How much does a pentest cost?

Why a fixed price

Most firms charge per day and per scope. You get a range, a quote after a meeting, and the retest turns out to be a separate line item. That isn't dishonest; it's awkward when you have a deal waiting on a security questionnaire or an audit starting in three months.

So I work the other way round. One price, up front, for a scope I know. The risk that the application is bigger than expected is mine — which is exactly why there is a thirty-minute scoping call first. That is where I decide whether you fit the standard scope. If you do, it's €6,500. If not, you hear it on that call and still get a fixed number, not an hourly rate.

What the €6,500 includes

• Thirty-minute scoping call, no strings.
• Five working days of manual testing against OWASP WSTG and ASVS Level 2, by one senior tester — the same person you talk to.
• A short update every test day. A critical finding you hear about the same day, not in the report.
• Draft report within three working days after the last test day. Later? 20% off.
• The report for your team: every finding with a proof of concept and a CVSS score, so your developers can reproduce it.
• The attestation letter for everyone else: a two-page statement for customers, investors, auditors and insurers, without your technical dirty laundry.
• Debrief with your team.
• Retest within 90 days, until everything is resolved or formally accepted — with a signed statement per round.
• Your auditor's questions about the attestation letter, answered by me, free of charge.

Report and attestation letter in English; the calls too, in English or German. That is what auditors, investors and international customers accept.

What the standard scope is

One web application with its API, about three user roles, about 75 endpoints, one environment. That covers most of the SaaS applications I see. Five days is a realistic estimate for that size, not an effort cap; I don't stop on Friday afternoon because the meter is full.

When it costs more

More user roles, many more endpoints, several environments, a mobile app next to the web app, or a second application. Then it isn't €6,500, but it is still a fixed number you get up front. A second application carries a fixed surcharge. Network, cloud and infrastructure I do for existing clients, on request.

When it costs less

If you need it more than once. Two single tests cost €13,000. The Annual plan costs €12,000 a year and includes a full test ahead of your audit window, a focused interim test six months later, a fix session with your developers after every test, and answers to your auditor's questions all year. Your report is never older than six months.

If you release every few weeks, Release Guard is the third option: €3,000 a month, up to two days a month, annual test included.

How it compares with the Spanish market

Price guides published in Spain in 2026 put a web application pentest between roughly €2,000 and €15,000 depending on scope and depth, and a senior pentester's day rate between €700 and €1,500. The €6,500 buys five days of testing at about €1,300 a day — the upper end of the market — with the report, the attestation letter and the retest included, which in many offers are separate line items. Cheaper exists; check who does the testing and whether the retest is included.

What you don't pay for

No credits. No expiring hours. No platform fee. No account manager between you and the tester. And a technical question in between — even outside a running engagement — I simply answer, without an invoice.

Five questions you should ask any firm

1. Who does the test, and is it the same person I'm talking to now?
2. Is the retest included in the price, and until when after the report?
3. What will my customer or auditor see, and what won't they?
4. What happens if you find something critical on day two?
5. What happens if the report is late?

My answers are above. If a firm can't give theirs, you already know enough.