Penetration testing is priced on tester days: how long a skilled consultant needs to cover the agreed scope properly. That makes scope, not a rate card, the real driver of cost.
Why it matters
Two quotes for the same system can differ by thousands of dollars because they assume different depth. Understanding what drives the number lets you compare quotes on substance, and stops you paying test prices for what is really an automated scan.
What drives the price
- Size and complexity of scope: one web application costs far less to cover than a whole network
- Depth: authenticated testing of every role takes longer than an anonymous outside view
- Type of test: red team exercises run over weeks and cost more than a scoped single-system test
- Reporting and retest: check whether a remediation retest is included or priced separately
- Constraints: testing only in maintenance windows or on production systems adds time
How to compare quotes
Ask each provider for the same three things: how many tester days the quote covers, how findings are validated and evidenced, and whether a retest of remediated findings is included. Comparing on those points, rather than headline price alone, shows you what each quote actually delivers. A fixed-price proposal against a written scope protects both sides.
Getting a real number
A short conversation about what you run is usually enough to scope a test. Conformance quotes fixed prices against a written scope, so the number you approve is the number you pay.
Conformance delivers penetration testing across networks, applications, wireless and people, with every finding evidenced and a retest to confirm your fixes. Explore our services or request a quote.