What does a penetration test cost in 2026?
Short answer: manual work is quote-based, published platform plans range by target and scope, and Notra offers a $149 verified audit. Here are the published examples, the factors behind a quote, and a calculator for your own numbers. Any $2,500–$50,000 figures you may see in examples (including a $5,000 test input) are illustrative scenarios, not a market average.
The honest price ranges
| Who | Model | Price | What that buys |
|---|---|---|---|
| One-shot consultancy | Per engagement | Quote varies | Scope, targets, depth, credentials, retests, and deliverables drive the quote; there is no universal list price. |
| Astra Security | Pentest plans, per target | $2,999–$9,999 / yr | Public plans show $2,999/yr, $5,999/yr, and $9,999/yr tiers; target definition and inclusions vary by plan. |
| Aikido Security | Per assessment | $4,000 typical | Public pentest pricing shows a typical $4,000 assessment; request a scope-specific quote. |
| Beagle Security | Test-based annual plans | $99–$299 / mo equivalent | The official pricing page presents annual billing with monthly-equivalent tiers; confirm current test quota and target terms before purchase. |
| Notra | One-time, per audit | $149 | Flat, published, no sales call. Re-tests cost the same $149. |
Platform prices are public pricing as of September 2026; terms and quotes vary with scope. SeeAstra pricing, Aikido pentest pricing, andBeagle pricing. Consultancy pricing is quote-based, so the calculator below uses clearly labeled example inputs.
What actually drives the price
Number of targets
Most engagement quotes are per app or per target. Three web apps roughly triples a one-shot price — which is also why per-target subscriptions get expensive fast.
Depth
A scoped external scan costs a fraction of weeks-long testing with authenticated sessions, multiple roles, and business-logic hunting. Authenticated testing alone moves quotes up a tier.
Human attestations
If your deliverable is a signed letter for SOC 2 or an enterprise reviewer, you're paying for a certified human to sign their name. That's a large slice of what consultancies charge.
Re-tests
You fixed the findings — now prove it. Consultancies often charge for a re-scan or put you back in the queue. Re-test frequency is where annual costs quietly double.
Where Notra fits — and what you give up
| Notra | Price | What it covers |
|---|---|---|
| Free scorecard | $0 | Grades your site in about a minute. No card, no sales call. |
| First verified audit | $0 | Free trial Deep Audit after you prove domain ownership. |
| Deep Audit | $149 one-time | Unauthenticated deep budget; report in ~35–60 minutes with evidence for findings that pass verification. |
| Deep+ | $299 one-time | Adds authenticated testing with your session cookie and an extended request ceiling. |
| Monitor | $49 / domain / mo | Daily re-scans with email on every change — between full audits. |
The honest rows: a Notra audit comes with no attestation letter — it's evidence, not a signed assurance from a certified assessor — and no human chaining of novel multi-step, business-logic attacks. If either of those is the deliverable you need, a manual engagement is the right buy; published examples above show how vendor scope changes the price. Where Notra wins is the verified-evidence slice, same-day, at a price that makes re-testing after every release affordable. The full trade-off is laid out in Notra vs manual penetration testing.
Price your own year
Pick your app count and re-test cadence. The calculator uses editable example inputs for a consultancy engagement and re-test against Notra's flat $149 per audit; consultancy prices and deliverables vary by scope.
Signed letter from a certified assessor, for auditors.
2 × $5,000 + 2 × 2 × $1,500 re-tests · example inputs only
| Free scorecard | $0 |
| 2 apps × (1 initial + 2 re-tests) × Deep Audit | $894 |
| Human attestation | Not included |
based on your editable inputs; not a quote or savings guarantee
Cost questions, answered straight
Why do pentest quotes vary so much?
You're buying different amounts of human time and different deliverables. Scope, target count, authentication, business-logic depth, retests, and compliance deliverables can all change a quote. The calculator above lets you model those inputs without presenting an illustrative number as a market average.
Is a $149 audit a 'real' penetration test?
It is an automated test with a narrower slice: Notra evaluates known exploit classes such as injection, exposed secrets and files, JWT and auth weaknesses, and version signals, then includes evidence for findings that pass its gate. It does not replace human creativity for novel multi-step chaining or business-logic abuse, and it does not provide a signed attestation letter. See the honest side-by-side with manual pentests below.
Can I use the results for SOC 2 or a customer security review?
You can share a Notra report as evidence of proactive testing — findings that pass verification carry proof, and runs are manifest-pinned. But it is not a signed attestation from a certified assessor, and some auditors specifically want that letter. If the letter is the deliverable, budget for a manual engagement and request a scope-specific quote.
How often should I re-test?
Every time your attack surface meaningfully changes: a major release, a new auth flow, a new integration. With one-shot consultancies that means re-entering their queue and paying again; with Notra a re-test is another flat $149 credit you can run the same day. Continuous monitoring at $49/domain/month catches regressions daily in between.
Run the free scorecard first — it grades your site in about a minute and tells you whether a $149 verified audit is worth it.
Next steps: the full pricing page, a sample verified report, the honest manual-pentest comparison, and continuous monitoring for between-audits coverage. Competitor prices referenced from public sources as of September 2026 — if something here is out of date, tell us.