What’s Actually Included in a Pentest in 2026 (And What’s Not)
A professional pentest is not a vulnerability scan with a PDF wrapper. Here’s exactly what you should expect from a real engagement at each tier, and what you are explicitly not getting.
Standard Inclusions
Pre-engagement call to confirm targets, test windows, communication channels, and emergency contacts. Typically 30-60 minutes.
Passive and active information gathering: DNS enumeration, technology fingerprinting, open-source intelligence on the target application.
Automated scanning supplemented with manual verification. All automated findings are manually validated before inclusion in the report.
Tester attempts to exploit identified vulnerabilities to confirm exploitability and assess impact. Safe-mode exploitation to avoid data loss or downtime.
Following a successful exploit, testers assess what an attacker could access from the compromised position. Often requires explicit scope agreement.
Technical report with detailed findings, CVSS scores, reproduction steps, and remediation guidance. Plus executive summary for non-technical stakeholders.
Common Exclusions (Often Separate Engagements)
Phishing, vishing, pretexting. Usually a separate engagement or red team add-on.
Badge cloning, tailgating, physical access. Separate engagement type.
Availability testing usually excluded by default due to downtime risk.
White-box code review is a separate service. Pentest is typically black/grey box.
Full adversary simulation with persistence, lateral movement, exfiltration. Separate service at $50k+.
Payment gateways, third-party SaaS you don't control. Requires explicit scope addition and third-party authorization.
Deliverables Checklist
A professional pentest should deliver all of the following. If any are missing, ask before signing the SOW.
Pentest vs Vulnerability Scan vs Bug Bounty vs Red Team
| Type | Manual work | Exploitability confirmed | Cost range | Compliance value |
|---|---|---|---|---|
| Vulnerability scan | No | No | $500-$3,000 | Low |
| Pentest | Yes | Yes | $5,000-$200,000 | High (PCI, SOC 2, ISO) |
| Bug bounty | Crowd-sourced | Yes (per finding) | $10,000-$500,000+/yr | Supplementary |
| Red team | Yes, full adversary | Yes + persistence | $50,000-$300,000+ | High (mature programs) |
For compliance-driven inclusions (PCI 11.3 pentest scope requirements, SOC 2 pen test section, ISO 27001 Annex A.12.6), see penetrationtestingcost.com.