Bugcrowd Pentest Pricing in 2026
Bugcrowd’s website is quote-only, but its own AWS Marketplace listing is not. There, Standard Pen Tests sell at fixed 12-month prices from $5,000 (Small) to $15,000 (Large), with cloud and mobile units and two vulnerability disclosure plans alongside. Bug bounty and the customised Plus Pen Test are still quoted.
Bugcrowd’s published unit prices
| Unit | Price (12 months) | Scope |
|---|---|---|
| Standard Pen Test, Small | $5,000 | 1 low-complexity web app, 50 active IPs, or 45 API endpoints |
| Standard Pen Test, Medium | $8,000 | 1 medium-complexity web app, 100 IPs, or 75 endpoints |
| Standard Pen Test, Large | $15,000 | 1 high-complexity web app, 256 IPs, or 150 endpoints |
| Standard Pen Test, Cloud Configuration | $5,000 | One cloud project |
| Standard Pen Test, Mobile App (1 platform) | $8,000 | Mobile app on one platform |
| Standard Pen Test, Mobile App (2 platforms) | $13,000 | Mobile app on two platforms |
| VDP Basic 15 | $3,588 | Vulnerability disclosure, first 15 submissions |
| VDP Basic 75 | $11,988 | Vulnerability disclosure, first 75 submissions |
Source: AWS Marketplace listing, “Sold by: Bugcrowd”, pricing information and product Q&A, read 1 October 2026. Each unit is bought as a separate contract dimension, not as an escalating subscription.
What a standard unit includes
- Launch: within three business days.
- Reporting: a platform-generated report and the PTaaS dashboard for real-time findings.
- Retesting: web app, network and API tests include 12 months of retesting with one report update.
- Customisation: not in the standard units. Bugcrowd says to contact it about a Plus Pen Test for customised testing.
Source: Bugcrowd AWS Marketplace listing, read 1 October 2026.
What stays quote-only
The listing marks Managed Bug Bounty “Contact us for pricing” and sends customised testing to a Plus Pen Test quote. On bugcrowd.com/bugcrowd-pricing, every product, from Pen Test as a Service and Red Team as a Service to Attack Surface Management and the Savant products, goes through a quote form, with Bugcrowd promising “a cost outline tailored to your unique requirements”.
Where Bugcrowd sits: PTaaS with fixed units
Bugcrowd calls its pentest offer Pen Testing as a Service, which puts it on the PTaaS side of our PTaaS vs traditional consulting split, but its standard units behave like fixed-price packages: a set scope for a set price.
For comparison, Synack lists package starting prices of $4,181, $10,283 and $27,120, while HackerOne publishes no price for its pentests.
Questions buyers ask
How much does a Bugcrowd pentest cost?
Bugcrowd's AWS Marketplace listing, sold by Bugcrowd, prices Standard Pen Tests on a 12-month contract at $5,000 (Small), $8,000 (Medium) and $15,000 (Large), $5,000 for a cloud configuration test, and $8,000 or $13,000 for a mobile app on one or two platforms. Bugcrowd's own website shows no prices and routes to a quote form.
What size is a Small, Medium or Large Bugcrowd pentest?
The listing defines Small as one low-complexity web app, 50 active IPs, or 45 API endpoints; Medium as one medium-complexity web app, 100 IPs, or 75 endpoints; and Large as one high-complexity web app, 256 IPs, or 150 endpoints.
What is included in a Bugcrowd standard pentest unit?
According to the listing, each standard pen test launches within three business days and comes with a platform-generated report and the PTaaS dashboard for real-time findings. Web app, network and API tests include 12 months of retesting with one report update.
Which Bugcrowd products have no published price?
Managed Bug Bounty ('Contact us for pricing') and the Plus Pen Test for customised testing are quote-only on the listing. On bugcrowd.com, every product, including Red Team as a Service, Attack Surface Management and the Savant products, routes to a quote form.
Sources
- AWS Marketplace: Bugcrowd Crowdsourced Security Platform (sold by Bugcrowd)read 1 October 2026
Unit prices on 12-month contracts, unit size definitions, launch time, retesting, Plus Pen Test and Managed Bug Bounty quote-only.
- Bugcrowd pricing pageread 1 October 2026
Product list; every product routes to a quote form. No prices shown.
Only the vendor’s own pages and listings are used here. This page carries no estimates from buyer marketplaces, review sites or competitor blogs. See the site-wide sources and methodology.