How much does a penetration test cost in 2026? Real price ranges and what drives them

Short answer: in 2026, a professional penetration test of a web application or API typically costs $16,000–$70,000 in the US and €8,000–€40,000 in Europe. AI/LLM applications and complex multi-tenant SaaS sit above that range, and red team engagements start in six figures. Below roughly $2,000 you are almost always buying an automated scan with a pentest label.

It is the question we get before any technical conversation, and the honest answer — "it depends" — helps nobody build a budget. So let’s open the math: what the price is made of, market ranges by test type, what drives cost up, what brings it down without cutting quality, and the signs that a quote is too cheap to be real.

What a penetration test price is made of

Pentesting is expert labour. The cost is essentially specialist days × day rate. A senior pentester’s day rate is typically $2,400–$5,000 in the US and €1,400–€2,800 in Europe, depending on the firm.

What decides how many days the work takes is the testable attack surface: how many features, endpoints, user roles and integrations exist, and how deep the test must go. A contact form and a checkout with coupons, subscriptions and split payments do not cost the same to test, even on the same domain.

Be suspicious of fixed prices "per website" or "per IP" that come without a single question about what sits behind the login. A vendor that does not ask about scope is pricing a tool, not a test.

Market ranges by test type (2026)

Reference values for manual work by experienced professionals. This is not a price list — use it to calibrate quotes.

Test type	Typical effort	US range	Europe range
Automated scan / external assessment	hours	free–$2,000 (not a pentest)	free–€1,500
Small web app (1–2 roles)	4–7 days	$16,000–$30,000	€8,000–€16,000
Mid-size web app / multi-tenant SaaS	8–15 days	$30,000–$70,000	€16,000–€40,000
REST/GraphQL API (up to ~80 endpoints)	5–12 days	$20,000–$60,000	€10,000–€30,000
LLM, RAG or agent application	6–15 days	$24,000–$80,000	€14,000–€44,000
Mobile (app + backend API)	8–15 days	$30,000–$70,000	€16,000–€40,000
Red team / adversary simulation	4–12 weeks	$120,000+	€80,000+

Web and API testing almost always go together — a modern SPA is an API with a UI, and a good scope covers both layers. Tests required by a standard (PCI DSS, SOC 2, DORA) add methodology and reporting requirements; see what assessors expect from a pentest report.

The 7 factors that move the price most

1. Authenticated functionality. That is where critical findings live (authorization, business logic). Every meaningful flow — payments, user invites, data export, admin panel — adds time.
2. Number of roles and tenants. Testing authorization needs at least two users per role. Five roles across two tenants is a much larger matrix than "user and admin".
3. Black, grey or white box. Grey box (with documentation and accounts) is the best value: the tester spends time attacking, not rediscovering what your team could have told them. See what penetration testing is and its types.
4. AI in the product. Chatbots, copilots and agents bring a new vulnerability class — indirect prompt injection, agent tool abuse — that needs specific technique.
5. Environment. A stable staging environment with realistic data speeds things up; production with narrow windows slows them down.
6. Reporting and compliance requirements. Executive summaries, mapping to SOC 2, ISO 27001 or PCI DSS, and formal attestation letters cost time.
7. Urgency. Starting tomorrow to meet Friday’s audit means reshuffling a team. Booking 2–4 weeks ahead is usually cheaper.

Signs a quote is too cheap

• No estimate of days and no word on who will do the work.
• A 24–48 hour report for an entire application. Real manual testing does not fit there.
• Methodology reduced to tool names. We explain the difference in pentest vs. scanner vs. bug bounty.
• No questions about roles, business rules or integrations.
• Retesting billed separately with no defined window.
• A generic sample report full of "server version disclosed" and missing headers, with no exploitation chain.

A $2,000 test that produces 80 pages of informational findings is more expensive than a $50,000 one that finds the BOLA exposing every customer’s data.

How to lower cost without lowering quality

• Choose grey box. Hand over the OpenAPI/Swagger spec, a Postman collection and test accounts per role.
• Prioritise by risk. Start with what moves money, personal data and privileges.
• Prepare the environment. Accounts created, test MFA configured, sample data loaded, tester IPs allowed through the WAF.
• Run a free external check first and fix the basics before paying someone to point them out: External Security X-Ray.
• Put the retest in the contract.

One-off or continuous?

An annual pentest fits stable products and audit cycles. If you ship features every week, the report ages within months; a recurring model — smaller cycles per significant release — keeps risk covered for longer at a similar yearly spend.

The cost of not testing

IBM’s Cost of a Data Breach report (2025) puts the global average cost of a breach at $4.44 million. For most B2B companies the more immediate cost is commercial: enterprise customers ask for a recent pentest report during procurement, and a deal stalls when you cannot produce one.

How Pentest Machine prices

After a short scoping call we send, within 24 hours, a fixed-price proposal with estimated days per track (web, API, AI), who will run it and what is out of scope. Retesting of fixed vulnerabilities is included. Before hiring any vendor — us or someone else — use our checklist for hiring a pentest.

Frequently asked questions

How much does a penetration test cost for a small business?

For a small application with few roles, a serious manual test usually costs $16,000–$30,000 in the US or €8,000–€16,000 in Europe. On a smaller budget, start with an external assessment and a focused test of your most critical feature.

Is penetration testing billed hourly, daily or per project?

Effort is estimated in specialist days, but reputable firms quote a fixed price per project with a defined scope.

How often should we run a pentest?

At least annually and after significant changes — explicitly required by PCI DSS and expected by SOC 2 auditors, ISO 27001 and DORA.

Is the retest included?

It should be. Check the window for requesting it and whether it produces an updated report you can show auditors and customers.