Sources and Methodology — pentestingcost.com
Every pricing figure on this site traces to a public URL listed below. “Contact sales” is stated honestly when no public source exists. Numbers marked as estimates are triangulated from multiple sources and clearly labelled.
Data Collection Methodology
Primary sources: Vendor pricing pages, vendor documentation, vendor-published blog posts with pricing information.
Marketplace data: Vendr (vendr.com) and Spendflo (spendflo.com) publish buyer-side pricing benchmarks for SaaS tools including security vendors, drawn from their negotiated-deal data. We treat these as estimates: they are not list prices published by the vendors, and we label them as such throughout the site.
Review platform data: G2 (g2.com) verified customer reviews that include pricing disclosure. G2 tags these as verified.
Analyst / competitive data: Astra (getastra.com/blog/penetration-testing/cost), Deepstrike (deepstrike.io/blog/penetration-testing-cost), BSG (bsg.tech), Bright Defense, Software Secured — these are vendor blogs with competitive research. We use their day-rate and range data, noting the vendor-bias caveat.
Freshness: Vendor pricing models re-verified live June 2026 (Cobalt and HackerOne pricing pages confirmed contact-sales with no published list prices). Prices change. Contact vendors directly for current pricing before making purchasing decisions.
Not fabricated: If a number is not publicly available and cannot be triangulated from multiple sources, we say “contact sales” and do not invent a figure.
Cobalt
Tier structure (Standard/Premium/Enterprise) and credit model (1 credit = 8 hrs); no list prices published, all contact-sales
Estimated annual contract values $15k-$50k, credit pack data
Customer-reported pricing estimates
HackerOne
Product structure only; no published prices (routes to contact sales)
Estimated annual programme pricing $15k-$50k
Enterprise ACV data
Day rate benchmarks (all traditional vendors)
Mid-market $1,500-$3,500/day; boutique $4,000-$7,000/day
Engagement cost ranges, day-rate data
Tier breakdowns, scope-to-cost ranges
PTaaS credit model
1 credit = 8 hours of tester time
Blended hourly equivalent ~$225/hr
Retest pricing
15-30% retest add-on as standard negotiation outcome
Retest cost percentages
Engagement tier inclusions
Tier inclusion lists
Entry-tier scope definitions
Methodology depth by tier
Corrections
If you spot a pricing figure that is incorrect or has changed, please contact us. We update the site when vendor pricing changes and will credit corrections.