How Much Does a Pentest Cost for an SMB? (2026)

What moves the price#

A penetration test is priced like any other piece of specialised work: time, risk, and the size of the thing being tested. For a company with one product and a small team, the variables are concrete.

• How many applications. One customer-facing web app is not the same purchase as that app, its admin console, and the API both of them call.
• How many roles and tenants. Proving that a support user cannot read a customer's invoice needs accounts for both, and the combinations grow faster than the account count.
• Authenticated or anonymous. Anonymous testing sees what a stranger sees. Authenticated testing needs test accounts, someone available during the window, and a decision about the data those accounts can reach.
• How well the surface is documented. An OpenAPI specification and a staging environment that mirrors production save reconnaissance hours. An undocumented legacy application spends them.
• The window. A test squeezed into a maintenance weekend carries a premium, and so does one with a hard deadline: the tester cannot follow a lead that turns out to be a dead end and simply start again next week.
• The report. A findings list is one deliverable. The same list mapped to PCI DSS, or to a customer's security questionnaire, is another, with its own review time attached.
• Cadence. One engagement a year is a snapshot. Two, or a quarterly rhythm, changes both the per-engagement rate and how much context the tester carries over.

Headcount appears nowhere on that list, and it is a poor proxy. A twenty-person company with three applications and a payment flow can need a wider scope than a two-hundred-person company running one internal tool.

Published rates, and what they cover#

Every figure below was read on the page named, on the date named. They stay in US dollars, including on the French version of this page: we do not run a euro price grid.

The manual figures are ranges because they describe a market, not a price list. Anyone who quotes you a single number before reading your scope is quoting the meeting.

Why two quotes for the same application differ#

Four questions separate most of the gap.

First, what the scope names. "Web application" can mean one hostname, or a product spread over an app, an admin panel, a marketing site and two API versions. Second, black box or grey box: a tester given documentation and a test account finishes sooner, and finds different things, than one who starts from a URL. Third, whether exploitation is attempted or suspected weaknesses are only listed. A report full of "may be vulnerable" costs less to produce and less to act on. Fourth, the retest. It is the only part of the engagement that tells you whether the fix worked, and it is frequently the line that gets cut.

A habit worth adopting: write a one-page scope, send the same page to both vendors, and ask each one to mark what it would exclude. The exclusions are where the quotes actually differ.

Per Application, per Asset, or per Scan: How Vendors Charge#

Continuous testing is billed on three different units. The unit, not the headline price, decides what you pay over a year, and vendors rarely put it in the same column of a pricing table.

Per application, per engagement. A consultancy quotes one application for one engagement. The ranges above are per engagement, not per portfolio: five applications means five scopes, run in sequence or bundled into a retainer with a discount. Our own scan follows the same unit, one credit for one target application, and the plans are published.

Per asset. Continuous exposure platforms charge an annual platform fee by tier, then bill the scanning separately, per domain or per target. The bill follows the size of your external footprint: more subdomains, the same depth on each one. Detectify prices this way, and the Detectify comparison carries its published tiers, the per-domain units and the date they were read.

Per scan. Cost follows cadence rather than footprint. Testing one application every week costs the weekly rate, and a second application is a second scan rather than a second subscription. That is the trade a per-scan model makes, and it is the one that gets expensive only when you want breadth and high cadence at the same time.

The arithmetic is worth doing on your own numbers. Five applications tested weekly come to 260 scans over a year, which is $12,740 at the founding rate and $20,540 at the standard rate. On a per-asset model the same five applications might be twenty hosts, each billed whether or not the code behind it changed. The scan pricing breakdown walks through the three units side by side with the competitor figures we could verify.

What each model buys#

A manual engagement buys a person's judgement for a week or two: someone who can decide that a broken approval step matters more than a missing header, who can chain two small weaknesses into a real path, and who signs a report your customer's procurement team will accept. It is also the only route when a framework asks for an independent, qualified tester. The penetration testing page sets out what such an engagement covers and, more usefully, what it excludes.

An automated scan buys repetition and evidence. It runs on the deploys between engagements, and the finding that reaches you comes with the request that produced it, which turns triage into a five-minute job instead of an afternoon. What an automated pentest finds and misses is the honest version of that trade.

The annual figures are quick to compare. A weekly cadence on one application is 52 scans, so $2,548 a year at the founding rate and $4,108 at the standard rate, against $5,000 to $30,000 for a single manual engagement. That comparison is not the whole story, because the two are not the same product. It does explain why teams that already buy an annual engagement keep scanning between them.

What this page does not price#

Vendors that publish no price list are absent from the table, and so is any figure we could not re-read on the vendor's own page the day we published. Copying a competitor's number out of a comparison article, or out of a planning document, produces a plausible table and a bad one. If a price you were counting on is missing here, that is the reason.

Sources#

• Blaze InfoSec, "How much does penetration testing cost" and Deepstrike, penetration testing cost, read 15 October 2026: the $5,000–$30,000 band for a web application or SaaS engagement.
• Invicti, penetration testing pricing guide, read 15 October 2026: $5,000–$30,000 for internal network testing and $4,000–$20,000+ for web applications and APIs.
• Software Secured, penetration testing cost, read 15 October 2026: manual engagements quoted from $5,000 to $100,000 or more depending on scope.
• breachvex.com/pricing, read 23 October 2026: our founding and standard scan prices, and the monthly packs.
• Penetration testing: what a test covers, published 19 October 2026: the scope vocabulary used above, and the compliance boundary.

Next step#

Scope first, price second. Send /penetration-testing to whoever is quoting you, because the exclusions listed there are the ones that should appear in their scope document.

Our own prices, including the founding rate and what the standard rate becomes afterwards, are on the pricing page. BreachVex is in early access, so access opens by invitation: join the waitlist and we will write when yours opens.