Pentest Timeline, Time-to-Quote, and Retest Pricing in 2026
Buyers need to know: if I sign today, when does testing start, and what happens when I fix the findings? A few vendors publish this. This page shows exactly what each one says, read from its own pages on 1 October 2026, and marks the rest as not published.
What Vendors Publish About Timing
| Vendor | Published start time | Published test window | Other published timing | Source |
|---|---|---|---|---|
| Cobalt | 3 / 2 / 1 business days (Standard / Premium / Enterprise) | Not published | Autonomous Pentest: findings in 24 hours | cobalt.io/platform/pricing |
| HackerOne | Not published | Not published | Enquiries: typically answered within 1 business day | hackerone.com/product/pentest |
| Synack | Not published | 4-5 days (Sara), 5 days (SynackST), 14 or 365 days (Synack14/365) | None | synack.com/pricing |
| Bugcrowd | Within 3 business days (standard units) | Not published | None | Bugcrowd AWS Marketplace listing |
| Bishop Fox | Not published | Packages are time-limited; length not published | None | bishopfox.com |
| NCC Group | Not published | Not published | None | nccgroup.com |
| Trail of Bits | Not published | Effort stated in person-weeks per review | None | trailofbits.com/services |
| IOActive | Not published | Not published | None | ioactive.com |
Read from each vendor’s own pages on 1 October 2026; full sources on each vendor page. Cobalt footnotes that start times may vary depending on the type of testing engagement. No vendor here publishes a quote turnaround time.
Retest Pricing Structure
Across the market, a separately priced retest typically runs 15-30% of the original engagement fee within a 30-90 day window; that range is our market synthesis, not a vendor's published price. Some vendors publish their own retest terms, shown below.
| Vendor | Published retest terms | Published retest price | Published window |
|---|---|---|---|
| Cobalt | Unlimited on-demand retesting through the contract term (FAQ); free retesting row in tier table | Included in credit package | 6 months (Standard), 12 months (Premium, Enterprise) |
| HackerOne | Retesting provided after remediation | Not published | Not published |
| Synack | Patch verification listed in every package | Included in package | Not published |
| Bugcrowd | Web app, network and API standard units include retesting with one report update | Included in unit | 12 months |
| Bishop Fox | Retesting listed as a deliverable; remediation testing started from the portal | Not published | Not published |
| NCC Group | Not published | Not published | Not published |
| Trail of Bits | Not published | Not published | Not published |
| IOActive | Not published | Not published | Not published |
Worked Example: Retest Cost on a $20k Engagement
The 15-30% range is our market synthesis; the included-retest row reflects terms Cobalt and Bugcrowd publish. Agree retest scope in your initial order: it is easier to include it upfront than to add it later.