For a manual penetration test in the German-speaking market, the publicly visible provider figures run roughly from 3,000 to 25,000 euros net, as evaluated by the specialist platform pentesto, last reviewed on 25 August 2026. A web application with a login and two roles, tested greybox with a report and a limited retest, is placed by the same evaluation at around 5,000 to 12,000 euros net, explicitly as orientation and not as a quote. Where your case lands in that range is decided by six drivers: the scope of what is being tested, the test depth from the outside in to full insight, whether you supply access, whether there is a retest after the repair, the form the report takes, and whether you have to show the result to a third party. Billing is usually by day rate, as a fixed price, as a packaged test, or as ongoing monitoring on a monthly fee, and each of the four sets a different incentive. The biggest cost driver is not the testing itself, it is the scope nobody bounded beforehand: test without a clear boundary and you pay for search time instead of test time.
In my own business this work is done by an AI employee, with its own frame per engagement instead of a list price. More on that below. How such a test runs step by step is in Website Security Audit: Steps and Checklist; this post is only about what drives the effort. How I work out the cost of AI employees generally is in What an AI Employee Really Costs.
Three things that often get lumped together
Before you compare numbers, compare the service. A vulnerability scan is a largely automated run against known patterns, cheap and easy to repeat. A security audit also examines configuration, processes and evidence against a benchmark you agree beforehand. An authorised penetration test goes further and tries to actually exploit what it finds inside the agreed frame, which is why it needs the most manual time and the clearest written approval. The ranges above are for the third case. When two quotes are far apart, it is often not the price talking but the fact that they are offering two different ones of these three.
Why the question gets answered with questions
The Penetration Testing Execution Standard, one of the methodologies listed in the Web Security Testing Guide from the OWASP Foundation, has seven phases. The first is called "Pre-engagement Interactions", the alignment before the engagement. Not recon, not the scan. Clarifying comes first, because without a clarified scope nobody knows how much work lies ahead.
The Web Security Testing Guide, which the OWASP Foundation lists in version 4.2 as the current stable edition, defines the scope of an engagement as "the boundaries and the needs of the engagement agreed upon with the organization", so as something agreed rather than something assumed. The same chapter lists the limitations a report should state, among them "lack of time" and "lack of access or credentials". The guide means the report's weight there. Read from the cost side, though, the same lines answer the price question: time and access are not side conditions, they are the price.
From that follows the point this whole post rests on. A tester who does not know where your system starts and stops begins by searching. They turn up secondary addresses, old test environments, a forgotten portal, and for each of those they have to ask you whether it belongs in scope. You pay for that search time, and it buys you not one tested sign-in flow. The hour you spend beforehand listing your own addresses and applications is the cheapest one in the whole project.
The six drivers of effort
The first two rows are connected, and that is where the price is decided. The Web Security Testing Guide splits a web application into twelve test areas, from information gathering to API testing. How many of them apply depends on your application: where there is no login, the areas on identity management, authentication, authorisation and session management fall away. That is not sloppiness, that is scope. Which test stages exist is set out in the process guide.
The sixth point is the one that arrives too late most often. If a client is asking for the test, ask them beforehand what they expect: whether a report is enough or whether they require a particular methodology makes a difference to the effort.
The four billing models and their incentives
Two sentences to place these. Day rate and fixed price differ less in price than in who carries the risk of a misjudgement. And ongoing monitoring does not replace a test: monitoring tells you that something has changed, a test tells you whether what is there holds.
How to bound the scope before the quote
These six points you answer yourself, before you ask anyone. They are the difference between three comparable quotes and three numbers that have nothing to do with each other.
- Write down your addresses. All of them under your company name, including the old campaign site and the test environment. What you do not list either gets searched for or left out.
- Say what sits behind the login. Are there accounts, roles, uploaded documents, payments? That determines which test stages make sense at all.
- Decide whether you supply access. Test accounts per role, ideally in a test environment. This is the point at which the same test gets faster and deeper.
- Set out what will not be tested. Third-party services your site merely connects to are not yours, and as a rule may not be tested.
- Say who reads the report. Your developer, your management, a third party. That sets the report format and with it part of the price.
- Ask for the retest in the same quote. Not later as an add-on.
How to turn these points into a written commissioning is in the process guide. One note, practical rather than legal: permission to test comes from the operator of the system. I am not a lawyer, and this is not legal advice.
How to spot a bad quote
An automated scan sold as a test. Automated tools belong in a test, but they are one phase of it, not the test. The operator of a well-known free online scanner says so under its own results: "Remote scanners have limited access and results are not guaranteed", and further, since the scanner only sees what is visible at browser level, "it will not detect anything on the server-side". Anyone handing you a scanner printout as an audit report is selling you tool time as test time. The tell in the quote: nowhere does it say how many hours of manual testing are included.
A fixed price with no knowledge of the scope. If the first conversation contains not one question about addresses, logins, roles and access, but a sum arrives the next day, then that sum is either padded with a large buffer or priced for a scope the provider invented for themselves. You pay for both. Ask which scope the number is based on, and have it written into the quote.
A report without reproduction steps. The Web Security Testing Guide lists, per finding, a description covering, in its words, "how to exploit it", and explicitly "detailed steps on how to remediate the vulnerability". A finding without the path to it is not reproducible for your developer, and without a fix suggestion it is homework you have to commission separately. Ask for a sample report before commissioning, an anonymised one is fine. Anyone who cannot show one does not have one.
No retest. If the quote ends at handover, it ends before the result. In my experience the retest is the smaller item, because it follows the reproduction steps from the report instead of searching again; that is experience, not a general pricing rule. If it is missing from the quote, ask what it costs before you sign, not after.
And the free offers?
Free online checkers are an honest way in as long as it is clear what each individual one covers. They are not a uniform class of product: one rates the certificate and the encryption, the next the security headers, the third looks for malicious code in the delivered source and for blocklist entries. Which tool answers which of those questions is compared in Check Your Website Security Online; the certificate on its own you check with How to Check an SSL Certificate.
What none of the outside views reach is everything behind the login, everything happening on the server and the flaws in your application's business logic. A free scan is therefore not a small pentest, it answers a different question. The sensible route: scan yourself first, fix the obvious, and spend the paid test time on what a tool cannot see. And if you get stuck clearing the obvious items, that is a good question for the community before you buy test time for it.
Why there is no list price for Falk
In my business this work is done by Falk, my AI employee for security. He tests in stages, from recon with no access at all, through the view of an unauthenticated visitor, to, where I approve it, access or insight into the source code. Every finding comes with evidence, a CVSS rating and a concrete fix.
Every engagement gets its own frame and its own written approval for exactly the system being tested. Before the first request goes to a target system, that approval is in place, a fixed gate and not a formality. The automated part runs throttled at no more than 20 requests per minute, with no load or stress testing and no trying out credentials. Instability, unexpected data access or a target belonging to a third party stop the test on the spot.
That is precisely why he does not exist as a ready-made package with a price tag: there would be an off-the-shelf test only if there were an off-the-shelf system to test. What he does in detail, and where I hold him back, is on Finding Security Flaws: Meet Falk. The advantage of building it this way is not the price, it is the frame: the scope is settled before the first request, and that is the same point at which the price is decided above.
Frequently asked questions
Why do some providers publish a price and others do not?
Both happen. There are providers with package prices, published day rates or an online configurator that produces a fixed-price quote, and there are providers who name a range only after a first conversation. That is not what makes them serious. The question is whether the scope, the test depth, the limits and the retest are described alongside the price. A fixed price with a clean scope is more solid than a range without one.
Is a day rate more expensive than a fixed price?
Not as a rule, the two just distribute the risk differently. On a day rate you carry the risk that it takes longer, on a fixed price the provider carries it and prices in a buffer. The clearer the scope, the smaller that buffer and the more a fixed price pays off. On unfamiliar ground a day rate with a cap is usually the fairer route.
Is there such a thing as a free security audit?
Free online checkers exist, and for the view from outside they are usable, each on its own question: certificate, headers, malicious code in the source, blocklists. What sits behind the login, what happens on the server and flaws in business logic they do not see. Use them as a first step and do not set them against a commissioned test.
How many test days do I need?
That cannot be said without your scope, and that is exactly what the provider should be asking about. The answer is usable when it can be broken down: this much for the view from outside, this much for the area behind the login, this much for the report and the retest. Insist on that breakdown in the quote, then two quotes can be compared at all.
Is the retest included in the price?
Sometimes yes, sometimes no, and it rarely says so clearly in the quote. Ask for it explicitly, together with the deadline: how long after handover the retest still runs at the agreed price. It works through the repaired findings along the reproduction steps from the report and is therefore generally faster than the first pass.
How to take it further
Put the six points from the scope section on one sheet before you have the first conversation. Then get three quotes against exactly that sheet and compare them at four places: manual test time included, test depth, sample report and retest. If a quote dodges any one of those four, you have your answer without looking at the sum. And if you want to go the step beyond that, an AI employee who runs a test like this for you with its own frame and its own approval: the route there and the ready-made roles are in my community Claude Practitioners.
