Security buyers’ most-searched question in 2026 isn’t “what is a pentest” — it’s “what should I pay for one?” This guide breaks down realistic 2026 penetration testing prices by scope, methodology, and compliance driver, with a build-your-own cost calculator you can adapt to your own RFP.
For a typical mid-size web application, expect $4,000–$15,000 per test cycle. Network infrastructure tests run $8,000–$30,000+. Red team engagements — multi-week, objective-based — start around $25,000. Below the ~$3,000 line you are almost always buying automated scanning re-packaged as “penetration testing.” Price actually moves on five factors: attacker-reachable scope, manual-vs-scanner hour mix, retest inclusion, compliance framing, and booking season.
Quick answer: what a pentest costs in 2026
For a typical mid-size web application, expect $4,000–$15,000 per test cycle. Network infrastructure tests run $8,000–$30,000+. Red team engagements — multi-week, objective-based — start around $25,000. Below the $3,000 line you are almost always buying automated scanning re-packaged as “penetration testing.”
| Test type | Typical 2026 range | Primary driver |
|---|---|---|
| Web application (1–2 apps) | $4,000–$15,000 | OWASP scope, auth complexity |
| API security test | $3,500–$12,000 | Endpoint count, data sensitivity |
| External network | $5,000–$20,000 | IP count, exposed services |
| Internal / AD assessment | $8,000–$25,000 | Domain size, tiering |
| Cloud (AWS/GCP/Azure) config + IAM | $6,000–$20,000 | Accounts, regions, IAM sprawl |
| Mobile application | $5,000–$18,000 | Platforms, obfuscation |
| Red team (objective-based) | $25,000–$100,000+ | Duration, detection maturity |
| Agentic AI / LLM application | $7,000–$25,000 | Tool surface, data flows |
The five factors that actually move the price
1. Scope counted in attacker-reachable surface, not pages
Vendors price by what they must actually test: authenticated roles, API endpoints, business logic flows. Cutting a quote by cutting scope usually means dropped auth roles — the single most bug-dense area of any application.
2. Methodology and seniority mix
Ask what percentage of hours go to manual testing versus scanner triage. A credible report should show per-finding reproduction steps written by a human. Senior-heavy teams charge more and find the logic flaws scanners structurally cannot — the same asymmetry that shapes modern attack capability also shapes its professional defense market.
3. Retesting and remediation window
Cheap quotes frequently exclude retest. Insist on a written retest window (30–90 days) for criticals and highs — otherwise you will pay twice to verify somebody else’s patch.
4. Compliance driver (and report overhead)
PCI DSS, SOC 2, ISO 27001, DORA and NIS2 all accept pentest evidence but each wants slightly different report framing. If the engagement exists purely for an auditor, say so — it changes how the vendor budgets report writing, not testing.
5. Timing and market
ISO 27001 certification cycles cluster at fiscal year-ends; Q4 quotes typically run roughly 10–20% higher and book out 4–6 weeks ahead. Planning a Q1–Q2 engagement is the simplest discount available.
Build-your-own estimate (the calculator)
Estimate: (baseline ± scope multiplier) × compliance factor × timing factor.
| Input | Value | Effect on estimate |
|---|---|---|
| Baseline — web app | $8,000 | Starting point |
| Baseline — external network | $12,000 | Starting point |
| Baseline — cloud config + IAM | $12,000 | Starting point |
| Extra authenticated role | +25% each | Scope multiplier |
| Extra platform (mobile/API) | +15% each | Scope multiplier |
| Additional environment | +10% each | Scope multiplier |
| PCI DSS driver | ×1.2 | Reporting rigor |
| DORA / NIS2 driver | ×1.15 | TLPT framing |
| Q4 booking | ×1.15 | Peak season |
| Multi-year contract | −10% | Commitment discount |
Worked example: one web app, three auth roles, PCI: $8,000 × 1.50 × 1.2 × 1.0 ≈ $14,400 — squarely inside the observed market band for PCI web tests.
What “too cheap” looks like
Red flags for scanner-resale masquerading as pentesting: fixed per-IP pricing with no scoping call, reports that read like scanner output with a new cover, no per-finding reproduction steps, resistance to sharing a sample report, and no discussion of your business logic. If the “test” never asks how your application actually makes money, it isn’t testing the things attackers will target — see how adversaries pick targets for what a real adversary model looks like.
Questions to ask before signing
- What fraction of hours is manual testing?
- Who exactly executes the engagement (names, seniority, background)?
- Is retest included, and for which severities?
- How is exploit evidence sanitized for our compliance archive?
- What happens if you find nothing? (Good answers involve deeper scope, not shorter hours.)
FAQ
Is one pentest per year enough?
For most compliance regimes, yes — minimum annually plus after major change. High-change organizations (continuous deployment, new AI features) benefit from narrower quarterly tests of what changed rather than one annual everything-test.
Why do AI application tests cost more than web tests?
Agentic systems add tool-call, memory, and indirect-prompt-injection surfaces that standard web methodology doesn’t cover — incidents like the AutoJack agent hijack show why agent execution paths need dedicated scrutiny. Testers need both web and ML security skills, which are still scarce in 2026.
Can I use a bug bounty instead?
Complementary, not interchangeable. Bounties are unbounded-discovery; pentests give you a scoped, dated, attested snapshot an auditor accepts.
What’s the smallest useful engagement?
A tightly scoped 3–5 day test of your crown-jewel application — one app, two roles, retest included. Well under $10k, and it will teach you more about your program than any scanner ever will.
References
- OWASP Web Security Testing Guide — the scoping baseline most web pentest quotes are built on
- PCI DSS requirements (incl. 11.4 penetration testing) — PCI Security Standards Council
- DORA — Regulation (EU) 2022/2554 — threat-led penetration testing (TLPT) framing for financial entities
- NIS2 Directive overview — European Commission
- Internal: Agent identity & least privilege — why AD/IAM sprawl drives internal-assessment pricing
- Internal: Top 10 emerging cybersecurity threats 2026 — context for what your test should cover
