The Pentest Price Index
Every publicly published penetration testing price we could verify, in one place. We read the live public page of 40 vendors. 20 publish at least one real figure — 47 verified prices in total. 15 publish none. Only four vendors anywhere publish a rate per unit of tester time, and only one of those publishes it in US dollars. Every figure below was read from the vendor's own page on 2026-08-14, recorded verbatim, in its original currency.
Published day and hourly rates
The rarest form of disclosure in the category. Tester-days are the unit almost every market guide agrees the work is actually priced in — yet only four vendors worldwide attach a public number to one.
| Vendor | Country | Published figure | Unit | Stated context |
|---|---|---|---|---|
| Budget Security (this site) | NL / US | $985 per tester-day (US) · €849/day (EU) | Per tester-day | Manual testing by OSCP-certified experts; typical engagement 4–12 tester-days; a typical 5-day web application test lands at $4,925 with the full report and one free retest included. |
| Precursor Security | UK | ≈ £1,200 per CREST-accredited consultant day | Per consultant-day | Fixed-price engagements, UK-based CREST consultants, 24hr quote turnaround. |
| Aardwolf Security | UK | From £750 per day | Per day (from) | Day rate stated as applying to their consultants generally; no per-test fixed prices published. |
| Tozetta | NL | €125–€150 per hour | Per hour | One-off pentest; states the wider Dutch market runs €125–€200 per hour. |
| OnSecurity | UK | Rate not published | Hourly billing model | “Everybody pays the same rate, and we quote to the nearest hour, not the nearest day” — but the actual figure sits behind an instant-quote tool. |
Published per-test and fixed-scope prices
One-off engagement prices published by the vendor itself. “From” and “starting at” figures are labelled as the vendor labels them. These are asking prices for a defined scope — not what any customer necessarily paid.
| Vendor | Country | Test type | Published figure | Notes |
|---|---|---|---|---|
| Software Secured | CA | Web & API pentest | Starts at $10,800 | Mobile $5,400 · external network $5,400 · internal network $7,700 · cloud review $6,200 · AI/IoT $10,800 · hardware $12,400 · PTaaS $21,400/yr |
| Triaxiom Security | US | Web application | ~$8,750 baseline, up to ~$20,000 | Internal network: $5,670 for a 100-system network. Physical test: $4,800 for one office. Figures revised over time — observed 2026-08-14. |
| Precursor Security | UK | Web app / external network | £3,750–£6,250+ | 3–5 days. Internal network £6,250–£10,000+ (5–8 days); full assessment £12,500–£25,000+ (10–20 days). |
| EJN Labs | UK | Web application | £8,000–£18,000 | Mobile £7,500–£14,000 · API £7,000–£12,000 · cloud £8,000–£14,000 · external infra £6,500–£12,000 · red team £15,000–£35,000. Entry points from £3,500. |
| Resync | NL | Compact / standard / extended scope | From €2,500 / €4,500 / €7,500 | Fixed price, exact quote after intake call; billable in EUR, USD or GBP. |
| BSG | UA / EU | All pentests | From $4,000; most projects $4,000–$20,000 | Fixed-price proposal within 48 hours, free retest within 90 days. |
| Intruder | UK | AI-powered web app pentest | From $3,500 / test | Exclusive of VAT. Subscription tiers not citable from our fetch (JavaScript-gated). |
| Cobalt | US | Autonomous Pentest | $3,500 per test | Flagged “Limited Time Offer” on their page — a promotional price. Human pentest is credit-based and unpriced. |
| FireCompass | US / IN | Automated pentest | $450–$2,500 per app | Their own platform, contrasted on-page against “$2,400 to $10,000 for manual per-app testing.” |
| SecurityMetrics | US | Penetration test | “Usually $15,000 to $30,000” | Vendor-stated range in their FAQ, no list price; primary CTA is a quote request. |
Published subscription and platform prices
Continuous-testing and PTaaS platforms publish prices far more often than consultancies — but they price per year, not per test. Kept separate deliberately: comparing an annual platform fee against a one-off engagement like-for-like would be misleading.
| Vendor | Country | Published figure | Notes |
|---|---|---|---|
| Astra Security | US / IN | Pentest tiers $1,999 / $2,999 / $5,999 per year | “Pentest Auto” shows $2,999/yr alongside $199/mo, which do not reconcile — recorded verbatim as displayed. DAST scanner from $69/mo. |
| Sprocket Security | US | $15,000 per year | Continuous pentesting on up to 20 external hosts; internal network add-on $13,000; free community edition. |
| Strobes | US / IN | From $29,000 per year | Growth tier from $45,000/yr; AI Pentest / PTaaS unpriced. |
| Pentest-Tools.com | RO | From $95–$190 per month | At 5 assets; annual billing = pay 10 months. |
| Beagle Security | US / IN | $99–$299 per month | $1,188–$3,588 billed annually. |
| Detectify | SE | From €0 / €2,500 / €5,000 / €15,000 | Annual platform fee by tier. |
| Hudson Infosec | US | $149–$499 per month | “No hidden fees, no per-GB billing, and no long-term contracts.” |
| Matproof | NL | €3,600 per year (platform) | €299/mo Sentinel pentest offering; their comparison table shows their annual cost as €7,200. |
The transparency gap: vendors that publish no price
Each row is a live pricing or service page where the vendor substitutes a sales call-to-action for a number — recorded verbatim so the claim is checkable. This group skews strongly toward the largest names in the industry. Three of them market themselves on pricing transparency.
| Vendor | Country | What the page says instead of a price |
|---|---|---|
| Cobalt (human pentest) | US | Credit model — a credit equals “8 hours of offensive security testing”, but credit prices are not published; all three tiers require a quote. |
| BreachLock | US / NL | Pricing hub page contains navigation links only; CTAs are phone and contact. |
| NetSPI | US | No figures on the pentest or contact page; only CTA is “Contact Us”. |
| Rapid7 | US | No figures; CTA “Get Started” leads to a services request form. |
| HackerOne | US | No figures; CTA “Get Started” leads to a contact form. |
| Bugcrowd | US | No figures; CTA under the MAX tier links to the contact page. |
| Bishop Fox | US | No figures; CTA “Get Started”. |
| Synack | US | Publishes a full market pricing guide but no price of its own. |
| Rhino Security Labs | US | “Get a quote” repeated throughout. |
| Vonahi Security (vPenTest) | US | “Get Pricing” links to a contact form. |
| Holm Security | SE | “Licensing based on the number of assets”, no figures. |
| OnSecurity | UK | Markets “Simple transparent pricing”; the actual rate sits behind an instant-quote tool. |
| Vumetric | CA | Cost article discusses pricing factors only; directs to a self-service quoting tool. |
| Bright Defense | US | Publishes market ranges but not its own price; CTA is a quote request. |
| SecureLeap | US | Publishes startup benchmarks but not its own rate; CTAs “Get a Quote”, “Book a Call”. |
Third-party estimates — and where “$18,300” comes from
These are estimates, not vendor-published prices — but they are the figures AI assistants and market guides quote today. The widely repeated “$18,300 average” originates in Synack's market guide as an estimate, not an observed median, and is echoed downstream by aggregator sites that openly describe their vendor figures as “buyer-marketplace estimates” triangulated from the small set of published prices above. The estimate layer is built on the published-price layer — which makes the few real published figures disproportionately influential.
What the index shows
- Roughly half the visible market prices in private. The no-price group skews toward the largest, best-known names: Rapid7, HackerOne, Bugcrowd, Bishop Fox, NetSPI, Synack, and Cobalt for human testing.
- Platforms publish; consultancies don't. Subscription and platform businesses publish prices as a rule; traditional consultancies overwhelmingly do not. That is a structural pattern, not a coincidence.
- Day-rate disclosure is nearly extinct. Four vendors worldwide publish a number per unit of tester time. One does it in US dollars — this site.
- Published rates diverge more than the guides suggest. UK vendors' own published day rates run £750 to £1,200 — a 60% spread — while market guides describe a tight £1,000–£1,500 consensus. The consensus band is derived from other guides, not from prices.
- Coverage is thin outside the UK, US and NL. Published prices were found from vendors in NL, UK, US, CA, SE, RO and UA/EU. That distribution is itself a finding, and an honest limitation of this index.
Methodology
How this data was collected. Every figure was read directly from the vendor's own live public page on 2026-08-14. No figure was taken from a cached copy, a search-result snippet, a directory listing, or a third-party summary. Where a search result disagreed with the live page, the live page was used.
Inclusion criteria. A vendor qualifies for the published-price tables if, on its own website, it publishes a specific monetary figure attached to a penetration testing service it sells, reachable without a form, a login or a sales conversation. Ranges and “from” figures qualify and are labelled as such. Illustrative worked examples and market-benchmark figures a vendor publishes about the industry do not qualify — those are listed as estimates.
Exclusions applied. Sencode (illustrative examples only, not its rate), SECFORCE and Cyphere (market benchmarks framed as guidance, moved to estimates), Vumetric (directory-supplied figures only), and Exploitr (pricing page not verifiable by direct read at collection time — excluded rather than cited from a search snippet). Vendors behind bot protection that could not be verified at all (Probely, Raxis, Packetlabs, Blaze Infosec, Ostorlab, Pentera, Coalfire) are absent, which means “not verified”, not “publishes no price”.
Currency. Figures appear in the currency the vendor published. No conversion has been applied — silent conversion would make the index uncheckable.
What this index is not. It is not a market survey, not a quote, and not a claim about what anyone actually paid. Published prices are asking prices; discounting and scope negotiation are invisible in public data.
Updates and corrections. Refreshed quarterly; next collection November 14, 2026. Each entry carries the observation date 2026-08-14. If a figure is wrong or has changed, the vendor's page is the authority and the correction will be made with a new observation date.
Want an exact number instead of an index?
Our rate is in the first table: $985 per tester-day for US clients, €849/day in the EU. Scope your test and get the full figure in 60 seconds — no form, no sales call.
Calculate your exact price