How much does a penetration test cost?
The cost of a penetration test depends on scope: how many applications, APIs, hosts and environments are in play, how complex they are, whether it is web2, web3 or both, and whether you want black box or white box testing. HYDN scopes every engagement against your actual attack surface and tells you what is driving the price before you commit.
What moves the price
- Size of the scope. The number of applications, user roles, API endpoints, IP ranges, cloud accounts or wallets to be tested.
- Complexity. Custom business logic, multi-step workflows and integrations take longer to test than a simple brochure site.
- Web2, web3 or both. Testing smart contract interactions, wallets and RPC endpoints alongside traditional web and infrastructure adds specialist work.
- Approach. White box testing, where we see source and architecture, often covers more in less time than black box testing. See black box vs white box.
- Compliance needs. Requirements such as PCI DSS segmentation testing or SOC 2 evidence add specific work and reporting.
- Timing. Out-of-hours testing or a tight deadline affects how we staff the engagement.
How we scope
- You tell us about your environment and share relevant documentation.
- We agree what is in and out of scope, the approach and the rules of engagement.
- We give you an estimate that shows what is driving the cost.
- Testing starts on the date agreed during the quote.
Watch for
A very cheap quote usually means a mostly automated scan. Scanners find known issues. The vulnerabilities that cause serious incidents tend to need someone to understand the application and chain several weaknesses together.
Frequently asked questions
Why do quotes from different firms vary so much?
Mostly because they are quoting for different work. One firm may run an automated scan and call it a test. Another may spend days testing manually. Ask how many days of manual testing are included and what the report contains.
Is a retest included?
Yes. Every HYDN engagement includes one free remediation check.
Published Updated