How much does a vulnerability scan or penetration test cost?
- A penetration test, where people try to break in by hand, typically costs a small business about $5,000 to $15,000 for a small scope, such as a small external network or a web application with a login. Complex custom applications run $15,000 to $35,000 or more.
- Automated vulnerability scanning costs far less: from tens of dollars a month per server for small-business services to several thousand dollars a year for a professional scanner licence you run yourself.
- The price of a manual test is driven by scope: how many servers, pages and user roles, whether areas behind a login are included, and whether the report and a re-test are part of the fee.
- You need a human penetration test if you handle payments or personal data behind a login, or if a customer contract or a standard you follow requires one. Otherwise, automated scanning is usually a sensible place to start.
- All figures here are rough guides from published sources we checked in November 2026. Get two or three quotes against the same written scope before you decide.
Vulnerability scan vs. penetration test cost: three options compared
What vendors call “security testing” falls into three groups. They differ in depth, price and who they suit.
| Manual penetration test | One-off scan run for you | Ongoing automated scanning | |
|---|---|---|---|
| What it checks | Everything a scan does, plus areas behind a login, flaws in how the application works (for example, changing a price or seeing another customer’s data), and how far an attacker could get | Known weaknesses (vulnerabilities), misconfigurations and outdated software, from a fixed list of checks | The same kind of checks, repeated, and matched against newly published vulnerabilities |
| Who does it | Security testers, by hand, with tools | A consultant or IT provider runs a scanning tool and tidies up the output | A service, automatically |
| Rough price guide | About $5,000–$15,000 for a small scope; $15,000–$35,000+ for complex applications | Usually a fraction of a penetration test. Published prices are rare, so ask for a quote | From tens of dollars a month per server, up to several thousand dollars a year for a professional scanner licence |
| How often | Once a year, or after a major change | Once or a few times a year | Daily to weekly |
| What you get | A detailed report with proof and fixes, often a walkthrough call | A report based on the tool’s findings | A dashboard, alerts and reports |
| Who it suits | Businesses with payments or personal data behind a login, or a contractual requirement | Businesses that need one report for one request | Businesses without security staff that want continuous watch on their website and servers |
Prices are a rough guide based on the published sources listed at the bottom of this page, checked in November 2026. Rates vary by country, by vendor and by scope.
If the terms themselves are new to you, start with what a vulnerability scan is and how it differs from a penetration test.
Why a penetration test costs what it does
You are paying for days of a specialist’s time. A tester opens each page, sends crafted input, logs in as different users and tries to reach things they should not. Then they write up each finding with steps to reproduce it and a fix. None of that scales the way software does.
One US provider’s published price guide shows how the price follows the effort: $3,500 to $6,000 for a simple site of a few pages, $8,000 to $15,000 for a site with logins, and $15,000 to $35,000 or more for a complex custom application. A test of a small external network (up to 25 addresses) is listed at $5,000 to $10,000.
The price is not padding. Flaws in business logic and in areas behind a login are found by a person thinking like an attacker. An automated scanner does not replace that.
Be wary of a “penetration test” priced like a scan. Some low quotes are an automated scan with a different label. Ask how many tester-days are included and what will be tested by hand.
What drives the price of a security test
Two quotes for “the same” test can differ by a factor of two or three. Usually they assume different scopes. Check these five points on every quote:
- Number of targets. Network tests are priced by the number of addresses or servers; web tests by pages, features or API endpoints.
- Login areas and user roles. Testing behind a login, with several kinds of user, adds a lot of work.
- Depth. Is a person testing by hand, or reviewing the output of a tool?
- Reporting. A technical report only, or also a summary for management and a call to walk through it? Reports written for a compliance standard often cost extra.
- Re-test. Is checking your fixes included, or billed separately?
The quickest way to get comparable quotes is to write one page with your URLs, an approximate count of pages and servers, whether logins are in scope, and the report you need, and send the same page to every vendor.
Hidden costs: re-tests, reports and doing it again next year
Re-test fees
A test is only finished when the fixes are confirmed. Some vendors include one re-test; others charge for it. One published guide lists a standalone re-test at $2,000 to $5,000.
Report extras
A management summary, a letter you can show customers, or a report mapped to a standard may be add-ons. Ask for a sample report before you sign.
Yearly repetition
A test describes one day. New vulnerabilities are published daily, so most businesses that test at all repeat it every year. Budget for the recurring cost, not a one-off.
One more cost sits outside every quote: fixing what is found. Testers find problems; your developer, agency or IT provider fixes them, and bills for it. Keep part of the budget for that.
Does a small business need a penetration test, or is scanning enough?
Not every business needs a human penetration test, and scanning alone is not enough for some. An honest way to decide:
Plan for a manual penetration test if:
- customers log in to your site or app and you handle payments or personal data there;
- a customer contract, an insurer or a standard you must meet asks for one;
- you built your own web application and are launching it or have changed it substantially.
Automated scanning is a reasonable start if:
- your online presence is a company website, WordPress, email and a few servers, with no custom application;
- you have never tested anything and want to know which doors are open and which software is out of date;
- a partner asked you to “get a security check” without naming a method.
A common way in is something ordinary: software nobody updated, or a service left open to the internet. Scanning finds those, and running it continuously catches them soon after they appear. A common, cost-effective pattern is continuous scanning as the baseline, plus a focused manual test on the parts that handle money or personal data.
Security Ready is in the third column: automated external scanning from $19 a month, with a free first scan. It does not replace a human penetration test. It does not test deeply behind logins or look for business-logic flaws. If you need those, hire testers.
Questions to ask a vendor before you sign
- 1
What exactly is in scope?
Get the list of URLs and servers in writing. Confirm whether pages behind a login are included, and for which user roles.
- 2
How much is done by hand?
Ask how many tester-days the quote covers and who will do the work. If the answer is “the tool runs overnight”, it is a scan.
- 3
Is a re-test included?
Ask how many, within how many days, and for which severity of finding. If it is extra, get the price now.
- 4
Can I see a sample report?
Check that it explains fixes, not just findings, and that a non-specialist can follow the summary. Confirm you may share it with customers.
- 5
Could testing disrupt my site?
Ask when testing happens, whether anything could slow or stop the service, and whether a test copy of the site is needed.
- 6
What will next year cost?
Ask for the repeat price and the unit price if your site grows. For subscriptions, ask about the minimum term and how to cancel.
Free vulnerability scanning options, and their limits
- A quick public-information check. Our 30-second check looks at your certificate, HTTPS, email spoofing protection and forgotten subdomains. No sign-up. It reads public information only, so it is not a vulnerability scan.
- Free tools you run yourself. ZAP is a free, open-source scanner for web applications. Nessus Essentials is free but limited to 5 addresses and to non-commercial use; the commercial licence, Nessus Professional, is listed at $4,790 a year.
- Free trials of paid services. Many scanning services offer a free first scan or trial period. Ours is one free in-depth scan of one server, with no payment details.
The limit of free tools is rarely the tool. It is the time and knowledge needed to set them up safely, to avoid scanning systems you do not own, and to sort a long technical output into what matters. If someone on your team has that, they are a good option. If not, a service that explains results in plain language is more likely to be used.
Whatever you choose, a clean result is not a guarantee of safety. It means nothing was found within the scope, by those checks, on that day.
Frequently asked questions
How much does a penetration test cost for a small business?
As a rough guide, $5,000 to $15,000 for a small, well-defined scope such as a small external network or one web application with a login. Simple sites can cost less and complex custom applications $15,000 to $35,000 or more. Rates vary by country and vendor.
How much does a vulnerability scan cost?
Automated scanning services for small businesses start at tens of dollars a month per server. A professional scanner licence that you run yourself costs several thousand dollars a year; one widely used product lists $4,790. A one-off scan run by a consultant sits in between and is quoted case by case.
Why is a penetration test so much more expensive than a scan?
A scan is software running a list of checks. A penetration test is a specialist spending days exploring your systems by hand and writing up what they find. You are paying for that time and skill.
Is a cheap automated scan enough?
For a company website, WordPress, email and a few servers, it is usually a reasonable start, because known, unpatched weaknesses are a common way in and scanning finds them. It is not enough on its own if customers log in and you handle payments or personal data there. Those areas need a person.
A customer asked us to “get a penetration test”. Do we really need one?
Ask them what they need to see: the type of test, who must perform it, and what the report should contain. If the contract says penetration test, a scan report will not satisfy it. If they only need evidence of regular security checks, a scan report may be accepted.
How often should we test?
Businesses that use manual penetration tests usually repeat them yearly and after major changes. Because new vulnerabilities are published every day, automated scanning is run far more often, daily to weekly, to cover the time in between.
Are re-tests included in the price?
It depends on the vendor. Some include one re-test within a set period; others charge separately. Ask before signing, and get the number of re-tests, the deadline and any fee in writing.
See where your own site stands — free
The free in-depth scan checks your site from the outside against thousands of known weaknesses and tells you how to fix each one. No payment details needed. For businesses; scans only with the owner's authorization.