If you are a founder or engineering lead at a SaaS company, you have probably Googled this exact question and ended up with a range so wide it felt useless. One vendor quotes €3,000. Another quotes €40,000. Both are technically telling the truth.
The honest answer is that penetration testing is a service, not a product. The price tracks the hours a human spends, which means the number depends on scope, depth, and how the vendor bills rather than on a fixed menu. Two companies can receive wildly different quotes for what sounds like the same test because they asked for different things.
This guide explains what the different price bands actually include, what pushes the number up, and the questions to ask before you sign. It also covers the hidden costs that rarely appear on the first quote.
Key takeaways
- A web app penetration test typically costs €2,000 to €10,000; enterprise engagements run €10,000 to €50,000 or more.
- The price is driven by scope, depth, compliance needs, reporting, and whether retesting is included.
- Many quotes exclude retesting, which means the real cost arrives after you fix the findings.
- An automated scan costs under €500 but misses business logic flaws a human tester catches.
- Day rates, fixed prices, and subscriptions are three different billing models, and they produce very different totals.
The short answer
A web application penetration test typically costs between €2,000 and €10,000, and enterprise engagements run €10,000 to €50,000 or more. An automated vulnerability scan costs under €500. Here is what each band actually buys you:
Automated vulnerability scan
Open-source and SaaS scanners cover the surface: known CVEs, missing headers, and exposed endpoints. They run in minutes but produce noise and miss anything that needs authenticated access or business logic. Useful as a first pass, not as a substitute for a real test.
Web app penetration test
The typical manual engagement for a single SaaS application. A tester spends a few days to a few weeks mapping the app, exercising the auth flow, and probing for OWASP Top 10 issues. Usually includes a written report; often excludes retesting.
Enterprise engagement
Multiple applications, APIs, mobile clients, and internal infrastructure, plus compliance reporting. These run a month or more and involve several testers. The price reflects headcount, not just tooling.
How vendors actually bill
The same test can be quoted three different ways. Knowing which model you are looking at makes the numbers easier to compare.
Day rate
Boutique consultancies charge roughly €1,000 to €3,000 per tester per day. A five-day test at €1,500 a day is €7,500.
Fixed price
The vendor estimates the effort and quotes one number. Predictable, but often padded to cover the vendor's own risk.
Subscription
A monthly or annual retainer for scheduled testing. Cheaper per test over time, but only worth it if you ship often.
What drives the price
Scope and attack surface
One web app is one price. Add APIs, mobile clients, user roles, microservices, and internal tools and the hours multiply. Every extra entry point is more surface for a tester to map before they can even start testing.
Depth of testing
A black-box test of the public site is cheapest. Authenticated testing costs more because the tester has to understand your product. Source-code access adds a layer a scanner cannot reach: auth logic, business rules, and hard-coded secrets.
Compliance requirements
PCI DSS, SOC 2, and ISO 27001 each ask for something different. If you need a report an auditor will accept, expect to pay for the structure and the writing, not just the testing.
Reporting and retesting
A readable report takes real time to write. Many fixed-price quotes quietly exclude the retest that proves the findings were fixed, so the final bill arrives after you have already committed.
Rate model and location
Boutique consultancies charge roughly €1,000 to €3,000 per tester per day. Agencies that resell tester time add a margin on top. Fixed-price quotes shift the estimation risk onto the vendor, which is why they are often padded.
Urgency
A rush engagement, or one that has to fit a customer or fundraising deadline, costs more than a test that can be scheduled three weeks out. Speed is a line item.
How to compare quotes like a buyer
- Ask for the exact scope in writing: domains, user roles, and depth.
- Ask whether retesting is included, and for how long.
- Ask who does the testing: in-house testers or a subcontracted third party.
- Ask what “delivered” means: a PDF, a score, a certificate, or a remediation call.
- Compare turnaround times, not just prices.
- Ask for references from companies in the same industry.
The hidden costs nobody quotes
The sticker price is only part of the total. These are the costs that tend to surface after you have already signed:
- Retesting, which is often billed separately from the initial test.
- Re-scoping mid-engagement when the vendor finds more than they expected.
- Expedited delivery when you need the report for a deadline.
- Compliance-ready reporting for PCI DSS, SOC 2, or ISO 27001.
- The opportunity cost of waiting weeks while a deal or an audit stalls.
Vulnerability scan vs penetration test
A vulnerability scan is automated: fast, cheap, and good at finding known issues such as missing headers, known CVEs, and exposed endpoints. A penetration test adds a human who tries to exploit those findings and reason about your business logic, authentication, and access control. Neither is strictly better. A scan finds a lot, quickly and cheaply; a test goes deeper. Many teams run scans continuously and schedule a manual test at milestones.
What a complete test covers
Whatever you pay, a useful test should cover at least these areas. If a quote does not mention most of them, ask why.
TLS and certificates
Protocol version, chain trust, expiry, HSTS, OCSP stapling, and downgrade resistance.
Security headers
CSP, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy, COOP/COEP.
Cookies and sessions
Secure, HttpOnly, SameSite, scope, and rotation behaviour across your auth flow.
Authentication and MFA
MFA availability, password policy, lockout, and credential stuffing exposure.
Exposed endpoints
Admin panels, debug pages, .git folders, .env backups, swagger docs, and more.
OWASP Top 10
Probes for SQLi, XSS, SSRF, command injection, IDOR/BOLA, and broken access control.
Dependency risk
Known CVEs, outdated packages, suspicious post-install scripts, and license flags.
DNS and email
SPF, DKIM, DMARC, CAA, DNSSEC, and MX hygiene to protect against spoofing.
API security
JWT handling, rate limiting, CORS posture, schema validation, and BOLA heuristics.
Source-code review
When you share a read-only repo, the team reviews auth, input validation, crypto, and secrets.
Frequently asked questions
How much does a web app penetration test cost?
Most web app penetration tests cost between €2,000 and €10,000 depending on scope, depth, and the vendor's day rate.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and finds known issues. A penetration test adds a human who tries to exploit the findings and reason about your business logic. The best results combine both.
How long does a penetration test take?
Traditional manual tests take two to six weeks from kickoff to report. Automated-first approaches can deliver results in a few days.
Do I need a penetration test for SOC 2?
SOC 2 requires regular security testing but does not mandate a specific vendor. What matters is that you can produce evidence of testing and remediation.
How often should I run a penetration test?
At least once a year, and after any major release, new integration, or change to your authentication flow.
What should I prepare before a penetration test?
A production or staging URL, a read-only test account, and a list of in-scope domains. Sharing a read-only repo is optional and unlocks a deeper review.
Is a cheap automated scan enough?
A scan catches known issues but cannot find business logic flaws, broken access control across roles, or authentication bypasses. For anything customer-facing, pair the scan with human review.
If the ranges above feel steep, there are now automated-first options that pair scanners with human review at a fraction of the cost. Our own product, AppCheck, runs 120+ checks across ten coverage areas with every finding reviewed by a person, for a flat €500 per audit delivered in days. It is not a replacement for every engagement, but it covers most of what a SaaS team needs between full tests. See what it checks.