The honest answer is "it depends", but the range is wide enough that "it depends" isn't useful. A single web application test can be quoted anywhere from $400 to $40,000. This post is about why, and how to land on the right number for what you actually need.
The three pricing models
Time-and-materials. A firm estimates days of effort and multiplies by a day rate (commonly $1,500–$3,000/day for senior testers). You are buying hours, and the scope is whatever fits in them. This is the default for boutique firms and the reason quotes take weeks — someone has to scope the hours.
Managed program / subscription. Platforms like HackerOne and Bugcrowd price around continuous coverage: a base fee plus bounties or per-test costs. Good if you have ongoing surface and a security team to run it. Heavy if you need one scoped test for an audit.
Fixed-scope. A defined deliverable — "up to 25 endpoints, unauthenticated plus one role, findings list, one retest" — at a set price. You trade some flexibility for a number you can see before you talk to anyone. This is the model Pentest Market uses; entry tiers run $400–$900.
What actually drives the number
- Surface size. Endpoints, roles, tenants, integrations. A 40-operation API
is not a 400-operation API.
- Depth. A known-issue sweep is cheap. Business-logic review, tenant
isolation testing, and an attack-path narrative cost more because they're manual and slow.
- Authenticated vs unauthenticated. Every additional role roughly adds a
pass.
- Retests. Verifying fixes is a second, smaller engagement. Bundled tiers
include it; hourly quotes often don't.
- Reporting rigour. A report an auditor will accept, with reproductions and
remediation guidance, is part of the cost. A raw scanner export is not a pentest.
Typical ranges by scope
| Scope | Fixed-scope range | Boutique T&M range |
|---|---|---|
| Small web app, 1 role | $400–$1,800 | $6,000–$15,000 |
| REST/GraphQL API | $500–$1,900 | $8,000–$20,000 |
| External network /24 | $600–$2,400 | $10,000–$25,000 |
| Internal / AD assessment | $900–$3,200 | $15,000–$40,000 |
The fixed-scope column isn't cheaper because the work is worse — it's cheaper because the scoping overhead, sales cycle and account management are removed, and the deliverable is bounded up front.
How to choose
If you need a scoped test for a SOC 2 or ISO 27001 audit, a customer security questionnaire, or a pre-launch check, a fixed-scope test at a visible price is usually the right call — see the SOC 2 checklist. If you have continuous surface and a security team, a managed program earns its keep. If you have a novel, high-stakes system — a new protocol, a payments core — pay for boutique depth.
Red flags in a quote
- No named methodology or standard (OWASP, PTES).
- "Automated scan" doing most of the work.
- No retest included or offered.
- The report is a tool export with a logo on it.
- The price can't be explained in terms of surface and depth.
You should be able to read a quote and see what you're paying for. On a fixed-scope marketplace that's the default: the gig page states the tier's surface, depth and delivery time before you order.