There is no fixed rate in the US market. The total depends on the systems tested, attack surface, testing depth, provider expertise, reporting, and follow-up support. Public evidence is thin, too: no independent survey of human-led test prices exists, so the figures below are provider-published starting prices, not market averages.
This guide covers current price signals, pricing models, cost drivers, hidden costs, and a practical way to build a budget.
Key Takeaways
- US starting prices run about $5,000 for small external tests to $30,000 for broader small-org engagements.
- Web app, API, network, cloud, and red team tests price differently by skill and effort required.
- Scope, manual depth, compliance documentation, and retesting drive most quote differences.
- The cheapest quote often means narrow coverage, scanning only, or excluded deliverables.
- Budget for preparation, remediation, retesting, and future cadence, not just the provider fee.
How Much Does a Penetration Test Cost? (Pricing Overview)
A pen test is priced against a defined scope and set of deliverables. Providers need details about your environment before they can quote reliably.
Typical Cost Range
The figures below are named-provider estimates and starting prices. They are not guaranteed quotes, and they are not DeepSeas prices.
| Test type / scope | Published US starting price |
|---|---|
| Small external test | From $5,000 (Triaxiom) |
| External network | From $8,000 |
| API | From $9,500 |
| Web application | From $13,500 |
| Internal network / cloud (combined category) | From $13,500 |
| Broader small-organization engagement (external, internal, social engineering) | Up to $30,000 |
The $8,000 to $13,500 rows come from Raxis's price page. Raxis also describes US engagements as starting near $5,000 and reaching six figures for large scopes.
Mobile, standalone social engineering, and red team work usually need custom quotes. Raxis says red team engagements run 4 to 12 weeks depending on scope, so expect a much higher spend than a standard test.
What pushes a quote up or down:
- Number of live hosts, endpoints, subnets, or sites
- User roles and authenticated workflows
- Environments and third-party integrations
- Testing days and the share of manual analysis
Pricing Models
Each model fits a different situation:
- Fixed fee: Best for a well-defined scope. Risk: scope changes alter the price.
- Hourly or daily rate: Suits uncertain scope. Risk: costs float with actual effort.
- Per-asset: Sometimes used for large, repetitive environments. Providers more often cite host counts and endpoints as scope inputs than a fixed per-asset rate.
- Credits or retainers: Cobalt's credit packages equal eight hours per credit and combine human and AI delivery. Risk: you can buy too few or too many credits.
- Recurring or PTaaS: Pricing varies with scope, frequency, and manual versus automated work. It may cost more upfront but gives predictable spend for fast-changing applications and cloud environments.
Whatever the model, ask whether the price includes scoping, rules of engagement, manual testing, validation, executive and technical reports, a readout, remediation guidance, and at least one retest.
Key Factors That Affect the Cost of a Penetration Test
Price reflects the skilled work needed to find, validate, document, and prioritize exploitable weaknesses. More work, more cost.
Scope and Attack Surface
Applications, IP addresses, APIs, cloud accounts, network segments, user roles, environments, and integrations all add effort.
Compare two cases. A single web application with one environment and two user roles may take a week. A multi-environment enterprise assessment with several apps, cloud accounts, and internal segments can take many testers several weeks.
Complexity and Testing Depth
How much you tell the testers changes the work. OWASP defines three approaches:
- Black-box: No internal knowledge, so more time goes to reconnaissance
- Gray-box: Partial knowledge of the environment
- White-box: Full information such as source code, which goes deeper per hour
Scanning is not a pen test. OWASP warns that automated tools alone perform poorly against bespoke applications. Manual testing costs more, but it finds business logic flaws, authorization gaps, exploit chains, and privilege escalation paths that scanners miss.
Provider Expertise and Engagement Model
Senior testers, offensive specialization, and experience with your stack raise rates and improve results. Evaluate providers on:
- Relevant credentials such as OSCP, GPEN, or CREST
- Sample reports and references
- A documented testing methodology
- Liability insurance, as noted in CREST's US buyer guide
Compliance and Reporting Requirements
Frameworks shape scope, evidence, and report structure. Verify current requirements directly:
- PCI DSS v4.0.1: Internal and external tests at least every 12 months and after significant changes, by an organizationally independent tester, with fixes verified by retesting.
- HIPAA: The current Security Rule requires periodic evaluation and risk analysis. An annual pen test appears only in a 2024 proposed rule.
- SOC 2: Pen testing is an example of an evaluation, not a mandated cadence.
- FedRAMP: Testing by a 3PAO, repeated at least every 12 months.
A test for internal risk reduction can be lighter than one producing customer-facing or audit documentation.
Timing, Access, and Operational Constraints
These constraints add planning time and can raise cost:
- Urgent deadlines and after-hours testing
- Production restrictions and change freezes
- Onsite work
- Limited test accounts or restricted source code
A tightly controlled environment can cost more than a larger, open one.
Retesting, Remediation, and Scope Changes
Retesting terms vary. Raxis says retesting is included at no charge. BreachLock lists one retest in its standard package and two in extended. Before signing, confirm what follow-up is included, how long it stays available, and how newly discovered assets are priced.
Cost Breakdown of a Penetration Test
The provider's headline quote is one part of total cost. Review one-time, recurring, conditional, and internal costs separately.
Pre-engagement Scoping and Preparation
Usually one-time, with recurring planning for ongoing programs. Typical work includes:
- Asset inventories and network diagrams
- Objectives and rules of engagement
- Access provisioning and test accounts
- Legal approvals and scheduling
Testing Execution
One-time for a traditional assessment, recurring under continuous testing. Coverage typically includes:
- Reconnaissance and discovery
- Manual exploitation and validation
- Evidence collection
Ask which tools and which human activities are included.
Reporting and Debrief
Usually one-time per engagement. Expect:
- Executive summary and technical findings
- Proof-of-concept evidence
- Prioritized remediation and stated limitations
- Stakeholder readout
Ask whether compliance-specific documentation costs extra.
Remediation and Retesting
Conditional or periodic. Your engineers will spend time fixing findings, and retesting may be included, billed separately, or bought through a retainer. PCI SSC guidance says remediation should be retested, and long delays may require a new engagement because the environment has changed.
Fix times are long. Edgescan's 2025 report found averages of 54.8 to 74.3 days to remediate and validate high and critical findings, though that data is global and not specific to pen tests.
Ongoing Testing and Program Costs
Recurring. Annual point-in-time testing is the baseline. Release-driven, retainer, or PTaaS approaches fit systems that change often. Set cadence by rate of change, risk, compliance, and internal capacity.
A simple total-cost formula:
Total cost = provider fee + internal preparation + remediation + retesting + recurring testing and reporting
How to Evaluate Pen Test Pricing and Set the Right Budget
The right price buys appropriate coverage, credible findings, useful reporting, and a practical path to remediation. It is not necessarily the lowest quote.
Low-Cost vs High-Cost Pen Testing
A low quote often means narrow scope, limited testing time, automated scanning, basic reporting, or no retest. A higher one may add broader coverage, deeper manual analysis, senior testers, specialized environments, and stronger reporting.
Higher is not automatically better. Ask any provider to justify the price with scope, estimated effort, methodology, personnel, deliverables, and follow-up terms.
Estimating the Right Budget
- Define the business objective: compliance, customer demand, or risk reduction.
- Inventory assets: apps, APIs, networks, cloud accounts.
- Identify critical data and workflows: highest-value assets first.
- Select test types: match coverage to those assets.
- Confirm compliance deliverables: auditor and customer requirements.
- Set cadence: annual, per release, or continuous.
- Reserve funds: remediation labor and retesting.
Then request several statements of work and check that each uses the same scope, depth, assumptions, exclusions, report format, and retest policy before comparing totals.
Organizations that need a tailored scope for annual testing, regulated environments, or controlled attack simulations can talk with DeepSeas' offensive security team about a customized assessment.
DeepSeas covers network, cloud, web application, mobile, API, wireless, and physical testing, with manual testing for application logic flaws. Network and cloud engagements include free remediation retesting within six months.
What Most Buyers Miss About Pen Test Cost
Buyers focus on the provider fee and overlook:
- Internal coordination and test-account preparation
- Production safeguards
- Remediation labor and retesting
- Travel and expedited scheduling
- Scope changes
Also confirm you are buying a genuine penetration test, not a vulnerability scan with a new label. Ask for a sample report, methodology, tester qualifications, insurance details, and defined deliverables.
Conclusion
US pen test costs vary with test type, scope, complexity, methodology, provider expertise, compliance needs, and follow-up services. Public prices are starting points, so treat them as reference points, not a quote.
Seeing the full cost structure helps you avoid underbudgeting and compare quotes fairly. The best investment balances coverage, testing quality, reporting, and remediation support against long-term needs, not just the lowest quote.
Frequently Asked Questions
How much does a typical pen test cost?
It depends on test type, scope, complexity, methodology, and deliverables. Published US starting prices range from about $5,000 to $30,000 for small to mid-sized scopes; larger engagements cost more.
What does a pen test include?
Typically scoping, rules of engagement, reconnaissance, manual and automated testing, validation, reporting, and remediation guidance. Retesting may be included. Check the statement of work.
How often should a penetration test be done?
PCI DSS requires at least every 12 months and after significant changes. Otherwise, base cadence on release frequency, risk, prior findings, and infrastructure changes, and verify your framework's rules.
How much should a risk assessment cost?
A risk assessment estimates organizational risk from threats, vulnerabilities, and impact, while a pen test actively exploits weaknesses. Its cost depends on size, assets, frameworks, interviews, and deliverables.
Is pentesting being replaced by AI?
No. AI speeds discovery, validation, and prioritization. A 2025 Stanford study found an AI agent competitive on one network but with more false positives. Humans still handle authorization, business logic, and context.
Which certification is best for penetration testing?
None is universally best. Evaluate relevant technical credentials, hands-on experience, methodology, industry expertise, and sample reports against your objectives.
