How much does a pentest cost?

To ensure that your business is protected from possible cyber attacks, you need to take various security measures. After all, cybersecurity should be an essential part of any business. Pentesting has proven to be the best method for detecting vulnerabilities and potential security breaches. Penetration testing is an important risk management tool, along with vulnerability scanning and security testing.

What is a pentest?

Penetration testing (pentests), or pentesting, is like a general inspection of your car, except instead of a car you diagnose the security of your applications. To do so, you hire white-hat hackers (often called ethical hackers), which are good hackers that find vulnerabilities in your system or app. In the end, customers will get a thorough report with the level of severity of each security vulnerability and a recommendation on how to fix them. After fixing all the bugs, the customer can get a re-test to make sure that all the vulnerabilities have been fixed. A re-test is sometimes offered for free, sometimes costs a small sum (often 5-20% of the pentest cost).

Penetration tests uncover the current technical state of an application and its infrastructure and examine it for technical vulnerabilities. A pentest is always a snapshot, so it never guarantees the complete security of an application.

In order to constantly increase the level of security in your company, it is necessary to ensure that all discovered vulnerabilities are identified and continuously remediated. Penetration testing helps mitigate cyber risks by simulating mischievous attacks and data breaches through ethical hacking, thereby determining if your incident response and data security controls are adequate, functioning properly, and can withstand a breach.

How does a penetration test actually work?

Together with your pentester (preferably requestee’s pentesting partners), you develop a scope that includes your security objectives, test plans, and any regulatory or contractual requirements for your organization.

Testing can include external testing to uncover IP address issues, web application vulnerabilities, and more. They can also involve internal tests that analyze your network devices and operating systems to uncover internal vulnerabilities such as weak passwords, outdated software, poorly coded websites and insecure applications.

However, many companies ask themselves the question: What does a penetration test cost? What are the most important cost factors? First of all, you should know that the price of a pentest always depends on the type and method.

So, let’s have a look.

‍

How much does a pentest cost and what influences the pentest price?

1 Applications

Application penetration testing (e.g. mobile app pentesting or web app pentesting) is an ethical cyber attack that reveals how secure your application is by showing the risks posed by actual exploitable vulnerabilities. A common approach is to consider all avenues of security risk investigation, including internal and external testing.

Cost drivers: white/grey/black box pentest, number of roles, number of APIs, number of IP addresses, aim of testing.

Average cost of a pen test: starting at 3.500€

2 Network

Vulnerabilities in your networks, systems and network devices are identified and exploited through network penetration tests. They include firewall bypass tests and DNS attack tests.

Cost factors: white/grey/black box pentest, complexity of the network, number and type of services to be scanned (IPS, scans of routing problems, port scans, services such as FTP, MySQL, SSH, etc.).

Average cost of a pen test: starting at 4.000€

3 Payment Card Industry (PCI)

During a PCI penetration test, a real attacker can actually compromise the environment containing cardholder data. If your company accepts credit cards, you should definitely consider this pentest. It must not just consist of a vulnerability scan. An actual attack must be attempted!

Cost drivers: Size and type of the system.

Average cost of a pen test: starting at 5.000

‍

There are other types of pentest, such as wireless penetration test and IoT penetration test.

If you need more information, please feel free to contact us.