How Much Does a Penetration Test Cost?

Penetration tests are a popular service for verifying the security of IT systems. This is reflected in the increasing demand for these security audits in recent years. More and more companies are integrating these tests as a matter of course into their product development process, just as no car today drives on the road without having passed a crash test. Many companies no longer ask why do I need a penetration test? but rather "how much does a penetration test cost me?".

What do you have to pay for a penetration test?

When choosing from various penetration testing companies on the market, buyers and IT managers wonder what penetration tests cost them. The good news for clients: the price of a penetration test is usually not based on the value of the test to the client. This is because, if serious security vulnerabilities are found, the value is almost priceless. In the case of Yahoo!, the purchase price that Verizon was willing to pay is said to have decreased by 1 billion US dollars following the revealed hacks. Penetration tests are usually calculated as a service based on the effort, i.e., the consultant days budgeted for the test.

The cost of a penetration test depends on various factors

The calculation of the effort for a penetration test depends on several factors. These are:

Test object

The type and complexity of the test object have a significant influence on the final price of a penetration test. For example, there is a difference between whether an entire organization with several hundred employees and various IT systems is to be subjected to a penetration test, or whether a simple web application is to be tested as part of a focused web penetration test.

Pentest modules

The test modules are defined prior to the penetration test. For a web application, for example, only the program code and configuration could be examined, or additionally the IT infrastructure on which the web application is hosted. An extension of the scope would be to examine the deployment system and other development systems. As an alternative to clearly defined test objects and modules, there is the "Red Teaming" or "Tiger Teaming" variant of the penetration test, where the testers are given a free hand in choosing their means and goals for penetrating a system.

Test configuration

Once the scope of the penetration test has been determined, the specific design must be configured, which can also have an impact on the effort. A Black Box test can sometimes be more time-consuming if it is to deliver the same number of found vulnerabilities as a White Box test. If a test is not only carried out from the outside, from the Internet, but additionally from the internal network, the effort also increases.

Desired security level

The final influencing factor is the desired security level. The number of vulnerabilities that a hacker — whether White Hat or Black Hat hacker — finds correlates directly with the time available. A longer test therefore usually leads to a more comprehensive examination of the test object and thus a higher security level.

Don't compare apples to oranges

If the prices of different providers deviate strongly from each other, one reason could be that some providers mistakenly use the term penetration test for simple vulnerability scans . Scanners can only uncover known vulnerabilities and do not provide information on whether the found vulnerabilities can actually be exploited. They are often used at the beginning of a penetration test to obtain an initial overview. However, in the further course, the expertise and creativity of the individual penetration testers determine the quality of the results.

Conclusion: Penetration tests as time-boxed audits

Penetration tests are time-limited security audits. The price of this service is therefore calculated based on the estimated time budget and the individual daily rate of the penetration testers. Experience shows that the time effort for a penetration test for a clearly defined test object starts at three days and can take up to twenty days for complex test objects with high security requirements. The usual daily rates of professional penetration testers currently range from 1,400 to 2,200 euros, resulting in a price range of 4,200 to 44,000 euros for a targeted penetration test.

Contact us and describe your starting situation to receive an offer for a penetration test from us.