Guide · cost · checked 2026-11-08
What a pentest costs, from the firms that say.
Of the 29 firms and platforms we compare, 8 publish a price or a pricing model and 21 quote only after a scoping call. The published prices are below, word for word, with the date we checked them. Scope drives the rest: applications, roles, endpoints, IP addresses and depth.
Prices firms publish themselves
| Firm | Type | What they publish | Checked |
|---|---|---|---|
| Decima Systems Ours | Hybrid | Indicative: Starter $99/month (early access) for one target with one AI-run assessment a month, an automated retest after a fix and human review of confirmed critical and high findings; Pilot $3,000 for one scoped application/API with a reviewed report and one retest; Adversary $1,499/month for up to 15 targets; Sovereign quote-only | November 8, 2026 |
| Praetorian | Hybrid | Not on praetorian.com (/pricing redirects to the contact page). Praetorian's own AWS Marketplace listing for the Praetorian Guard Platform shows a 12-month 'Enterprise' contract at USD 80,000, with 'reach out to sales@praetorian.com for custom pricing' and usage over the contracted value at USD 0.01/unit. | November 8, 2026 |
| Rhino Security Labs | Consulting firm | FAQ: penetration tests 'generally start around the $10,000 range' (USD) and 'can grow into six figures for large, in-depth projects'; discounts offered for multi-year contracts. | November 8, 2026 |
| Raxis | Consulting firm | Raxis Attack (PTaaS subscription): 'Prices start at $25K for one year depending on the scope' (USD); point-in-time (Raxis Strike) pricing not published | November 8, 2026 |
| Cobalt | PTaaS platform | Cobalt Autonomous Pentest (AI-run web application test directed by Cobalt Core pentesters): $3,500 per test, limited-time promotional price; the test must be initiated and completed before 31 Dec 2026. Human-led PTaaS tiers (Standard, Premium, Enterprise) are sold as annual credit packages (1 Cobalt Credit = 8 hours of testing), quote only. | November 8, 2026 |
| Synack | PTaaS platform | Standard list prices (USD): Sara Pentest (agentic AI-led) from $5,085 for 1 Standard Sara Pentest; SynackST (human-led compliance pentest, 1 tester) from $10,283 for 1 Standard Pentest; Synack14/365 (team of researchers) from $27,120 for 1 Synack14 Pentest; Enterprise on request. The Synack Platform subscription is required and is a separate line item; FedRAMP offerings priced on request; credits expire one year from purchase. | November 8, 2026 |
| Astra Security | Hybrid | Pricing page (USD): Pentest Auto (autonomous AI pentest, 1 target) $199/month or $2,999/year; Pentest Expert (manual pentest by certified pentesters plus autonomous agents, 1 target) $5,999/year; Enterprise from $9,999/year. FAQ: Android/iOS apps sharing a code base priced from $2,200/app. | November 8, 2026 |
| Horizon3.ai | Autonomous / AI | List prices in USD (NodeZero pricing page): Flex (episodic) $15 per asset per test, 12-month term; Core $50, Pro $65, Elite $85 per asset per year (annual subscriptions, unlimited testing). NodeZero WebApp Flex $10,000 per asset (app) per test, 12-month term; WebApp Continuous custom-priced. Premium support adds 10% (min $7,500/yr) or 20% (min $25,000/yr) of the annual subscription. | November 8, 2026 |
Prices change; confirm with the firm. Taxes, travel and retests may be extra unless stated.
What moves a quote up or down
Scope size
Number of applications, user roles, API endpoints, IP addresses or cloud accounts. The biggest single factor.
Depth
Black box (no information) is cheaper to scope but slower to test; grey or white box (credentials, documentation, code) finds more per day.
Type of test
A single web app is the usual entry point; internal networks, red teams and social engineering cost more.
Retests and reporting
Whether retesting fixed findings and a customer-facing letter are included, or billed separately.
Compliance mapping
Reports mapped to PCI DSS 11.4 or written for SOC 2 auditors can add review time.
Who tests
Senior consultants, a crowd of vetted testers, or software with human review are priced very differently.
Four ways firms charge
- Fixed scope, fixed price: the classic consulting statement of work, quoted after scoping.
- Per day: a number of tester-days at a day rate; common for unusual scopes and red teams.
- Credits or subscription: PTaaS platforms sell units you spend on tests over a year.
- Platform license: automated tools charge for the software, often by asset count.
Questions
How much does a penetration test cost?
It depends on scope: the number of applications, roles, endpoints or IP addresses, and how deep the test goes. The prices firms publish themselves are in the table on this page, each with the date it was checked; most firms only quote after a scoping call.
Why don’t most firms publish prices?
Because scope varies so much between clients. Platforms with standardised packages (PTaaS and automated tools) are more likely to publish a price or a starting point.
Is a retest included in the price?
Sometimes. It is one of the most important questions to ask, because a finding is not closed until the fix is confirmed. The table on the firms page shows which firms state their retest policy.
Sources for this page
- Decima Systems: pricing — The published price quoted above.
- Praetorian: pricing — The published price quoted above.
- Rhino Security Labs: pricing — The published price quoted above.
- Raxis: pricing — The published price quoted above.
- Cobalt: pricing — The published price quoted above.
- Synack: pricing — The published price quoted above.
- Astra Security: pricing — The published price quoted above.
- Horizon3.ai: pricing — The published price quoted above.
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Penetration testing cost: what firms publish, and what drives the price." Updated November 8, 2026. https://pentestingfirms.com/cost/