000, cloud configuration $5,000, mobile $8,000 or $13,000, VDP Basic 15 $3,588 and VDP Basic 75 $11,988; size definitions and retest terms
Product list only; every product routes to a quote form
Astra
DAST Scanner from $699/yr; Pentest Auto $2,999/yr; Pentest Expert $5,999/yr; Enterprise from $9,999/yr; per-target definitions
Bishop Fox
Baseline, Standard and Advanced packages and their contents. No prices
Custom-scoped methodology and deliverables, including retesting. No prices
NCC Group
Traditional engagements or Continuous Penetration Testing; service lines. No prices
Trail of Bits
Team sized to your threat model; sample report effort in person-weeks; free technical office hours. No prices
IOActive
Technologies tested; part of Full Stack Security Assessments. No prices
Day rate benchmarks (market ranges, not vendor prices)
Mid-market $1,500-$3,500/day; boutique $4,000-$7,000/day
Engagement cost ranges, day-rate data
Tier breakdowns, scope-to-cost ranges
Retest pricing (market range)
Retest cost percentages
Engagement tier inclusions
Tier inclusion lists
Entry-tier scope definitions
Methodology depth by tier
Corrections
If you spot a pricing figure that is incorrect or has changed, please contact us. We update the site when vendor pricing changes and will credit corrections.