Penetration testers send a proposal or quote after a scoping call and before any testing starts. Clients typically get quotes from two or three providers and compare price, methodology, timeline, report quality, and credentials. A clear scope is the main thing that separates a good quote from a vague one.
When to use estimates: Use estimates to provide project quotes and get client approval before starting work. Once approved, convert your estimate to an invoice with one click to collect payment.
Create an invoice for payment collection
Upload logo
PDF will be generated with filename:
Invoice_1001_Client_2026-10-14.pdf
The price depends on the size of the attack surface, and unclear targets lead to arguments about what was in scope.
Different levels of access change how much time is needed and what findings are likely.
Denial-of-service testing, social engineering, production data access, or third-party systems should be called out as included or excluded.
Clients may limit testing to off-hours or specific dates, and you need a contact in case something breaks.
Clients need to know whether the report will satisfy an auditor, and whether a presentation or call is included.
Without a defined window, a retest request six months later can cause friction.
Delays caused by the client should extend the timeline or trigger additional charges.
| Service | Priced | Typical range |
|---|---|---|
| Web application penetration test (small to mid-size app) | flat fee | $6,000-20,000 |
| External network penetration test | flat fee | $4,000-12,000 |
| Internal network penetration test | flat fee | $7,000-25,000 |
| Cloud configuration review (AWS, Azure, GCP) | flat fee | $5,000-15,000 |
| Phishing or social engineering campaign | flat fee | $2,500-8,000 |
| Retest of remediated findings | flat fee | $1,000-4,000 |
| Consulting, advisory, and remediation support | per hour | $150-300 |
| Testing day rate (time-and-materials work) | per day | $1,200-2,500 |
Typical US ranges. Rates vary by region, experience, and job size.
Break the job into scoping, testing, reporting, and readout days. Add a buffer of 10-20% for surprises. Present the total as a flat fee but keep the day count for pricing change orders.
Offer a basic, standard, and extended option, such as unauthenticated only, authenticated with two roles, or full coverage with API testing. Clients can then choose based on budget and compliance needs.
List the factors that will trigger a change order: additional hosts, more roles, major application changes during testing, or rescheduled test windows.
A 30-day validity period keeps you from honoring old pricing when your calendar is full or when the target environment has changed.
Usually not. Rough ranges are fine, but a firm number needs details such as app size, number of roles, and IP count. A short scoping call or questionnaire gives you what you need.
Thirty days is common. Testing calendars fill up and client environments change, so an expiry date protects your pricing and schedule.
Short scoping calls are usually free. For complex environments that need architecture review or document analysis, some testers charge a paid scoping fee that is credited toward the test if the client proceeds.
For a fixed fee, you absorb normal overruns. If the client changes scope or causes delays, send a change order. Your quote should list the assumptions that would justify extra charges.
Use the Penetration Tester invoice template to bill the client, or convert this estimate once it's approved.
Penetration Tester invoice template