For a small or midsize business, a penetration test usually costs somewhere between the mid four figures and the low five figures. A pricing guide from testing firm DeepStrike, updated in October 2026, puts a typical external network test at $5,000 to $20,000 and an internal network test at $7,000 to $40,000. Where your quote lands inside those ranges depends on scope, not on a price list.
What you are really paying for is skilled people's time, and every scoping decision adds hours or removes them. This guide explains what drives a quote, the ranges testing firms publish, when a regulation makes testing mandatory, and how to avoid paying test prices for an automated scan. It is written for the owner or office manager who signs the check, not for the tester.
What you are buying when you buy a penetration test
A penetration test is a controlled attack by a skilled person who tries to get in, chain small weaknesses into a real path, and show what an attacker could reach. That human work is what separates it from an automated scan, which lists known weaknesses without proving which ones matter. It is also why the two are priced so differently. If the difference between the two is still fuzzy, our explainer on penetration testing covers it, and everything below applies only to the manual kind.
Most firms price by tester time. DeepStrike's guide puts tester rates at roughly $100 to $300 per hour, with senior testers at the top of that range. Firms that quote a flat fee are still estimating hours behind the scenes. Either way, the size and complexity of what you ask them to test sets the cost.
Published price ranges by type of test
The figures below come from two published pricing guides, and they are market ranges, not quotes. For an external test of internet facing systems such as firewalls, VPN gateways, email servers, and websites, Compass IT Compliance lists $5,000 to $10,000 for a small business with up to 25 public IP addresses, rising to $10,000 to $15,000 for 25 to 50 addresses. For an internal test, which shows what an attacker could do once inside your network, including against your Windows domain, the same guide lists $7,500 to $12,000 for a small office with one or two network segments.
Web applications vary the most, because the work grows with the number of user roles, pages, workflows, and connections to other systems. Compass lists $3,500 to $6,000 for a simple site of a few pages and $8,000 to $15,000 for a site with logins, while DeepStrike's broader range runs from $5,000 to more than $30,000. If your business runs a client portal or online payments, our guide to web application security testing explains what that work covers.
For a full year, both guides land on the same number: a small business typically budgets $8,000 to $20,000 for testing. That usually covers an annual external test and a test of one or two critical applications, with internal testing added as the business grows or as compliance requires.
Why two quotes for the same test can be far apart
Two honest quotes for an external test can differ by thousands of dollars. One firm may plan several days of manual work by a senior tester, include a retest after you fix things, and write a report your auditor will accept. Another may plan a shorter engagement with more automation and bill the retest separately. Both guides put a standalone retest at roughly $2,000 to $5,000, and Compass notes that most reputable firms include a limited retest within 30 to 90 days. Compare what each proposal includes, not just the totals.
The scoping decisions that move your price
Every quote starts with a scoping call or questionnaire, and your answers set the price. For network tests, the biggest factor is how many internet addresses and live systems are in scope. For applications, it is the number of user roles, pages, and connections to other systems.
How much you tell the testers up front matters too. In a gray box test, the testers receive some logins and documentation before they start, and they usually find more in less time than testers who begin blind. That can lower the cost of a given amount of coverage.
Timing and logistics add up as well. Testing after hours or on weekends to protect busy systems costs more. Many internal tests can run through a small device or secure connection instead of an on site visit. And if you need a report formatted for a payment card assessor or a client audit, expect extra documentation time; Compass estimates that heavier compliance reporting can add 10 to 25 percent.
The costs that never appear on the invoice
The quote covers the testers, not your side of the work. Before testing, someone has to answer the scoping questions, create test accounts for each user role, and confirm which systems are fair game and when. During the test, someone should be reachable in case a system starts behaving oddly.
The largest hidden cost comes after the report. Fixing what the testers find takes staff or provider time, sometimes new hardware or licenses, and occasionally a vendor update you have to wait for. Budget for remediation alongside the test itself.
When a penetration test is required, not optional
For many small businesses, the first quote request is triggered by a rule, a client, or an insurer. Knowing exactly what each rule asks for keeps you from buying too much testing, or too little.
Payment cards and PCI DSS
PCI DSS version 4.0.1, published by the PCI Security Standards Council, requires internal and external penetration testing at least once every 12 months and after any significant change to infrastructure or applications. The tester can be a qualified internal person or an outside firm but must be organizationally independent. Exploitable findings must be fixed and retested. If you use network segmentation to shrink the part of your business that PCI covers, that segmentation must be tested too, at least every 12 months for merchants and every six months for service providers.
Two details save money. The quarterly scans PCI requires are vulnerability scans, not penetration tests, so they do not satisfy the testing requirement on their own. And whether your business must meet the testing requirement at all depends on how you validate compliance, so check against our summary of PCI DSS 4.0 requirements before you buy.
Financial firms and the FTC Safeguards Rule
Tax preparers, mortgage brokers, and other businesses covered by the FTC Safeguards Rule must either monitor their systems continuously or perform annual penetration testing plus vulnerability assessments at least every six months. For a small firm without monitoring in place, the annual test is usually the practical route. Our guide to FTC Safeguards Rule compliance covers the rest of the rule.
Medical and dental practices under HIPAA
The HIPAA Security Rule in effect today does not use the words penetration test. It does require a risk analysis and periodic evaluation of your safeguards, and a test is one of the clearest ways to show that evaluation happened. Our guide to the HIPAA Security Rule explains those duties.
That may change. HHS has proposed updating the rule to require vulnerability scanning at least every six months and penetration testing at least once every 12 months. The proposal is not final, and in mid 2026 HHS moved its target for a final rule to July 2027 and shifted it to its list of long term actions. Practices that start testing now will not be scrambling if it becomes law.
What a good test report contains
The report is the product you keep, so ask for a sample before you sign. A useful report opens with a summary an owner can read in five minutes. It states the scope, dates, and method, often following a recognized approach such as the OWASP testing guide or NIST's technical guide to security testing. Each finding is ranked by severity, shows evidence of how it was exploited, explains the business impact in plain words, and gives remediation steps your IT team can follow. It ends with retest results or a letter confirming what was fixed.
That letter is useful well beyond the security team. The security questionnaires clients send often ask for the date of your last test and a summary of results, and a clean retest letter answers without sharing the full report.
How to spot an automated scan sold as a test
The cheapest offers are usually a different product. DeepStrike warns that tests priced under about $4,000 are usually just automated scans. Other warning signs are a price quoted before anyone asks what you have, no named tester and no description of the tester's experience, results promised within a day or two, a report that reads like raw tool output with no evidence of exploitation, and no retest at all.
Scans have real value, and you should run them regularly. They answer a different question, though, and paying test prices for scan output leaves the real attack paths untested.
Getting more out of every testing dollar
The fastest way to waste testing hours is to let testers spend them finding missing updates you could have found yourself. Run authenticated vulnerability scans and fix what they turn up before the engagement, which is what a working vulnerability management program does every month. The testers can then spend their time on attack paths only a person can find.
Scope by risk rather than by everything you own. Start with internet facing systems and the applications that hold sensitive data, and combine external and internal testing in one engagement when you need both. Schedule the test after a major change, such as a new firewall, a cloud move, or a new client portal, rather than just before it. And book the remediation work and the retest date before testing starts, because findings without a deadline tend to sit until the next test finds them again.
Budgeting for testing year after year
For most small businesses, testing settles into a predictable annual line: one external test a year, internal and application testing as risk and compliance require, and a retest after each round of fixes. The first year usually produces the longest list. Later rounds get shorter as the environment improves, which is the point.
GlobeVM has supported businesses for 30 years and currently looks after more than 75 organizations across Southern California, from the San Fernando Valley to Santa Clarita. Our penetration testing service starts with scoping, so the estimate reflects your actual systems rather than a price list. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi. To get started, request a free IT and security assessment or call (818) 405-9930.