How much does a pentest cost? 2026 prices, retests and what to buy

How much does a pentest cost in 2026?

A manual penetration test of one web application usually costs $5,000 to $30,000. A pentest is an authorized attack on your app by someone you hired, who then writes up what they could reach and how to fix it. TCM Security, Blaze Information Security and Synack, three firms that sell pentests, all publish that same range for a web app in their pricing guides. Where your app lands depends on how many days of testing it needs: the low end is a small app with one or two user roles, the high end an app with many roles, a large API and a compliance report on top. Other targets are priced the same way: Blaze puts a separate API test at $5,000 to $20,000 and a mobile app test at $5,000 to $30,000.

Ranges stay vague because every quote is built from a scope. Published list prices are more concrete. Here is what testing one web app costs at vendors that print their prices:

Keep one warning from SecurityMetrics in mind: a "pen test" listed under $4,000 is probably not a real penetration test. That holds for manual tests sold as manual. Automated and AI-run tests are a different product sold for less, and the honest ones say so on the label. The pentest vs vulnerability scan guide explains what separates a scan from an attack that proves something.

Where the money goes: tester days times a day rate

A manual pentest is priced like any consulting job. The firm estimates how many days a tester needs for your scope, multiplies by its day rate, and adds the report and the retest if they are not already counted. TCM Security says a web app test almost always averages a week of testing. Blaze sizes a simple SaaS app at 3 to 7 testing days, and a medium one at a week and a half to two weeks. Cobalt, which sells pentests as prepaid credits, defines one credit as 8 hours of testing.

So a five-day test at €1,300 a day comes to €6,500, and a ten-day test of a larger app to €13,000. When two quotes for the same app differ by a factor of three, the first question to ask is how many tester days each one includes.

What makes a pentest quote go up or down

• Scope. The number of apps, domains and API endpoints. Bugcrowd's list prices step up at 45, 75 and 150 API endpoints. At Astra, a customer dashboard and an admin dashboard on two subdomains with separate logins count as two targets.
• User roles. Every role (visitor, member, admin, a second customer account) multiplies the access checks a tester has to run. Roles and APIs are what separate Blaze's simple SaaS tier from its medium one.
• How much the tester is given. A black box test starts from your app's address alone. A grey box test comes with an account for each role, and a white box test adds the source code. More context means more found per paid day. The web app pentest guide compares the three.
• The report you need. A test meant for a SOC 2 audit or an enterprise buyer needs a formal report, and often an attestation letter you can forward. Blaze prices a standard SaaS SOC 2 pentest at $8,000 to $25,000.
• Retests. Included, limited to a window, or billed per round. The next sections cover this.
• Timing. Astra says its manual pentests take 10 to 15 working days, and its pricing guide counts a short timeline among the things that raise a price.

Manual pentest, PTaaS or automated: what each one costs

Three kinds of offers answer the search for a pentest today. A manual pentest is a consultancy engagement with named testers. PTaaS (pentest as a service) is a platform where you buy tests or credits, testers work on your app, and findings land in a dashboard with retests included. Automated tools are software that attacks the app, some with AI agents choosing the next request.

The row that decides most purchases is the report. When a customer's security team asks for your latest third-party pentest, they usually expect a human test by a named firm. When nobody is asking yet, you are buying protection rather than paperwork, and the cheapest option that keeps attacking every new build makes more sense. The automated penetration testing guide covers what software can prove and what it misses.

Retests: what they cost and what to ask before you sign

A retest is the tester running the same attack after your fix, to confirm the hole is closed. The PCI Security Standards Council's penetration testing guidance expects one: the tester should retest to validate the fix, and if fixing drags on long after the original test, a new engagement may be needed to report on the app as it is now. Terms differ more than headline prices do:

• Blaze: one round of fix validation within 90 days in its main one-off packages, sold as an add-on in its Lite package.
• Astra Pentest Expert: two rescans by its testers, available for 30 days.
• Bugcrowd: its Standard Pen Tests of web apps, APIs and networks include 12 months of retesting and one report update.
• Cobalt: unlimited on-demand retesting for the length of the contract.
• Intruder: unlimited retesting with its AI pentest.
• Billed per round: Synack gives the example of a $10,000 engagement that charges $3,000 per retest, which runs over budget quickly if you fix in several batches.
• Keybrum: the one-time report retests its findings for 7 days, and plans keep retests open.

Send the same questions to every vendor, and compare the answers rather than the totals:

• How many tester days does the quote include, and who is the tester?
• Which apps, user roles and API endpoints are in scope, and what is left out?
• How many retest rounds are included, within what window, and what does one more cost?
• Will the report and the attestation letter satisfy the customer or auditor who asked for them?
• Which findings were confirmed by a person, and which came straight from a scanner?

How often to pentest, and the cost of a test that goes stale

How often you test is set by whoever asks for the test. PCI DSS, the card industry's standard, wants a penetration test at least once a year and after any significant change, but only when your self-assessment questionnaire includes requirement 11.4; most apps that take cards through Stripe Checkout or Elements fill SAQ A, which has no pentest requirement (PCI DSS penetration testing has the detail). SOC 2 has no explicit pentest requirement: the AICPA criteria name penetration testing only as one example of how a company can evaluate its controls, and say the criteria do not require every such example to be addressed. A customer contract that asks for a pentest makes one required anyway. The security questionnaire guide covers what to answer when the question comes.

The hidden cost is time. A pentest report describes the build that was tested, on the days it was tested. If you deploy every week, a yearly test checks about one build in 52. On apps built with Lovable, Bolt, Cursor or Claude Code, one prompt can add a table, an API route or a rewritten policy, and nothing in last spring's report covers it.

That is the case for splitting the budget: a human test when a deal or an audit needs the report, and automated attacks on every deploy in between, so the next leak shows up the day it ships rather than at next year's test.

What a startup needs at each stage, and what it costs

Skipping the manual test early is not cutting corners. A $5,000 test of an app that changes every day is out of date within weeks, while the same amount pays for years of automated attacks on every deploy. Buy the human test when someone needs the report. The pentest guide for startups goes deeper on timing, and the sample pentest report shows what a buyer expects to receive.

Cut the bill before you pay for a pentest

Every day a tester spends on a leak that a free tool would have shown is a paid day, at €1,000 or more in Northern and Western Europe. Blaze's own advice for making a small budget count: give the tester credentials and context, prioritize the scope, and compare quotes by tester days, deliverables and retest terms.

1. 1

   Fix what anyone can find

   Tables with RLS off, server keys in the JavaScript bundle, an exposed .env file. The Supabase RLS checker and the API key leak checker run in your browser, and the exposed .env guide covers how to check for that file.

2. 2

   Run the two-account test yourself

   Sign up as user A and user B. As B, request A's records by changing the id in the URL or the API call. If B sees A's data, that is an IDOR: any user can read any other user's records, and a tester would bill you a day to tell you so.

3. 3

   Write the scope down

   List the domains, the apps, the API routes, and every user role. Create one test account per role. A clear scope makes the quote smaller and the test deeper.

4. 4

   Ask for grey box

   Hand over the test accounts. Testers then spend paid days on what sits behind the login, where access control bugs live, instead of trying to get in.

Where Keybrum fits, and what it does not replace

Keybrum is an automated attack tool for apps built with AI. It attacks your live app the way a stranger would, with a library of more than 100 attacks: Supabase tables, functions, storage and realtime, Firebase rules, secret keys in the bundle, IDOR across two accounts, unprotected AI endpoints, unsigned Stripe webhooks, exposed .env files and known Next.js and React CVEs. Every finding comes with the request that worked, and your coding agent reads the fix through Keybrum's MCP server.

• One-time report, €49: one app attacked, proof of every finding, the fix for your coding agent, and retests of those findings for 7 days.
• Plans: Maker €29 a month for 5 apps, Team €99 a month for 25 apps. They attack every deploy, keep retests open and add a public trust page that shows what was tested and when.
• All prices exclude VAT. Keybrum only attacks apps whose owner proved ownership.

What it does not replace: a human tester's judgment on business logic, such as refunds, credits or a multi-step checkout, and the signed report from a named firm that an auditor or a buyer's security team may ask for. Use both. Automated attacks run between human tests, and the human test comes when a deal or an audit needs it, on an app that already passed the obvious checks.