A penetration test in 2026 usually costs between about $5,000 and $35,000 for a typical commercial engagement, according to published pricing guides from testing firms. ioSENTRIX puts most engagements at $5,000 to $35,000, and Blaze Information Security puts a standard commercial test at $10,000 to $35,000. Large or complex scopes go much higher: Invicti notes costs can reach over $150,000. These are vendor estimates, not audited market data, so treat them as a starting point for budgeting.
Updated October 2026
Published price ranges
| Source | Scope | Published range |
|---|---|---|
| ioSENTRIX | Most engagements | $5,000 to $35,000 |
| Blaze Information Security | Standard commercial engagement | $10,000 to $35,000 |
| FireCompass | Web application | $5,000 to $30,000 |
| Beagle Security | Web application | $5,000 to $30,000 |
| Invicti | Full range | A few thousand to over $150,000 |
Each of these sources sells security testing, so their numbers reflect their own market. Get two or three quotes for your actual scope.
What drives the price
Most firms price on tester days. Anything that adds days adds cost:
- Scope size. Number of hosts, pages, API endpoints and apps.
- Roles and tenants. Testing access control properly needs accounts for each role and more than one tenant. Each extra role multiplies the requests to check. See authenticated testing.
- Depth. A short test catches common issues. Business logic and access control testing takes longer because the tester has to learn the app first.
- Source code access. Whitebox tests can be faster per bug but add code review time.
- Tester seniority and location.
- Compliance needs. A report formatted for an auditor, or a letter of attestation, can add cost.
Costs that are not on the quote
- Retesting. Some firms include one retest, some charge for it. Ask.
- Scheduling lead time. Good firms book weeks ahead. Waiting has a cost if a customer or audit is blocked on the report.
- Internal time. Your team sets up accounts and environments, answers questions and triages the report.
- Fix time. The report lists bugs. Engineers still have to fix them.
- Gaps between tests. An annual test covers the code that existed that week. Code shipped the next week is untested until the next one. See continuous vs annual pentesting.
How to compare quotes
Normalize what you get, not just the total:
- How many tester days, and at what seniority?
- Which roles and tenants will be tested?
- Is a retest included?
- What does a finding include: steps, requests, responses, fix advice?
- Does the report state what was covered?
The buyer checklist has a fuller list.
Cost per bug, not per test
A cheaper test that misses the one cross-tenant bug that matters is not cheaper. When comparing options, look at what each one finds on the same app, how much of the output your team rejects, and how often it can run.
Pricing models you will see
- Fixed price per engagement. Common for human tests. Scope is agreed up front, and changes in scope mean a new quote.
- Day rate. You buy a number of tester days. Flexible, but coverage depends on how the days are spent.
- Pentest as a service (PTaaS). A platform plus human testers, often sold as credits or an annual plan.
- Subscription. Common for scanners and AI pentesting agents. Usually priced per app, target or asset, with testing as often as needed.
The cheapest way to compare is to pick one app, define the same scope for every option and ask what a full year of testing would cost, including retests.
How Wakefield helps
Wakefield runs nightly, on every pull request or when a new host appears, so testing is not tied to a booking window. Each finding is replayed by a separate verifier with a live exploit and a negative control, and retest replays that proof after a fix. Pricing is not published yet: talk to us. See the platform.