In brief
Penetration testing cost is the number of person-days times the testers' day rate, plus the report and, if agreed, a retest. Scope sets the days: web apps, APIs, networks and cloud accounts. Two suppliers on the UK G-Cloud 14 marketplace list £750-1,400 a day (as of 27 October 2026).
Key takeaways
- A pentest is priced per person-day: the scoped number of days times the day rate, with the report and the retest as separate lines.
- Two penetration testing suppliers on the UK government's G-Cloud 14 marketplace list day rates between £750 and £1,400 (as of 27 October 2026).
- Black box testing spends paid days on reconnaissance; the German BSI recommends white box testing as the default.
- NIST SP 800-115 says a retest validates that fixes are in place, and verifying them means repeating the original test.
- DORA requires appropriate tests of ICT systems supporting critical or important functions at least yearly and lists penetration testing as one of the test types (Art. 24-25).
Penetration testing cost comes down to one formula: the number of person-days the testers need times their day rate, plus the report and, if agreed, a retest. The scope sets the days: how many web applications, user roles and API endpoints, how much of the internal network, which cloud accounts. Guides such as the OWASP Web Security Testing Guide and NIST SP 800-115 describe what those days should contain. Below we show how to read a quote line by line before you order a penetration test.
How is penetration testing cost calculated?
Few vendors in Poland or Germany publish their day rates, and a quote with one total and no days hides the calculation. The price is days times day rate. The days come from scoping, so the same team will quote very different totals for one web application and for an internal network with three cloud accounts.
One public reference point: suppliers on the UK government's G-Cloud 14 marketplace publish their day rates. Pentest Cyber lists £900 a day, PureCyber £750 to £1,400 a day for web application testing (checked 27 October 2026). These are list prices set by the suppliers, not awarded contract values, and they do not translate directly to other markets.
What drives the number of days?
Each item in scope adds test time, so a vendor needs the size of every target before counting days. The table shows what you will be asked and why it moves the estimate.
| Scope item | What the vendor asks | Why it adds days |
|---|---|---|
| Web application | user roles, main functions, login methods, file uploads, payments | each role and business process is tested separately |
| API | number of endpoints, OpenAPI documentation, authentication method | without documentation the testers first map the API themselves |
| External infrastructure | public IP addresses and domains | every exposed service is enumerated and tested |
| Internal network | segments, number of hosts, starting point (office network, VPN account) | lateral movement and Active Directory paths take time |
| Cloud | number of accounts or subscriptions, services in use | configuration review per account plus tests of exposed services |
| Environment and window | staging or production, allowed hours | testing only at night or with throttled traffic stretches the calendar |
For web applications, the OWASP guide groups tests into categories such as authentication, authorization, session management, input validation, business logic and client-side testing. Our web application security tips show where most of those weaknesses start. For cloud accounts, a cloud audit covers the configuration side that a pentest only touches.
Ask the vendor to state the assumptions behind the price: number of roles, endpoints or IP addresses. If the real scope turns out larger or smaller, you can see which assumption moved and why the price changed.
Black box, gray box or white box: which gets you more for the money?
The terms describe how much the testers know before they start. The OWASP guide calls testing without prior knowledge black-box testing and testing with some partial knowledge of the application gray-box testing. In practice, gray box usually means a test account for each role. In a white box test the team gets documentation, accounts and often the source code.
Black box sounds realistic, but some of the paid days go to finding out what you could have told the testers in an email. The German BSI recommends white box testing as the default in its practical guide to penetration tests. A real attacker is not limited to the days in your quote. Your testers are.
For web applications, gray box is the common choice. If what you need is a check of the application against a security standard rather than an attack simulation, that is a different scope: an OWASP ASVS assessment.
What should a pentest quote include?
A quote you can compare names the work, not just a total. Check these lines:
- Scope. Targets by name: URLs, API base addresses, IP ranges, cloud accounts, and what is explicitly out of scope.
- Method. The guide the team follows, for example the OWASP Web Security Testing Guide or NIST SP 800-115, which describes planning, discovery, attack and reporting phases.
- Effort. Person-days per target and how many people work on the test.
- Test conditions. Environment, time windows, accounts you provide and a contact person during the test.
- Rules of engagement. A signed authorization of what may be tested and how; NIST SP 800-115 treats it as the testers' permission to act.
- Report. An executive summary and, for each finding, severity, evidence, steps to reproduce and a recommendation.
- Retest. Whether it is included, within what period and which findings it covers.
A line such as "application pentest: 1 package" does not tell you whether you are buying manual testing or an automated scan with a branded report.
Why are two pentest quotes so different?
Usually because they price different work. Put two offers side by side and you will often find that:
- one includes the API and the admin panel, the other only the public part of the application;
- one counts days of manual testing, the other mostly runs a vulnerability scanner;
- one budgets for a single tester, the other for a team (the BSI guide assumes at least two people per test);
- one includes a retest and an executive summary, the other charges for both separately;
- one tests at night in production, the other during the day in a staging environment.
Ask both vendors to fill in the same table: targets, days per target, method, team, report and retest. The price gap usually shrinks or becomes explainable. A pentest checks whether someone can get in. It does not replace an IT audit of processes and access rights.
What is a retest and should it be in the price?
A retest is a second, shorter test after you fix the findings. NIST SP 800-115 (section 8.3) says retesting validates that the mitigation actions are complete, and that the test team verifies a fix by repeating the original test. Without it, the report shows what was broken, not what is fixed now.
Ask four questions before you sign. Is the retest in the price or a separate line? How long after the report can you order it? Does it cover all findings or only critical and high ones? Do you get an updated report that marks each finding as fixed? Agree these terms before the test, not after the report lands.
When does regulation expect a penetration test?
For financial entities, DORA is explicit (as of 27 October 2026). Entities other than microenterprises must run appropriate tests on all ICT systems and applications supporting critical or important functions at least once a year, using independent internal or external testers. Penetration testing is on the list of test types in Art. 25(1).
Threat-led penetration testing (TLPT) every three years applies only to entities identified by their competent authority (Regulation (EU) 2022/2554, Art. 24-26).
NIS2 does not use the word pentest. Art. 21(2)(f) requires policies and procedures to assess the effectiveness of cybersecurity measures. For cloud, data center, managed service and similar providers, Implementing Regulation (EU) 2024/2690 requires a security testing policy that sets the need, scope and frequency of tests (Annex, point 6.5); its recital 15 names penetration tests as one option.
In both cases you have to show the scope, the method and what you fixed. That is why the report and the retest matter as much as the test days. Our article on data breaches and their consequences shows what happens when nobody tests.
How to get pentest quotes you can compare
Before you ask for prices, list the targets, user roles, API documentation, IP ranges and cloud accounts, and decide on the environment and the test window.
Send the same list to every vendor and ask for days per target, method, team, report contents and retest terms in writing. If you are comparing penetration testing companies in Poland, read how we run penetration tests or write to us to talk through your scope.
Frequently asked questions
- How much does a penetration test cost?
It is the number of person-days times the day rate, plus the report and a retest if agreed. Two suppliers on the UK G-Cloud 14 marketplace list £750-1,400 a day (as of 27 October 2026); the total depends on how many days your scope needs.
- How long does a penetration test take?
That depends on the scope. The vendor estimates days per target from the number of user roles, API endpoints, IP addresses and cloud accounts, then adds time for the report.
- Is a vulnerability scan the same as a penetration test?
No. A scan runs automated checks for known weaknesses. In a penetration test, as NIST defines it, people mimic real attacks to get around security controls and confirm what can actually be exploited.
- What is a retest in a pentest?
A repeat of the original tests for the reported findings after you fix them. It confirms the fixes work and should end with an updated report.
- Do we need a pentest for DORA or NIS2?
DORA requires financial entities to test systems supporting critical or important functions at least yearly and lists penetration testing as one of the test types. NIS2 requires assessing the effectiveness of security measures without naming pentests, so a pentest is one way to provide that evidence.
