How much does a penetration test cost?
These ranges come from pen test firms that publish their prices and from firms' own pricing guides, checked in October 2026. They're for manual, human-led testing in the US market.
Pen test price by scope
Typical price by scope, in thousands of dollars
Web app and API: $10,000 to $25,000. The usual SOC 2 scope for a SaaS product.
| Scope | Typical price |
|---|---|
| External network | $4,000 to $15,000 |
| Small web app | $4,000 to $12,000 |
| API only | $3,500 to $18,000 |
| Web app and API | $10,000 to $25,000 |
| Cloud configuration review | $6,000 to $30,000 |
| Web, API and cloud together | $12,000 to $25,000 |
| Several products | $25,000 to $60,000 or more |
Most tests take one to three weeks of testing, plus about a week for the report.
What drives pen test pricing?
- Scope size. Number of applications, API endpoints, user roles and cloud accounts. This matters more than anything else.
- Tester time. Published US rates run $1,500 to $3,000 a day, or $175 to $350 an hour. Most SOC 2 engagements take five to ten tester-days.
- Authenticated testing. Testing as a logged-in user, across several roles, takes longer and finds more. SOC 2 scopes should include it.
- Manual depth. A human chaining flaws together costs more than a tool run.
- Urgency. One firm's guide puts rush work at 20 to 40 percent extra.
- Compliance. Compliance-driven tests can cost 15 to 30 percent more, by another firm's estimate.
How much should a SOC 2 pen test cost?
For a first SOC 2 at a small SaaS company, $5,000 to $20,000 is a sensible budget. That buys a test of the in-scope application and its API as an authenticated user, a written report with findings by severity, and normally a retest.
You don't need to test everything you own. Test what's in your SOC 2 system description. If your scope is one product, test that product.
Retests: check the quote
Your auditor wants to see that findings were fixed, and a retest is the cleanest proof. Firms handle it in two ways. Some include one or more rounds in the price. Others bill a retest separately, at up to about half the original fee. Read that line before you sign.
Vulnerability scan vs penetration test cost
A vulnerability scan is automated. A commercial scanner license costs anywhere from under $1,000 to several thousand dollars a year, and free tiers exist for small footprints. You need scanning as well, because it runs all year and a pen test happens once.
The two aren't interchangeable. One pricing guide warns that web application tests sold for under $3,000 are often a scanner's output with a cover report. An auditor who reads the methodology section will notice.
Pen testing as a subscription
Some providers sell testing as an annual subscription, often called PTaaS. Published and reported prices range from about $6,000 a year for a single target to $20,000 or more for continuous programs. Vendr's contract data for one well-known provider shows a median near $30,000 a year. It suits teams that ship major changes often. For a first SOC 2, one well-scoped test is usually enough.
How to get a quote you can compare
- Write the scope down. URLs, number of roles, API endpoint count, cloud accounts.
- Ask for tester-days, not just a total.
- Ask whether a retest is included.
- Ask for a sample report. Your auditor will read the real one.
- Book early. Leave two months before your period ends to test, fix and retest.
Not sure you need one at all? Read does SOC 2 require penetration testing?
With AccuSights: you don't have to commit to a heavy engagement. We run light pen testing in-house, bring in partners for a full external test when your auditor or a customer needs one, and file the report and the fixes for the audit.