Penetration testers are independent consultants and small security firms hired to find and demonstrate weaknesses in web applications, networks, cloud environments, and people before real attackers do. Invoices usually cover scoped testing engagements, retesting after fixes, and the written report. Clients are often software companies, healthcare and fintech firms, or businesses that need a test for SOC 2, PCI DSS, or HIPAA-related security work.
Create an invoice for payment collection
Upload logo
PDF will be generated with filename:
Invoice_1001_Client_2026-10-14.pdf
Most pen testers price by scoped engagement, not by the hour, because clients want a fixed number they can get approved. The fee is built from estimated testing days times a day rate, plus reporting time, project management, and a retest. Scope drivers include the number of web app roles and endpoints, API count, IP addresses or hosts in range, wireless sites, cloud accounts, and whether social engineering is included. Hourly or daily billing is common for ad hoc work, advisory, remediation support, and out-of-scope requests. Some testers sell retainers for ongoing testing or quarterly retests. Travel for on-site internal or physical tests is billed separately at cost, and expenses such as cloud testing infrastructure or commercial scanner licenses are usually absorbed in the rate unless they are unusual.
| Service | Priced | Typical range |
|---|---|---|
| Web application penetration test (small to mid-size app) | flat fee | $6,000-20,000 |
| External network penetration test | flat fee | $4,000-12,000 |
| Internal network penetration test | flat fee | $7,000-25,000 |
| Cloud configuration review (AWS, Azure, GCP) | flat fee | $5,000-15,000 |
| Phishing or social engineering campaign | flat fee | $2,500-8,000 |
| Retest of remediated findings | flat fee | $1,000-4,000 |
| Consulting, advisory, and remediation support | per hour | $150-300 |
| Testing day rate (time-and-materials work) | per day | $1,200-2,500 |
Typical US ranges. Rates vary by region, experience, and job size.
| Description | Qty | Rate | Amount |
|---|---|---|---|
| Web application penetration test, customer portal and REST API (3 user roles), testing performed May 6-17 | 1 flat fee | $9,500.00 | $9,500.00 |
| Written report with executive summary, findings, evidence, and remediation guidance | 1 flat fee | $1,500.00 | $1,500.00 |
| Findings walkthrough call with development team | 2 hours | $200.00 | $400.00 |
| Retest of remediated high and critical findings (completed June 3) | 1 flat fee | $1,500.00 | $1,500.00 |
| Additional testing of staging API endpoints added after kickoff (change order #1) | 1 days | $1,600.00 | $1,600.00 |
| Total | $14,500.00 | ||
Notes: Engagement performed under the Statement of Work and Rules of Engagement signed April 22, PO 48213. Payment due within 30 days of invoice date. Late balances accrue 1.5% per month. Report and retest letter are confidential and provided to the named client contact only. ACH preferred.
Ties the charges to written authorization and the agreed scope, which protects both sides if a dispute or an audit question comes up.
Shows exactly what was tested and when, and helps the client match the work to their compliance evidence window.
Clients often need to allocate cost or show a retest was completed, and separate lines make partial payments and approvals easier.
Extra endpoints, added hosts, or extended test windows are the most common source of invoice disputes.
Larger clients often reject invoices without a PO or the correct accounts payable contact.
Expense items should be itemized at cost with receipts available, as stated in the SOW.
Needed for the client to set you up as a vendor and file any required 1099 reporting.
Net 30 is the norm for companies, with Net 15 common for small clients. Many testers require 25-50% upfront at signing or before the test window starts, with the balance due on report delivery. Large or multi-phase engagements are sometimes split into milestones. Some testers hold the final report until payment clears, though this should be written into the contract and not used as a surprise. Late fees of 1-1.5% per month are common if stated in the agreement. Payment is typically by ACH or wire, with cards used for smaller jobs and the processing fee sometimes passed on.
Never test without a signed SOW and authorization that confirms the client owns or controls the targets. This also covers third-party hosting or cloud providers. The same document is your basis for billing.
State how many days the client has for a free or discounted retest, how many rounds are included, and that new findings or changed code are billed separately. Without limits, retests tend to stretch indefinitely.
Clients often ask for edits, rewording, or a second version for auditors. Include one round of revisions in the fee and bill additional rounds hourly.
Tie the final invoice to report delivery, not to the client's remediation. Clients can take months to fix issues, and you should not wait on their schedule to be paid.
If the client adds hosts, asks for an extra role, or extends the window, send a short written change order and bill it as its own line so it does not look like a surprise at the end.
Flat fees are standard for defined engagements because clients need a fixed budget and the scope is clear. Use hourly or daily rates for open-ended work, advisory, and anything out of scope.
Many testers invoice a deposit at signing and the balance when the report is delivered. For shorter jobs, a single invoice on report delivery is common. Put the schedule in the SOW.
You can if your contract says so. Many testers deliver a draft or summary and release the final signed report on payment. Make sure the client agrees to this before the work begins.
Either include a retest window in the original fee or list it as a separate line. A separate retest line, usually 10-25% of the original test price, keeps the first invoice clean and sets clear limits.
It depends on the state. Some states tax certain IT or security services and many do not. Check your state's rules or ask an accountant before adding tax to invoices.
Send a Penetration Tester estimate for approval, then turn it into an invoice when the work is done.
Penetration Tester estimate template