How much does a pentest cost? $4,000 to $50,000 depending on scope. (September 2026)
Buyer-side vendor pricing intelligence, fixed-price package guidance, and a scope estimator that maps your application to a realistic band before the sales call.
Credit tiers and boutique SOWs are contact-sales • Published anchors: Astra $2,999-$5,999/yr pentest plans, Cobalt Autonomous $3,500/test, Synack from $4,181/test, Bugcrowd from $5,000/unit • Category bands are our own market estimates • Updated September 2026
8-Vendor Pricing Matrix (October 2026)
Vendor pages read 1 October 2026Cobalt, HackerOne, Synack, Bugcrowd, Bishop Fox, NCC Group, Trail of Bits and IOActive in one place, each read from the vendor’s own pages. “Contact sales” stated honestly when no public pricing exists.
Astra is the rare vendor that lists prices publicly: automated scanning from $699/yr, an autonomous pentest at $2,999/yr and a manual pentest by certified experts at $5,999/yr per target. Cheapest entry point for SMB and startup buyers.
Astra pentest pricing breakdown →What you actually get at $5k, $10k, $20k, and $50k
Buyers ask this exact question and get scattered answers across vendor blogs. One page, four columns.
- Scope: 1 small web app, ~10 endpoints
- Method: OWASP Top 10, light manual
- Report: Summary report
- Retest: Basic, 30-day window
- Vendors: Published entry units (Bugcrowd, Synack, Astra)
- Scope: 1 mid-size app or API set, ~30 endpoints
- Method: Full OWASP + auth bypass
- Report: Technical + exec report
- Retest: Included, 60-day window
- Vendors: Mid-market consultancy
- Scope: Web + API + light cloud, 50-100 endpoints
- Method: Business-logic depth, attack chains
- Report: Full report + walkthrough
- Retest: Included, 90-day window
- Vendors: Mid-market consultancy or PTaaS programme
- Scope: Multi-app / cloud / mobile, 100+ endpoints
- Method: Chained exploits, custom methodology
- Report: Executive brief + full technical + walkthrough
- Retest: Multiple retests, extended window
- Vendors: Specialist consultancy (quote only)
Day-Rate Reference (2026)
Day-rate ranges are our market synthesis from published vendor rate guidance (Astra, Software Secured) and category norms. Cobalt’s credit dollar price is quote-only; its one published figure is the Autonomous Pentest at $3,500/test.
| Category | Hourly rate | Day rate | Source |
|---|---|---|---|
| Independent contractor | $150-$250 | $1,200-$2,000 | Astra, Software Secured |
| Mid-market consultancy | $200-$350 | $1,500-$3,500 | BSG, Deepstrike |
| Senior boutique / Big-4 | $350-$500 | $4,000-$7,000 | BSG, Bright Defense |
| PTaaS (Cobalt credits) | Quote-only | 1 credit = 8 hrs (quote) | cobalt.io/pricing |
PTaaS vs Traditional: 4-Question Filter
Answer the first question that matches your situation.
Traditional SOW. One engagement, retest included, sign off.
PTaaS. Credits consumed as you ship, always current coverage.
Traditional with retest. Need a clean report with methodology attestation.
PTaaS hybrid. Cobalt, Synack, or Bugcrowd extends your existing program.
6 Cost Drivers That Move the Quote
Know these before you talk to a vendor. Each one maps to a multiplier in the scope estimator.
Network pentest takes 2x longer than a web app of similar size. Mobile adds platform complexity.
Sub-linear scaling: 100 endpoints takes ~2.5x the time of 10, not 10x.
Multi-tenant RBAC and SSO flows require separate test accounts and elevated privileges.
Each third-party integration is additional attack surface that needs manual review.
PCI/HIPAA data requires compliance attestation rigor, adding methodology time.
Sub-2-week start requires scheduling premium. Most vendors are 2-4 weeks out.
Why are you getting a pentest?
The answer determines which site helps you most and which vendor profile fits.
You need a pentest report to send to a customer or enterprise prospect. Start with the engagement tiers page to match your budget to what they'll accept.
See engagement tiers→You need a pentest that satisfies a compliance framework. What each framework expects in scope and deliverables is on the what's-included page, so you can confirm a quote will actually pass audit.
What's included→You're shipping continuously and want ongoing coverage. PTaaS is almost certainly the right model over traditional SOW engagements.
PTaaS vs traditional→Common Questions
How much does a pentest cost in 2026?
A pentest costs between $4,000 and $50,000 for most web application and API engagements; those bands are our market synthesis, not vendor list prices. The figures vendors actually publish are Astra's tiers (automated scanning from $699/yr, autonomous pentest $2,999/yr, manual pentest $5,999/yr per target), Cobalt's Autonomous Pentest at $3,500 per test (promo through 31 December 2026), Synack's package starting prices from $4,181 per test, and Bugcrowd's standard pentest units from $5,000 on AWS Marketplace. Cobalt's credit tiers, HackerOne's pentests and the consultancies (Bishop Fox, NCC Group, Trail of Bits, IOActive) do not publish list prices; every engagement routes to a scoped quote. Enterprise red-team engagements can reach $200,000 or more in our market synthesis.
Can I negotiate pentest pricing?
Yes, for anything quoted. The usual levers are contract length, volume and a competing quote for the same scope. None of the vendors we track publishes its discount terms, so we do not quote discount percentages.
What is the difference between a pentest and a vulnerability scan?
A scan is automated and finds known CVEs. A pentest is manual and finds business-logic flaws, authentication bypasses, and chained exploits. Anything labelled 'pentest' under $3,000 is almost certainly the former. Real pentests involve human testers who reason about your specific architecture.
How often should you do a pentest?
Annually at minimum for compliance (PCI DSS 11.4, SOC 2, ISO 27001). After major releases or significant infrastructure changes. Continuously if you're a high-threat-profile company (fintech, healthtech, defence).