Guide

How We Scope and Price a Pentest

Understand what changes the price, what your quote should include and how to compare assessment proposals.

A useful pentest quote describes a bounded piece of work. The price depends on the application’s size, distinct roles, critical workflows, integrations, test environments and the depth of review.

Our starting points

These are starting prices for agreed scopes, not a market average or a promise to test unlimited assets. We confirm the final fee, schedule and deliverables before work starts.

Information that makes a quote useful

• Applications, APIs and environments in scope.
• User roles and access available to the testing team.
• Important flows: login, recovery, payments, refunds and administration.
• Release or procurement deadline and permitted testing windows.
• Any source review, mobile testing or infrastructure work required.

Compare deliverables as well as prices

Ask for a sample report. Check that findings include reproducible evidence, impact and remediation guidance, and that the report records what was tested and what was excluded.

Plan for remediation

Agree who will triage findings, how urgent issues will be communicated and when fixes can be retested. DEEP and TOTAL include retesting within the scope and period stated in the proposal. New features and expanded assets require separate scoping.

Start at the right depth

Use RECON for an external surface review. Choose CORE for a focused application assessment. DEEP and TOTAL support broader work across connected components. A small engagement can be useful, but it is not a prerequisite if you already know the full scope you need.