Quotes for “a pen test” vary widely because providers are often selling different things. The cheapest quotes are frequently an automated vulnerability scan with a report template on top. That has its place, but it is not a penetration test, and it will not satisfy an auditor or a bank's security questionnaire.
Penetration test vs vulnerability scan
- Vulnerability scan: automated, fast and cheap. Finds known missing patches and misconfigurations. Good to run monthly.
- Penetration test: a qualified tester manually tries to break in, chaining weaknesses and testing business logic such as prices, permissions and other users' data. Run at least yearly and after major changes.
- Our free website security check is an external health check, a useful first step, but not a substitute for either.
What decides the cost and duration
- Number and size of web applications, and how many user roles each has.
- API endpoints (REST, GraphQL), typically 5–10 days for under 50 endpoints.
- Mobile apps: iOS, Android, or both with a shared backend.
- External and internal network IP ranges, cloud accounts and Active Directory.
- Testing approach: black box (no information) takes longer than grey box (test accounts and documentation provided).
- Retesting after fixes, and any compliance mapping (PCI DSS, ISO 27001, SOC 2).
What a good penetration test report contains
- An executive summary that management can read in five minutes.
- Each finding with a severity score (CVSS), the affected asset, evidence and steps to reproduce.
- Clear, specific remediation advice for your developers.
- Scope, methodology (for example OWASP, PTES) and testing dates.
- A free or discounted retest to confirm the fixes.
How to choose a provider
Ask who will actually do the testing and what certifications they hold, ask to see a sample report, check that testing is manual and covers business logic, and agree rules of engagement in writing before anything starts. Companies in Egypt and the Gulf often also need a provider who can write the report in Arabic for regulators or boards.
A scan tells you what is visibly out of date. A penetration test tells you what an attacker could actually do with it.