How Much Does a Pentest Cost in 2026? Published Prices Compared

How much does a website penetration test cost? In 2026, published vendor starting prices for a web application pentest sit between about USD 2,500 and USD 5,000 per application, with broader tiers starting at USD 6,800 to USD 9,500, and the number you pay depends almost entirely on scope: how many applications and APIs are in range, whether logged-in user roles are tested, whether a human reviews the results, and whether you need a signed attestation letter for compliance.

This guide lists real published prices from six providers, checked on November 3, 2026, so you can compare like for like. It also explains where Protego's own USD 14.50 hosted automated assessment fits, and where it does not. Protego sells that automated assessment, so treat the human-led and self-managed routes below as the honest alternatives when your question needs more than an unauthenticated scan.

Published pentest prices (checked November 3, 2026)

Each figure below is a vendor's own published starting price or range, not a market survey. Prices change, so confirm on the vendor's page before you buy.

Pentestica also publishes a useful piece of context: it aggregates US pricing guides that quote USD 5,000 to USD 30,000 for a web application or API pentest, and US tester-day rates of USD 850 to USD 2,500. Read that as Pentestica's summary of other guides, not as a single market price.

The four ways to buy a test

The prices above are easier to read once you know that they belong to four different buying routes. A lower entry price does not mean better value when the work is different. An unauthenticated automated scan and a human-led engagement that signs in as an administrator are not the same product.

Which kind of test do I need?

flowchart TD
    A[Start] --> B{Need signed attestation or compliance proof}
    B -->|Yes| C[Human-led or hybrid pentest]
    B -->|No| D{Must test logged-in roles}
    D -->|Yes| E[Autonomous with auth or human-led]
    D -->|No| F{Want a fast low-cost first look}
    F -->|Yes| G[Hosted automated assessment]
    F -->|No| H[Free website scanner]

Use the tree as a starting point, then confirm the exact scope with the vendor. The honest answer for many teams is that they need more than one of these over time: a free scan to find obvious exposure, an automated assessment for a quick signal, and a human-led engagement when an auditor or customer asks for proof.

What drives the price

The published prices move with a few scope decisions. None of these is a number you can read off a chart; they are the variables a vendor prices against.

• Scope and number of targets. Ask vendors to price each application and API explicitly. HackNow lists a web application including its own API from USD 5,000, a separate API from USD 8,000, and a USD 5,000 project minimum.
• User roles. Testing logged-in behavior across roles costs more than an external look. CYBRI's entry tier covers up to 2 user roles; Stingrai's autonomous tier covers up to 3 authenticated roles. If your real risk is one customer reading another customer's data, you are paying for authenticated testing.
• API endpoints and dynamic pages. Coverage limits are part of the price. Stingrai's autonomous tier is bounded at up to 200 endpoints or dynamic pages per assessment.
• Retests. Some prices include a retest after you fix findings (HackNow within 90 days, Xint up to 3 within 30 days, Pentestica re-test available); others do not say. Confirm whether remediation testing is included, its scope and its deadline before comparing quotes.
• Compliance attestation. A signed attestation letter is a distinct deliverable. Stingrai includes it in the hybrid tier, and HackNow includes it with its human-led testing. If you need a letter for an auditor, ask whether it is in scope.
• Tester-days. Manual testing is sold in tester-days. Pentestica quotes its manual pentests in tester-days and, in its aggregation of US guides, puts US tester-day rates at USD 850 to USD 2,500. More tester-days means more human time, and more cost.

Protego's USD 14.50 automated assessment

Disclosure: Protego sells this service, so weigh it against the independent routes above.

Protego's hosted Strix assessment is USD 14.50 during early access, list price USD 29, plus applicable tax, charged once. It runs an automated agent-driven assessment against one DNS-verified domain you own and returns a PDF report plus a technical ZIP. It includes one free rescan within 30 days after you fix the issues, and a full refund if the report finds nothing actionable. You can preview the output format on the sample report page.

The limits belong right next to the price:

• Automated only. There is no human tester on the engagement.
• No authenticated testing. It does not sign in and exercise logged-in roles, so it cannot confirm that one user's data is walled off from another's.
• One DNS-verified domain you own. You must prove control of the domain.
• Findings need review. A person still has to confirm each finding, assign a fix and verify it. A clean report is not proof that the site is secure.

Because it is automated and unauthenticated, Protego's assessment is not a substitute for a manual or authenticated vendor engagement (USD 2,500 and up in the prices above) when you need business-logic testing, authenticated coverage or a signed attestation. It is a fast, low-cost first look at one site. If you want to spend nothing first, the free website vulnerability scanner checks public headers, TLS, DNS and exposure signals.

Questions to ask before you buy

Send the same brief to every provider and compare the written answers:

• Which exact applications, APIs and environments are in scope, and what is excluded?
• Do you test authenticated user roles, and if so, how many?
• Is testing automated, human-led or a combination?
• Is a retest after remediation included, and for how long?
• Do you provide a signed attestation letter, and does my auditor accept it?
• Can I see a sample report before buying?
• Are retests, support, additional targets and tax included in the quoted price?
• What authorization, test windows and stop conditions apply?

If one quote excludes authenticated work and another includes it, resolve that difference before you treat the two prices as comparable.

FAQ

Is a USD 3,000 autonomous pentest a real pentest?

It is a real automated assessment, but "autonomous" and "human-led" are different products. Stingrai's USD 3,000 tier is driven by AI agents; its USD 6,800 hybrid tier adds human testers and an attestation letter. If you need a person to validate findings or a signed letter, ask the vendor whether the autonomous tier includes them, or buy the hybrid tier.

Do I need a pentest for SOC 2?

The sources here do not define SOC 2 requirements, so treat this as a question for your auditor. Ask them what evidence they accept, then ask the vendor whether they provide an attestation letter. Stingrai (hybrid) and HackNow both include an attestation letter with their human-led testing; an unauthenticated automated assessment like Protego's does not.

Why is Protego's assessment USD 14.50 when others start at USD 2,500?

Because it buys different work. Protego's USD 14.50 is an automated, unauthenticated assessment of one DNS-verified site with no human tester. Pentestica lists manual testing at USD 2,500 to 5,500. HackNow starts web application testing at USD 5,000 with manual testing, a retest within 90 days and an attestation letter. CYBRI starts authenticated web application testing at USD 5,000 for one target and up to two user roles. Compare the deliverable, not just the number.

What is a tester-day, and why does it matter?

A tester-day is one day of a human tester's time. Manual pentests are often quoted this way: Pentestica prices its manual work in tester-days and, aggregating US guides, cites tester-day rates of USD 850 to USD 2,500. The more days a vendor needs to cover your scope, the higher the price.

How current are these prices?

They are published starting prices and ranges from each vendor's public pricing page, checked on November 3, 2026. Pentestica's page was last updated October 2, 2026, and HackNow's prices were reviewed October 2026. Vendors change pricing, so confirm before you buy.

Prices checked on November 3, 2026 from each provider's public pricing page; they change, so confirm with the vendor.