How much does
a pentest cost?

No two engagements are quite alike. The amount of work depends mainly on:

• The size of the scope: a single web app is a few days; a full information system, more.
• Complexity: number of features, roles, APIs and technologies involved.
• The level of information provided: a black box costs reconnaissance time that a grey box saves (see the types of tests).
• The depth expected: a simple demonstration of exploitability, or the widest possible coverage.

Every engagement is quoted at scoping, but here are indicative benchmarks, based on the €1,100 day rate:

• A brochure site or a small web app: often 2 to 4 days, roughly €2,200 to €4,400 (excl. VAT).
• A business application or an API with several roles: usually 5 to 8 days (€5,500 to €8,800 excl. VAT).
• A full infrastructure or information system, multiple targets: 8 to 15 days depending on scope.

These are only orders of magnitude: the exact number depends on the real size and complexity, agreed together before the quote. The goal is never to inflate the days, but to properly cover what matters.

After a scoping conversation, you receive a written proposal: scope, approach, estimated number of days and price. No hidden cost, no surprise along the way. The debrief and the retest of fixes are part of the engagement — a penetration test that doesn’t verify the fixes has only proven half the job.

I’d rather have a well-scoped, genuinely testable perimeter than an oversold quote: better to cover what matters properly than skim over everything.

The same day rate of €1,100 (excl. VAT) applies when reinforcing your teams as a subcontractor: web, API, cloud, Linux, Android and hardware scopes, report in your format. Write to me to discuss needs and availability.

Hesitating between an audit and a penetration test? It’s explained here. The FAQ covers the rest (timelines, confidentiality, area).