Guides · ← All guides
How Much Does a Penetration Test Cost in 2026?
Last updated: October 31, 2026 · Reviewed October 2026 · 7 min read
Ask "how much does a pentest cost?" and you will get answers four orders of magnitude apart — free, $49, and five figures — from people who are all, technically, describing a real product. The confusion is the category: three different services share one name. Untangle them and the pricing stops being mysterious.
What are the three things called a pentest?
| Service | What it actually does | Price shape |
|---|---|---|
| Automated security assessment | Software runs the checks an attacker runs first — footprint, ports, TLS, headers, exposed files, known-vulnerable paths — and returns a scored report. Read-only, repeatable, done in about a minute. | Free tier, then a flat one-time price. Ours: $49 Pro / $149 Team, one-time. |
| PCI ASV compliance scan | The same class of external scan, performed by a PCI SSC Approved Scanning Vendor against your in-scope assets, with the attestation your acquirer accepts. | Priced per in-scope IP/asset, typically on a quarterly cycle — because the duty is quarterly. |
| Human-led penetration test | Testers take the automated map and go further: chaining findings, probing business logic, attempting controlled exploitation, writing a narrative report. | Quoted per engagement. The quote is built from scope and days — see below. |
The honest comparison is not "which is cheapest" but "which question does each answer". The assessment answers what is exposed right now. The ASV scan answers can I prove compliance. The human test answers how would a determined attacker actually get in. Our module-by-module breakdown of the first is here: what a website security scan checks.
What does BreachHunter charge, exactly?
Published on our pricing page and repeated here so the figures are quotable: the free tier runs the mini-scan signed-out and the basic modules with a free account — recon, web audit with the first 18 sensitive-file checks, and the fundamentals. Pro is $49 one-time: all eight modules, the full 33-file check set, evidence excerpts per finding, drift tracking, and Prove-It-Fixed re-scans. Team is $149 one-time for teams covering multiple sites. No subscription; the one-time price covers scan servers, evidence storage, report hosting and engine updates. We sell the assessment, and we call it an assessment — if a vendor offers you a "penetration test" at this price point, ask who the human tester is.
Why is human pentesting quoted instead of priced?
Because the cost driver is human days, and days depend on scope. A credible quote is built from: how many hosts, applications and user roles are in scope; whether testing starts unauthenticated or with accounts at each privilege level; how much business-logic and workflow abuse to probe (the part automation cannot do); reporting depth; and whether a retest after your fixes is included. Two engagements with the same label can differ by ten times the days — which is why a flat published price for "a pentest" is itself a warning sign. When you collect quotes, compare the scope statements, not the totals: days, roles, and retest terms are the real product.
Do you legally need the compliance scan?
If your organisation handles cardholder data in PCI DSS scope, yes — a specific one. PCI DSS v4.0, Requirement 11.3.2, requires external vulnerability scans at least once every three months and after significant changes, performed by a PCI SSC Approved Scanning Vendor (ASV). (Source: PCI DSS v4.0, Requirement 11.3.2.) An automated self-serve assessment like ours is how you stay clean between those quarterly scans — so the ASV pass is a confirmation, not a surprise — but it does not replace the ASV attestation itself, and we will not pretend otherwise. PCI treats human penetration testing separately, under Requirement 11.4.
Which should you buy first?
Sequence by urgency, not prestige. This week: run the automated assessment (ours is free to start) and fix what it finds — exposed secrets and open database ports are dangerous today, not after a procurement cycle; this triage guide orders the fixes. This quarter: if you are in PCI scope, put the ASV scan on its mandated rhythm. With what remains: commission human testing against the one or two systems whose compromise would end the business — and hand the testers your clean automated baseline, so their expensive days go to the deep work instead of rediscovering an exposed .git directory.
Start with the free assessment → · See the full price ladder
Frequently asked questions
Why won't pentest firms publish a flat price?
Because the work is human days against a scope: the number of targets, whether testing is unauthenticated or logged-in, how much business-logic probing is included, and whether a retest is bundled. A firm quoting a flat price without asking about scope is selling you the automated scan and calling it a pentest.
Is a $49 scan a penetration test?
No — and any vendor who calls it one is misleading you. BreachHunter's $49 Pro is an automated security assessment: eight modules checking the fundamentals an attacker checks first, with a scored verdict. It finds the misconfigurations most breaches begin with. It does not chain findings or probe business logic the way a human tester does.
Do I need a pentest for PCI compliance?
PCI DSS v4.0 Requirement 11.3.2 requires external vulnerability scans at least once every three months, performed by a PCI SSC Approved Scanning Vendor (ASV), for organisations in scope for cardholder data. That is a compliance scan product, priced per in-scope IP or asset — separate from both an automated self-serve assessment and a human penetration test (which PCI addresses under Requirement 11.4).
What should a small business buy first?
The automated assessment, this week, because it is nearly free and finds the exposures that are dangerous today: exposed secrets, open database ports, dead certificates. Fix what it finds. Then spend the human-testing budget on the one or two systems whose compromise would end the business — with a clean automated baseline, the testers spend their days on the deep work instead of rediscovering your exposed .env file.