What does a pentest cost?

The cost of a penetration test is determined by the question the test has to answer. A straightforward check of a small internet-facing environment calls for a different approach than an assessment of a customer portal, API, cloud environment or internal network. The price therefore follows from scope, depth, complexity and the level of assurance the organisation requires.

DeepBlue Security & Intelligence carries out penetration tests with senior specialists. They combine technical depth with experience in government, vital sectors and large corporate environments. That does not make a test cheaper per hour, but it does make it more efficient in time, execution, analysis and reporting.

A good penetration test consists of more than the test days themselves. Preparation, scoping, rules of engagement, execution, reporting, alignment and aftercare together determine the quality of the result. At DeepBlue these components are included in the quotation, so the organisation knows in advance what it receives.

Why is there no fixed price for a penetration test?

A penetration test is not a standard product. The objective is to establish whether vulnerabilities are present and which of them can actually be exploited, what impact that has and which mitigating measures are required. That calls for a test approach that matches the environment, the business processes and the risk profile.

Two applications can look comparable from the outside. One contains only a login and a few forms, while the other holds multiple roles, tenants, API connections, payment flows and administrative functions. The second environment has more attack paths and therefore takes more time.

A fixed price without a substantive scope often leads to the wrong assumptions. The test then becomes too narrow, too shallow or unnecessarily broad. A careful quotation process makes visible which components are examined, which assumptions were made and where the limits of the test lie.

Which variables determine the cost?

The most important variable is the scope. It determines which applications, IP addresses, APIs, cloud environments, VLANs, user roles, mobile apps, integrations and management interfaces fall within the test. The larger the scope, the more time is needed for inventory, attack paths, validation and reporting.

The second variable is complexity. Authorisation, business logic, single sign-on, multi-tenant architecture, API integrations, file uploads, payment processes, Active Directory, Microsoft Entra ID and cloud permissions require manual analysis. These components can only be assessed to a very limited extent with automated tooling alone.

The third variable is the test type. A black box test provides little prior knowledge and simulates an attacker from the outside. A grey box test uses limited information and therefore tests depth more efficiently. A white box or crystal box approach can include source code, architecture information and configurations.

What does a professional penetration test contain?

A professional penetration test starts with preparation. The objective, confidentiality, scope, test windows, contact persons, indemnity, stop conditions and escalation arrangements are recorded in advance. This prevents ambiguity during execution and ensures that critical findings reach the right people immediately.

Technical execution follows. Testing can consist of discovery, manual analysis, exploitation, validation, privilege escalation, lateral movement, session analysis, authorisation tests and review of business logic. The exact method depends on the type of environment and the agreed rules of engagement.

Reporting translates technical findings into operational consequences. Executive stakeholders receive a clear picture of impact, likelihood and priority. Technical teams receive reproducible evidence, concrete technical remediation guidance and enough detail to resolve vulnerabilities precisely.

Why does DeepBlue work with senior penetration testers?

Senior testers recognise attack paths faster and validate findings more carefully. They know when a vulnerability remains theoretical and when it leads to access, data loss, fraud or disruption. Test time is therefore spent on risks that are demonstrably relevant.

Experience shows above all in complex environments. Consider authorisation flaws between user roles, abuse of API chains, cloud permissions, identity flows, network segmentation and connections with third parties. These vulnerabilities require judgement, context and technical depth.

DeepBlue works exclusively with senior specialists. The hourly rate can be higher, while the total cost can work out more favourably through efficient execution, less noise and better prioritisation. The organisation pays for demonstrable risks, clear choices and remediation guidance that can be applied directly.

What is the difference between a penetration test and a scan?

A vulnerability scan looks mainly for known vulnerabilities, missing patches and recognisable configuration errors. That is useful for periodic checks, but it gives limited insight into exploitability and business impact. A scan usually does not prove how far an attacker can get.

A penetration test is manual and investigative. The tester uses tooling where that is efficient, but then assesses context, coherence and exploitability. The aim is not to collect as many alerts as possible, but to make relevant risks demonstrable for the organisation.

This difference matters when comparing quotations. A low price can suit a limited scan or quick test. A penetration test with manual validation, reporting and aftercare requires more specialist knowledge and more time.

Why a CCV certification?

The CCV Pentest quality mark does not claim that a certified test is technically better than every non-certified test. The mark focuses on demonstrable process quality, qualifications, file build-up, working method and quality management. That gives clients something to hold on to in a market where quality is not always easy to assess.

DeepBlue is CCV certified for penetration testing. This means that preparation, execution, reporting and record keeping take place within a controlled quality framework. Technical quality still depends on the people who carry out the work, their experience and their ability to translate findings into demonstrable risk.

Certification also costs time and discipline. Quality has to be demonstrable, not merely promised. That quality assurance forms part of the way a professional penetration test is prepared, executed and reported.

How is a quotation built up?

A quotation starts with a technical intake together with the client and a senior tester. In that session the research question, scope, technical details, assumptions and limits of the test are established. It also determines what the organisation needs to know once the work is done.

The scope is then translated into the test time required. Factors include the number of objects, the complexity of functionality, the number of roles, the documentation available, the preferred test type and the required reporting depth. Alignment and aftercare are included as well.

A transparent quotation makes the applicable assumptions visible. If the intake shows that the environment is larger, more sensitive or more complex than expected, the scope is adjusted before the test starts.

What does the organisation receive afterwards?

The organisation receives a report covering scope, method, findings, risk assessment, evidence and remediation guidance. Critical findings are not shared only at the end, but escalated during the test according to the agreed arrangements. The team can therefore take measures immediately.

Aftercare is part of a mature penetration testing process. Findings are explained, technical teams can ask questions, priorities are aligned with risk and feasibility, and a retest can establish whether measures have been implemented effectively.

A penetration test therefore delivers more than a list of vulnerabilities. The result is a substantiated picture of current resilience, concrete improvements and technical evidence for decision-making. For a CISO that is the basis for priority, budget and accountability.

How does an organisation compare penetration testing quotations?

Quotations should be compared on content, not on total price alone. Key questions are which scope is included, how much manual test time is available, which qualifications the testers hold, how findings are validated and which aftercare is covered.

The report matters as well. A good report makes exploitability, impact, priority and remediation clear for both management and technical teams. Findings are assessed using the CVSS methodology, supported by context on business impact, attack path and a practical remediation order.

The cheapest quotation is not automatically unsuitable. The most expensive quotation is not automatically the best. The right quotation demonstrably matches the initial question, the environment and the risk the organisation wants to have tested.

Conclusion

The question of what a penetration test costs can only be answered carefully with insight into objective, scope and complexity. A professional test requires preparation, manual execution, technical validation, reporting and aftercare. Together those components determine the value of the assessment.

DeepBlue deliberately chooses senior specialists, clear scope agreements and CCV certified delivery. The result is a penetration test that does not just name vulnerabilities, but substantiates risk and makes remediation practical. The price of a quotation is therefore not a loose calculation, but a translation of the assurance the organisation needs.

Sources

Last reviewed: 14 August 2026.