Pentest Timeline, Time-to-Quote, and Retest Pricing in 2026
Procurement timing is the most consistent gap in page-one content. Buyers need to know: if I email Cobalt today, when do I get a report? Nobody publishes this clearly. Here it is.
Time-to-Quote by Vendor
| Vendor | Quote turnaround | Time-to-test | Test duration (typical) | Report turnaround |
|---|---|---|---|---|
| Cobalt | 1-2 days | Within 1 week | 1-2 weeks | 1 week after test |
| HackerOne | 2-4 days | 1-2 weeks | 1-3 weeks | 1-2 weeks after test |
| Synack | 3-5 days | 1-2 weeks | 2-3 weeks | 1-2 weeks after test |
| Bugcrowd | 3-5 days | 1-2 weeks | 2-3 weeks | Ongoing (bounty model) |
| Bishop Fox | 5-10 days | 2-4 weeks | 2-5 weeks | 2-3 weeks after test |
| NCC Group | 5-8 days | 2-4 weeks | 2-4 weeks | 1-2 weeks after test |
| Trail of Bits | 7-14 days | 3-6 weeks | 3-6 weeks | 2-4 weeks after test |
| IOActive | 5-10 days | 2-5 weeks | 2-5 weeks | 2-4 weeks after test |
Based on vendor documentation and G2/Vendr buyer reports. Actual timelines vary by availability and scope complexity. Last verified April 2026.
Retest Pricing Structure
Retest pricing is typically 15-30% of the original engagement fee, bounded by a 30-90 day window. Some vendors include retest; others charge separately.
| Vendor | Retest policy | Cost structure | Time window |
|---|---|---|---|
| Cobalt | Charged per credit | ~$1,800/credit (8 hrs, est.) | No fixed window |
| HackerOne | Varies by product | Included in some products | Product-dependent |
| Synack | Continuous (rolling) | Covered by programme fee | Always-on |
| Bugcrowd | Continuous (bounty) | Bounty per valid finding | Always-on |
| Bishop Fox | 15-30% of engagement | $3k-$30k typical | 90 days |
| NCC Group | 15-25% of engagement | $2k-$20k typical | 90 days |
| Trail of Bits | Quoted separately | Day-rate basis | No standard window |
| IOActive | Quoted per engagement | Day-rate basis | Negotiated |
Worked Example: $20k Pentest + Retest
Bishop Fox ($20k SOW)
$3,000-$6,000
Within 90 days of report
All severity levels
Cobalt ($20k spend)
~$1,800/credit (est.)
No window restriction
Pay-as-you-retest
NCC Group ($20k SOW)
$3,000-$5,000
Within 90 days
Critical/high findings standard
Vendr buyer guides confirm 15-30% retest add-on as standard. Always negotiate retest scope in your initial SOW — it’s easier to include it upfront than add it later.