Penetration testing cost: published prices from 14 providers

Penetration testing cost depends first on what the provider sells: a test, a number of assets, prepaid credits, hours or a subscription. As of 9 November 2026, 7 of the 15 providers in the PentestCompare dataset publish at least one price. The other 8 quote after scoping. Published prices are starting prices or list prices. They are not the total you will pay.

We copied every price below from the provider's own page. We did not average, convert or estimate anything.

What pricing models do pentest providers use?#

Providers use five models, and some use several at once.

Providers that publish no price are BreachLock, Escape, HackerOne, Pen Test Partners, Parameter, Terra Security, XBOW and Excession Labs.

Which prices do providers publish?#

The table lists every published price in the dataset. "Starting" means the provider calls it a starting price or the smallest scope.

Cobalt's human-led tiers (Standard, Premium, Enterprise) are annual credit packages without a published price. One Cobalt credit equals 8 hours of testing. Synack requires a platform subscription that it bills separately and does not price. Horizon3.ai sells support tiers at extra cost (Enhanced is 10% of the subscription, minimum $7,500 a year; Premier is 20%, minimum $25,000 a year).

Why can't you compare these prices directly?#

The units differ, so the amounts do not line up. A TurboPentest credit is one automated pentest of one to eight targets. A Secure Ideas credit is up to a day of expert work. A Cobalt credit is 8 hours. A Horizon3.ai price is per discovered asset, such as a server, device or cloud resource, not per test.

Some arithmetic shows the gap. Under Horizon3.ai Flex, a hypothetical 100 assets would cost $1,500 for one test ($15 x 100). A hypothetical 5 assets would cost $75. The same $15 buys no fixed amount of testing. Secure Ideas shows the other extreme: 25 credits at $2,520 is $63,000, and that is its minimum for the credit plan.

Scope definitions also differ. Synack counts web apps and host IPs. Aikido counts an application plus its primary APIs. Hadrian and Horizon3.ai WebApp do not define one test. Depth differs too: Synack's cheapest item covers external web or hosts only, while its top item is a 14-day team test.

Only compare two prices after you check that scope, depth, who tests, retest terms and the report match.

What drives the price of a pentest?#

Scope drives price more than any other factor. The dataset shows these drivers on provider pages:

• Number of applications, targets or assets (Synack, TurboPentest, Horizon3.ai).
• Test type and size tier (Secure Ideas has four scope tiers per test type).
• Depth and test window, such as the length of the test or the number of agent-hours (Synack, TurboPentest).
• Box type. Aikido's $4,000 price is for whitebox; black-box and grey-box cost extra.
• Authenticated roles and API size. Synack distinguishes unauthenticated apps from authenticated ones.
• Attestation letters and retesting. Secure Ideas lists both as factors that can change the quote.
• Platform fees, such as Synack's required platform subscription.
• Contract term. Cobalt's tiers are annual, and Horizon3.ai prices run on 12-month terms.

Providers also state their own ranges. Secure Ideas says on its homepage that most of its tests cost $10K to $45K. That is the vendor's statement about its own work, not a market figure.

Is there a market average for pentest cost?#

We found no neutral market average, and we do not publish one. The closest figure is a survey average of annual spend, not the price of a test. Pentera surveyed 500 CISOs and senior security executives at organizations with 3,000 or more employees (200 in the United States) in January 2025. The report says US enterprises spend an average of $187,000 a year on pentesting. Pentera sells automated pentesting software, and the sample is large enterprises. Do not use it to estimate the cost of one test for a startup.

What should a pentest quote include?#

A quote is comparable only when it states what it covers. Ask every provider to put these items in writing:

1. The unit and the total, in one currency, with taxes stated (Hadrian lists prices excluding VAT).
2. Scope: named hosts, apps, APIs, environments and the roles tested.
3. Test type: black box, grey box or white box.
4. Who tests, and whether humans review every finding.
5. The test window and the start date, and whether the turnaround is time to start, to first findings or to final report.
6. The report: whether a sample report exists, which formats you get, and whether an attestation letter is included.
7. Retesting: how many, for how long, and the price after the window.
8. Extra costs: platform subscription, support tier, extra targets or credits that expire (Synack credits expire one year after purchase).
9. What happens if the scope grows during the test.

The scoping checklist collects the scope answers, and the questions guide lists what to ask about the team and the report.

Where do the published prices sit?#

Published per-test starting prices in this dataset run from $99 (a TurboPentest credit) to $27,120 (Synack14). Aikido's Rightsized range starts lower, at $50, and reaches $30,000+. Automated and AI-agent products publish most of the low prices. Human-led work is mostly quoted after scoping. Secure Ideas is the human-led exception, with published starting prices and rates. The prices cover different units, scopes and depths, as the table shows.

Delivery type affects price, and the AI vs human guide covers it. The PTaaS guide covers how platform and consultancy contracts differ.