Most small-to-mid-size penetration tests in 2026 land between 4,000 and 25,000 US dollars, depending on scope. Ongoing advisory retainers typically run 2,000 to 10,000 dollars a month. Below is how that number is actually built, so you can tell a fair quote from a padded one.
What you are really buying: consultant-days
Almost every security engagement is priced the same way underneath: number of skilled days multiplied by a day rate. Day rates in 2026 broadly range from about 600 dollars (independent consultants and boutique firms) to 2,500 dollars or more (large-brand firms with heavy overhead). The technical work is often comparable; the brand, the sales team and the office are what you pay extra for.
Typical scopes and day counts
- Small web application (one app, 2-3 roles, no complex logic): 5-8 days.
- Mid-size SaaS platform plus API: 10-15 days.
- Public REST or GraphQL API only: 4-8 days.
- Mobile app (Android or iOS) plus backend: 8-12 days.
- Internal network / Active Directory assessment: 8-15 days.
- Cloud configuration review (single account): 3-6 days.
- Full red team simulation: 20-40 days.
Multiply days by rate and you have the honest price. Ask any vendor how many consultant-days their quote contains — if they will not say, that is your answer.
What drives the price up
- Number of distinct user roles and tenants (access-control testing scales with role combinations).
- Number of endpoints and unique workflows, not number of pages.
- Complex business logic — payments, trading, healthcare, identity.
- Compliance requirements needing specific report formats and attestation letters.
- Retesting rounds included in the quote.
- Tight deadlines and out-of-hours testing windows.
What brings the price down
Good documentation. Give the tester an API spec, an architecture diagram, and working credentials for every role on day one and you save one to two days of discovery — real money.
Sensible scoping. Test your crown jewels properly rather than everything shallowly.
Working with an independent consultant or small team instead of a large firm.
Fixing the obvious first: MFA, patching, secret management, dependency updates. Do not pay expert day rates for findings a free scanner would flag.
Pricing models you will encounter
Fixed-price project — most common and best for a defined scope. You know the cost up front.
Retainer — a set number of days per month for ongoing advisory, design reviews and quick turnarounds on new features. Best once you ship frequently.
PTaaS (penetration testing as a service) — subscription with a platform, continuous scanning and periodic manual testing. Good for continuous delivery teams; verify how many manual days are actually included.
Time and materials — flexible, but insist on a cap.
Red flags in a quote
- An automated-scan-only engagement sold as a penetration test.
- No named consultant or no CV/certifications provided.
- No retest included.
- Price quoted before any scoping conversation.
- A report template you are not allowed to preview.
Is it worth it?
Compare it against the alternative. The average cost of a data breach globally now runs into the millions, and for a startup the real cost is usually the enterprise deal you cannot close without a clean report. A well-scoped test that unblocks one contract has already paid for itself.
---
Need a second opinion on your security posture?
I'm Michael Adeyanju, a penetration tester and security consultant working with companies globally — web app, API, mobile and network security. Based in Lagos, Nigeria, available for remote and on-site engagements worldwide.
Book a 15-minute call: cal.com/michaeladeyanju/15min
See what an engagement covers: michaeladeyanju.com/security-engineer