Pentest pricing index 2026: medians by unit from 21 providers

Last updated 9 November 2026. This pentest pricing index counts every price that the 66 providers in the PentestCompare dataset publish on their own pages. Twenty-one providers publish at least one price, which gives 68 price rows. We group the rows by billing unit and currency. We never mix units. A median appears only where 3 or more providers share a group.

Pentest pricing index: summary table#

The only group with enough providers for a median in a project-sized unit is "per test" in US dollars. It has 21 rows from 9 providers: lowest $1,000, median $5,000, highest $27,120. "Per month" has a median of $199.95 across 6 rows from 3 providers, but those rows are subscription tiers, mostly of scanners, so it says little about a pentest.

Of the 21 per-test rows, 14 are starting prices ("from", "starts at", "smallest scope"). The median of the 7 exact prices is $3,500 (5 providers: Cobalt, Intruder, Aikido, Stingrai and Prescient Security). We compute that figure from the same rows and show it so you can see how much the "starting" label moves the number. Prices change often: the Cobalt $3,500 row is a limited-time offer that its page says must start and finish before 31 December 2026.

How do we compute the index?#

We read each provider's public pricing page on 9 November 2026 and copied every dollar or euro price into the dataset with its unit, scope note and source URL. This index uses only those rows. We did not search for prices on other sites, convert currencies or adjust for inflation.

Method, step by step:

1. Take all 68 rows from data/providers.json where a provider lists a price.
2. Map each unit string, exactly as published, to one unit class using the mapping table below. Rows that fit no class go to "not comparable".
3. Split each class by currency. USD and EUR rows are never combined.
4. Use the first number in the amount. For ranges ("640 EUR to 890 EUR") that is the low end.
5. Count rows and distinct providers per group. Compute a median only when the group has 3 or more providers. Otherwise show the lowest and highest values only.

The dataset has no field for test type (web application, network, cloud). We cannot compute a median per test type, and the index does not pretend to. Some price rows carry a scope note, and the full row list below links each one to its source.

What do published prices per test look like?#

Per-test prices run from $1,000 to $27,120 in US dollars. Each row below is one published price. "Starting price" is Yes when the amount or unit uses "from", "starts at" or "starting", or when the provider calls it the smallest scope.

One euro row sits outside this table: Hadrian lists "From EUR 1,250" per test, excluding VAT.

The widest spread is inside single providers. Synack's three per-test starting prices run from $5,085 to $27,120, and CYBRI's four run from $2,500 to $20,000. The dataset records what each tier covers (for example, Synack14 is a 14-day team test), so read the provider's row before you compare two numbers.

Splitting the per-test rows by delivery model shows a pattern, with caveats. Delivery model comes from the dataset's own label for each provider.

Human-led and automated providers each have only 2 providers with per-test rows, so no median is shown. The hybrid median equals the all-provider median. The sample is too small to call one model cheaper than another.

What do subscription and asset prices look like?#

Annual and monthly prices come mostly from platforms and scanners. Annual prices in US dollars range from $2,999 (Astra Security, Pentest Auto) to $49,990 (TurboPentest, an enterprise dedicated instance), from 2 providers. Detectify's annual platform fees are in euros, from EUR 500 for PCI ASV scanning to EUR 15,000 for the Enterprise tier. Its Starter tier at EUR 0 sits under "not comparable" as a free tier.

Monthly flat plans in US dollars come from Penligent, Penti and TurboPentest:

Per-asset prices and time-based rates have too few providers for a median, and each uses a different unit.

Credits have no shared definition. TurboPentest sells one pentest per credit ($99, $299 or $699 by tier). Secure Ideas sells a credit worth up to one day of expert work ($2,520).

Which price rows are not comparable?#

Eighteen of the 68 rows do not fit a unit class. We list each with the reason, so you can check our judgment.

All 68 input rows with source and date#

The table lists every row in the index, in dataset order, with the unit class we assigned. Click a source to see the price on the provider's page. All rows were checked on 9 November 2026.

What are the limits of this index?#

The index describes published prices, and the limits matter more than the medians.

Only published prices count. 45 of 66 providers publish none, and providers that sell human-led work mostly quote after scoping. They are under-represented: 3 of 32 human-led providers have a price row, against 10 of 19 hybrid and 8 of 15 automated providers.

Many amounts are starting prices, which are floors for the smallest scope. A real project often costs more. The dataset has no test-type field, so a $4,000 row and a $13,600 row may cover different work.

Nine providers drive the per-test median, and one provider with 3 or 4 rows (CYBRI, Secure Ideas, Synack) moves it. Prices were read once, on 9 November 2026, and offers expire. EUR rows are shown and never converted. PentestCompare is published by Excession Labs, which is not a row in this dataset.

To compare quotes for your own project, use the pentest cost guide and the questions to ask a pentest provider. Provider pages are in the pricing hub. Counts of how many providers publish prices and sample reports are in the pentest provider market snapshot.

Download the pentest pricing CSV#

Download pricing-index-2026.csv. It has one line per price row (68 lines) with these columns: provider, provider_slug, delivery_model, row_label, amount_as_published, currency, amount_first_number, starting_price, unit_as_published, unit_class, used_in_range_stats, reason_not_comparable, source_url and checked. The computed tables are under CC BY 4.0.

How to cite this index#

Cite it as: PentestCompare, "Pentest pricing index 2026", 9 November 2026, https://pentestcompare.com/research/pentest-pricing-index-2026/. State the unit and the sample size with any figure, for example "median $5,000 per test, 21 published rows from 9 providers, 9 November 2026". Send corrections through the correction form.