A manual penetration test of a web application and its API typically costs between about €3,000 and €20,000 in Europe, £5,000 and £18,000 in the UK, and $5,000 and $30,000 in the US, depending on scope. Under most quotes sits day-rate maths: a fair day rate is around £1,000 to £1,500, so divide any quote by it to see how many days you are buying. If the answer is one or two days, you are probably being sold an automated scan, not a penetration test.
Sources: the named providers’ own pages, all checked 06-08-2026; full links in the source list.
| What moves the number | Honest range | Source (checked 06-08-2026) |
|---|---|---|
| Web application test (UK) | From £5,000; typically £8,000 to £18,000 | EJN Labs |
| Web application test (US) | $5,000 to $30,000 | Blaze Information Security; Synack |
| Web application test (EU) | €3,500 to €20,000+ | Sectricity |
| API penetration test | From £4,000 (UK); €3,000 to €7,500 (EU) | EJN Labs; Sectricity |
| Cloud security review | From £4,500 (UK); $10,000 to $50,000 (US) | EJN Labs; Synack |
| Automated scanning subscription (for comparison) | From $95 per month | Pentest-Tools.com |
Why listen to us. Atoro is an Irish AI governance and cyber compliance consultancy for software companies, and the first consultancy in Europe certified against ISO 42001. We scope and deliver penetration tests for software companies preparing for audits and enterprise deals, and we see this quote confusion weekly.
What actually drives the penetration testing cost
Four things set the price: the size of the application, the number of user roles, the API surface, and whether cloud infrastructure is included. Everything else is secondary to how many days of a tester’s time those four things imply.
The size of the application
Count what a tester has to touch: screens, workflows, forms, integrations, file uploads, payment flows. A ten-screen product with one checkout flow is a different job from a multi-tenant platform with an admin console and a dozen integrations. More surface means more days, and more days is the entire cost story. A quote that never asks how big your application is should worry you more than a high quote that did.
The number of user roles
Each distinct role multiplies the authorisation testing: a tester has to check that a viewer cannot act as an editor, an editor cannot act as an admin, and one tenant’s admin cannot reach another tenant’s data. An application with two roles is a smaller job than the same application with six, and any serious scoping call will ask about roles before it talks about price.
The API surface
Most modern software companies expose an API that does the real work, and it needs its own testing: authentication, object-level authorisation, rate limiting, injection. Endpoint count is one of the cleanest scoping inputs there is: CyberHunter Solutions publishes a package scoped at one app, three user roles and 100 API endpoints (pricing page, checked 06-08-2026). If your API is the product, read what a dedicated API penetration test covers before accepting a quote that bundles it into “the app test”.
Whether cloud infrastructure is included
A test that stops at the application is a different engagement from one that also reviews the AWS, Azure or GCP environment underneath it: identity and access management, storage exposure, network segmentation. EJN Labs prices AWS cloud security separately, from £4,500 against £5,000 for the application itself (pricing page, checked 06-08-2026). If your quote says “the platform” without saying whether the cloud account is in scope, ask. Our cloud penetration testing page explains what that scope includes.
The day-rate maths underneath every quote
Most providers price by the day, whether they say so or not. Secforce, a UK CREST firm, puts a fair 2026 day rate at around £1,200 (€1,400), calls anything under £500 (€600) a day “risky, likely not a real pen test”, and works an example web application test at six days and about £6,000 (price guide, checked 06-08-2026). EJN Labs discloses rates of £1,100 to £1,400 per day; Synack puts US boutique senior-tester day rates between $1,200 and $3,000 (both checked 06-08-2026). Once you know this, every quote becomes legible: ask how many days it buys.
What penetration testing costs in 2026: the published ranges
Published, citable prices are rare: most providers hide pricing behind a call, and no regulator or accreditation body publishes cost guidance, so the figures below are the verified published set, each from the named provider’s own page.
| Provider (market) | Published figure | Notes |
|---|---|---|
| Precursor Security (UK, CREST) | Pen testing from £2,500 | Fixed pricing, retest included |
| Sectricity (EU) | Web €3,500 to €20,000+; API and mobile €3,000 to €7,500; external infrastructure €2,500 to €7,000 | European market ranges |
| Blaze Information Security (US) | Web $5,000 to $30,000; API $5,000 to $20,000; cloud $10,000 to $40,000+; own tests from $4,999 | Market table plus own prices |
| Synack (US, market guide) | $5,000 to $100,000+ overall; most organisations $10,000 to $30,000 per engagement | Day rates $1,200 to $3,000 |
| CyberHunter Solutions (Canada/US) | Web app and API $2,500 to $10,000+; application tests $1,500 to $45,000+ | Packages with explicit scope limits |
| Astra Security (PTaaS) | Pentest plan $5,999 per year; scanner-only plan $1,999 per year | Subscription platform pricing |
| Pentest-Tools.com (automated tools) | From $95 per month | Self-service scanning, comparison only |
Two honest observations. First, the spread inside each row is scope, not arbitrariness: a £5,000 test and an £18,000 test from the same firm are different amounts of work. Second, the bottom two rows are a different product wearing the same label.
The €500 option vs the €5,000 option: what you actually get
The price spread in this market mostly reflects automated vulnerability scans being sold as penetration tests at the low end. A scan finds known weaknesses automatically; a penetration test has a human chaining weaknesses, testing business logic and validating every finding before it goes in the report.
| Automated scan sold as a “pen test” | Manual penetration test | |
|---|---|---|
| Typical time implied | Hours to one day | 4 to 12+ days depending on scope |
| Findings validated by a human | Rarely; false positives common | Yes, each finding reproduced before reporting |
| Business logic and authorisation flaws | Not detectable by scanners | Core of the work |
| Report | Tool output, reformatted | Audit-ready document a customer or auditor can read |
| Retest after fixes | Usually another paid run | Included by some providers, charged by others; ask |
Buyers describe the gap bluntly: “someone’s literally show up with Nessus on a laptop, run it, then email you the PDF along with a bill” (r/sysadmin, April 2023). A pentester answering a founder whose quotes ran from $1,000 to $12,000 warned that “anything under 5k is likely just automated Vuln scans with some fancy reformatting” (r/Pentesting, November 2024). Practitioner descriptions, not statistics, but they match the day-rate maths above.
A scan is not worthless: it is a cheap layer of ongoing vulnerability management, and tools start at $95 per month (Pentest-Tools.com, checked 06-08-2026). It is not an independent manual test, which is what an audit, security review or customer questionnaire is asking for. For what a manual engagement involves, see our penetration testing services page.
The hidden costs nobody mentions
The quote is rarely the whole cost. Four line items surface after signature.
The retest. Fixing findings is the point, and someone has to verify the fixes. Precursor Security advertises “retest included” and EJN Labs advertises free retests (both checked 06-08-2026); others charge for it as a new engagement. A cheap quote plus a charged retest can cost more than an honest quote with one included.
False positives that eat engineering time. An unvalidated scanner report hands your engineers a list where many “criticals” are wrong or irrelevant to your stack; practitioners report tests flagging an Exchange server the client had decommissioned two years earlier (r/msp, January 2023). Triage hours are a real cost, and manual validation is what removes them.
The report that fails its purpose. If the test exists to satisfy an auditor or close a deal, the report is the deliverable. Reformatted scan output may not survive a security questionnaire review; buyers report paying for tests purely because “I just need the paper from a reputable vendor that I can give to auditors or spicy customers” (r/msp, January 2023).
Scope change fees. If the scoping call was shallow, the engagement will find the missing surface mid-test, at day-rate prices. A quote built on a real scoping conversation is cheaper than a low quote plus change orders.
How to reduce the cost honestly
You can bring the number down without buying a worse test: most of the levers are scope and preparation, not quality.
- Fix what you already know about first. Run your own vulnerability management before paying day rates to learn what a scanner would have found. One practitioner’s advice: if you have not scanned your systems and worked through the results, “a penetration test is probably not a good use of money” (r/msp, January 2023). Every finding you fix first is tester time spent on things only a human can find.
- Scope to what the test is for. If an enterprise customer wants assurance over your production application and its API, scope exactly that. Staging, internal tools and the marketing site can wait.
- Prepare before day one. Test accounts for every role, API documentation, credentials and a working environment, ready before the engagement starts. Days lost to access problems are billed days that buy you nothing.
- Go white box or grey box. Documentation, architecture diagrams and source access cut reconnaissance time and raise coverage per day; buyers note white box testing is “more bang for the buck” than black box (r/Pentesting, November 2024).
- Negotiate the retest into the price. It costs the provider little to commit to up front and costs you money if billed separately.
- Bundle deliberately. Testing application, API and cloud in one engagement is usually cheaper than three, because scoping and reporting overhead are paid once. If that combined scope is yours, our page on penetration testing for software platforms describes how it is structured.
When the number is worth paying
Pay for a proper manual test when the test is load-bearing: when it unblocks an audit, satisfies an enterprise security review, or stands between you and a contract. Founders describe losing six-figure deals at the security-review stage. Against a six-figure contract, a four-figure difference between quotes is noise.
The provider’s name on the report matters more than buyers expect: practitioners report clients coming “just for the name on the report as their clients do ask to see reports”, and that the stamp matters particularly for companies selling into Europe (r/Pentesting, November 2024). A test that passes the first time is cheaper than a cheap test done twice.
For calibration: a typical Atoro test of a web application and its API, with manual validation, an audit-ready report and a retest included, starts at around EUR 3,000, and larger or more complex platforms sit higher. We scope before quoting, so the number you hear on the first call is the number, not the opening bid.
Frequently asked questions
Why are my penetration testing quotes so different?
Because they are not quoting the same thing. Quotes for what sounds like one test routinely range from $1,000 to $12,000 (r/Pentesting, November 2024); the difference is days of manual work and human validation. Divide each quote by a fair day rate (£1,000 to £1,500, per Secforce) and compare day counts, not totals.
Is £5,000 or €5,000 the going rate for a pen test?
It is a real price for a small, well-scoped manual test: EJN Labs starts web application work at £5,000, Precursor Security at £2,500. Whether it is the going rate for yours depends on scope; a £5,000 quote for a large multi-role platform implies so few days you should ask what is being tested.
How do I know if I am getting a real penetration test or just a vulnerability scan?
Ask three questions: how many days of manual testing are included, are all findings manually validated before reporting, and can you see a sample report. A genuine provider answers all three easily. A scanner reseller talks about tools, coverage badges and turnaround time instead.
How many days should a penetration test take?
EJN Labs publishes durations that give proportion: 6 to 12 days for a web application, 4 to 9 for an API, 3 to 5 for external infrastructure; Secforce’s worked example is six days. Anything promising a thorough manual test in a day or two is describing a scan.
Should the retest be included in the price?
Some providers include it: Precursor Security and EJN Labs both advertise included or free retests. Others charge separately; there is no market standard, so ask before signing.
Do I need a penetration test for SOC 2?
Providers sell SOC 2-specific penetration tests: EJN Labs prices them at £5,000 to £8,000 for small companies and £8,000 to £18,000 for standard scope, so auditors commonly expect one, and founders budgeting for SOC 2 commonly plan several thousand more for it alongside the audit fee.
Will my customer or auditor accept a cheap test?
Sometimes, if all they need is evidence a test happened; buyers report paying purely for “the paper from a reputable vendor” (r/msp, January 2023). But security teams increasingly recognise scan output, and practitioners report customers asking to see the report and the name on it (r/Pentesting, November 2024). The risk is paying twice: for the cheap test, then for the real one.
Can I just run a scanner myself instead?
Yes, for ongoing vulnerability management; self-service tooling starts at $95 per month (Pentest-Tools.com). No, if the requirement is an independent test: an audit or enterprise review asking for a penetration test is asking for a third party trying to break in. Run the scanner yourself, fix what it finds, then pay for the manual test on a cleaner target. The honest next step, if you have quotes in hand and cannot tell what separates them, is a scoping conversation rather than more shopping. Send us your application size, user roles, endpoint count and cloud scope, and we will tell you what a proper test involves and costs. Start at our penetration testing services page.
Sources
Tier 2 (named provider pages, all checked 06-08-2026):
- EJN Labs, pricing page: https://ejnlabs.com/pricing/ (web app from £5,000, typical £8,000 to £18,000, 6 to 12 days; API from £4,000, typical £7,000 to £12,000, 4 to 9 days; AWS cloud from £4,500; external infrastructure 3 to 5 days; SOC 2 pen test £5,000 to £18,000; day rates £1,100 to £1,400; free retests)
- Secforce, “Pen testing price list UK and EU guide” (updated for 2026): https://www.secforce.com/the-blog/pen-testing-price-list-uk-and-eu-guide-2025/ (fair day rate £1,200 / €1,400; under £500 / €600 per day “risky, likely not a real pen test”; £1,000 to £1,500 / €1,200 to €1,800 typical manual range; worked example 6 days, £6,000)
- Synack, “How much does penetration testing cost?” (25-06-2026): https://www.synack.com/blog/penetration-testing-cost/ (overall $5,000 to $100,000+; most organisations $10,000 to $30,000; day rates $1,200 to $3,000; cloud $10,000 to $50,000)
- Blaze Information Security, “How much does penetration testing cost?”: https://www.blazeinfosec.com/post/how-much-does-penetration-testing-cost/ (web $5,000 to $30,000; API $5,000 to $20,000; cloud $10,000 to $40,000+; own starting prices from $4,999)
- Sectricity, “How much does a pentest cost?”: https://sectricity.com/blog/how-much-does-a-pentest-cost/ (web €3,500 to €20,000+; API and mobile €3,000 to €7,500; external €2,500 to €7,000)
- Precursor Security, homepage: https://www.precursorsecurity.com/ (“Pen testing from £2,500. Fixed pricing. Retest included.”)
- CyberHunter Solutions, packages and pricing: https://cyberhunter.solutions/penetration-testing-packages-and-pricing/ (web app and API $2,500 to $10,000+; application $1,500 to $45,000+; package scoped at 1 app, 3 user roles, 100 API endpoints)
- Astra Security, cost guide and plans: https://www.getastra.com/blog/penetration-testing/cost/ (Scanner $1,999/yr; Pentest $5,999/yr)
- Pentest-Tools.com, pricing: https://pentest-tools.com/pricing (from $95/month)
Language sources (Reddit, phrasing and buyer experience only, never price facts):
- r/sysadmin, “Pen tests recommendations?” (November 2020): https://www.reddit.com/r/sysadmin/comments/js8gy6/pen_tests_recommendations/
- r/sysadmin, “Penetration Testing” (April 2023): https://www.reddit.com/r/sysadmin/comments/12yc7qw/penetration_testing/ (“show up with Nessus on a laptop… email you the PDF along with a bill”)
- r/Pentesting, “Pentesting advice for startup” (November 2024): https://www.reddit.com/r/Pentesting/comments/1gv57ft/pentesting_advice_for_startup/ (“anything under 5k is likely just automated Vuln scans”; “more bang for the buck”; name-on-the-report comments)
- r/msp, “Rise of terrible penetration tests” (January 2023): https://www.reddit.com/r/msp/comments/10n1exs/rise_of_terrible_penetration_tests/ (“the paper from a reputable vendor”; Exchange false-positive story; vulnerability-management-first advice)
- r/startups, SOC 2 budget threads (2024 to 2025): buyer-sentiment background only; direct quotes removed pending re-verification of thread URLs