What does a pentest cost? From €2,700.
A penetration test can take four days or three weeks depending on what there is to test: the exact price is set at scoping. Here is our pricing, what moves the number, what is always included, and how to read a quote you got elsewhere.
At a glance
- PricingSet at scoping, once the scope is written down and agreed.
- Always includedReport, debrief, retest and NDA.
- Never billedScoping time and writing the quote.
- QuoteWithin 24 business hours of our call or of receiving your brief.
The price of an audit is research time.
Two quotes at the same price can hide half the research. Always check the number of days.
That has a direct consequence: for the same scope, a quote that is much cheaper than another buys less research time. That is not necessarily a bad call, but you need to know what you are cutting. The first day of an audit mostly finds configuration problems. The following days go into understanding the application and digging further: access control, business logic, chained flaws.
The other consequence is that a price posted publicly assumes a standard scope, and in offensive security there is no such thing. A thirty-page online store and a business platform with seven roles are both web applications, and the workload has nothing in common.
That said, giving no figure at all helps nobody build a budget. So below is our pricing, for an engagement run with our in-house tools and hands-on expertise. These are minimums: the exact price is set at scoping, and that is the number we commit to.
Fewer days means less research. The first day mostly finds configuration, the following days go further: business logic, access, chained flaws.
Our pricing.
Three sizes of engagement, three prices. What is included is the same across the board, and nothing gets added as an option.
| Brochure site or store From €2,700 incl. tax Four to six days Request a quote | Focused API From €3,200 incl. tax Four to eight days Request a quote | Business application or SaaS From €7,500 incl. tax Ten to fifteen days or more Request a quote | |
|---|---|---|---|
| What gets tested | The public site, its forms, its customer area and its checkout. | The sensitive endpoints, each replayed with every role. | Several roles, overlapping permissions, complete journeys to break through. |
| Accounts and roles | The customer area, if there is one | Every route with every role | The full permission matrix |
| Scoping and quote | Free | Free | Free |
| NDA before any technical detail | Included | Included | Included |
| Same-day alert on a critical flaw | Included | Included | Included |
| Full report, replayable proof | Included | Included | Included |
| One-hour debrief | Included | Included | Included |
| Retest within 60 days | Included | Included | Included |
"From" prices, never flat fees: the exact amount is set at scoping, on a written scope, and then it stays put. A wider or deeper scope gets priced at the same time.
What moves the number.
Six things are usually enough to scope an engagement. They are exactly the questions we ask on the first call.
The size of the scope
The number of screens, journeys and endpoints actually tested. Not the number of pages: a hundred identical content pages count as one, while a single checkout can take a full day.
Authenticated or not
Testing without an account means looking at the storefront. As soon as there are accounts, the surface multiplies by the number of roles, because every feature has to be replayed with each of them.
Business complexity
A content site enforces few rules. A platform that handles permissions, balances, approvals or money flows enforces hundreds, and each one is a place where the logic can give way.
The depth you expect
Confirming there is nothing obvious, or digging all the way to the chains of minor flaws that, put end to end, give full access. Both are legitimate, but they do not cost the same.
The technical context
An API specification, read access to the code or a dedicated staging environment save a great deal of time, so they bring the price down. Without them, the time goes into reconnaissance.
The timing
An engagement planned a few weeks ahead costs less than one squeezed into the week because a customer wants a certificate by Friday.
How your price gets built.
Six steps, from the scoping call to the retest. The price is set at the third one and does not move after that.
Read the full methodology- 01
A thirty-minute call
We look together at what the application does, what data it handles, and what actually worries you. The call is not billed and commits you to nothing. Sometimes it ends with "you do not need an audit just yet".
- 02
A written scope
We send back, in black and white, what is in the engagement and above all what is not. That document protects both sides: without it, nobody can say at the end whether the work was done.
- 03
A priced proposal
An amount, a number of days, a test window and the list of deliverables. The price does not move after that, unless the scope changes at your request.
- 04
An NDA and an authorization agreement
The confidentiality agreement is signed as soon as we get into technical details. Once the quote is signed, the penetration test authorization agreement is essential: without it, the work has no legal footing, whoever the provider.
- 05
The engagement, then the report
If something critical turns up along the way, you hear about it right away, without waiting for the end. The report follows within days, with a one-hour debrief.
- 06
The retest, included
After your fixes, we replay the relevant tests and confirm in writing what is closed. No extra line on the invoice.
What never costs extra.
These items are in every proposal we send. They are listed here because elsewhere they are sometimes sold as options.
- €0.00
Scoping and quote
The scoping call and the written quote, whatever you decide.
- €0.00
Confidentiality agreement
Signed before you share the slightest technical detail.
- €0.00
Full report
An executive summary, the details of every vulnerability, the steps to reproduce and the expected fix. See a sample.
- €0.00
Immediate alert
If a critical vulnerability turns up during the engagement, you hear about it right away, not at hand-off.
- €0.00
One-hour debrief
With your technical team, to go back over anything that raises questions.
- €0.00
Retest of the fixes
Within 60 days of your fixes going live, with written confirmation of what is actually closed.
Extra charge€0.00
Nothing optionalReading a quote from someone else.
If you have several proposals on the table, four questions are enough to tell whether they describe the same thing.
How many days, and who does them
A quote without a number of days cannot be compared. Ask who does the work, too: the person you met, or a junior assigned after signing.
Hands-on or tool-driven
Ask how much of it is hands-on research. An audit built on one tool pass and its formatting is a scan: it has its value, but it is not the same job or the same price.
Is the retest included
Without a retest, you pay for a diagnosis nobody checks. It is the line most often taken out of the package to bring the headline price down.
What is in the report
Ask to see the structure, or the anonymized details of one vulnerability. A report that is just a tool export gives itself away immediately by its length and its lack of business context.
Why "from" prices rather than a flat rate?
Because a flat rate would be wrong both ways. Too high, it would rule out short engagements that wrap up in a few days. Too low, it would force us to cut research time, which is the one thing you are actually buying. A "from" price gives you the order of magnitude without pretending to know your scope before we have looked at it.
How big does a company need to be for this to make sense?
Company size has little to do with it. What matters is what your application handles and what a compromise would cost. A five-person team hosting its customers' health data needs an audit far more than a two-hundred-person group whose website is a brochure.
Can the quote change during the engagement?
The price stays put once the scope is written down and agreed. It only moves if the scope moves, for instance if you add an application along the way. If we find the scope is bigger than announced, we tell you before going further, and you choose between extending it and cutting it.
Is the retest really included?
Yes, and it is worth checking with everyone. An audit without a retest leaves you with a list of fixes nobody has confirmed. The retest covers the vulnerabilities in the report, within 60 days of your fixes going live. It does not cover features built since.
How much of my team's time does it take?
Half a day at scoping on a simple scope, to define what gets tested and create the accounts. More if the application has several roles and each needs its own set of data. Nothing during the test window, apart from someone reachable if something blocks. One hour at the debrief. The rest is our time, not yours.
What if you find nothing?
The price does not change, because what you buy is research time, not a number of flaws. And the report keeps its value: it lists what was tested, how, and what held up. That is the document you show a customer or an auditor. A report that announces zero flaws without detailing what was tried is not worth much. Ours details it.
Is it cheaper than a large firm?
Generally, yes, because there is no sales structure or project manager to pay for, and the person who sells you the engagement is the one who does it. What we cannot do, we do not sell: a scope outside our field gets turned down, not subcontracted.
Read further.
The price follows from the method and the deliverable: both are covered in detail elsewhere.
Our methodology
The frameworks, the phases and the rules of engagement of every engagement.
See the pageSample report
What you get for the price: the eight sections of the report and one flaw documented end to end.
See the pagePentest or vulnerability scan
Why a scan costs far less, and what it misses.
See the pageAll services
The six services, and which one fits your project.
See the pageRequest a quote.
Describe the scope in a few lines: what the application does, whether there are accounts and how many roles. We'll get back to you with a scoping proposal, a number of days and a price. The first call commits you to nothing.