October 26, 2026
How much does a penetration test cost in 2026?
A penetration test from Escaped costs $1,200 a day. Most small jobs take one to five days of testing, so they come to $1,200 to $6,000, and the number of days is fixed and quoted as one price before testing starts. Larger testing firms quote $5,000 to $30,000, and only after a sales call. An automated scan costs a few hundred dollars and is a different thing, covered at the end of this page.
The rest of this page is the detail behind those numbers: what the common job sizes cost, what is in the price, what moves it, and how to get a number for your own app.
Typical prices by job size
| What you’ve built | Days | Price at $1,200 a day |
|---|---|---|
| Marketing site with a contact form and an admin login | 1 | $1,200 |
| Customer support chatbot answering from your help docs | 2 | $2,400 |
| Single-platform mobile app with around 10 screens and a simple API | 2 to 3 | $2,400 to $3,600 |
| SaaS app with a few user roles and a REST API | 3 to 5 | $3,600 to $6,000 |
| iOS and Android app with accounts, payments and an API | 4 to 6 | $4,800 to $7,200 |
| AI agent that can take actions across several systems | 5 to 8 | $6,000 to $9,600 |
| Multi-tenant platform with a large API and third-party integrations | 6 to 10 | $7,200 to $12,000 |
These are typical sizes, priced at the day rate. The SaaS app row is the job we quote most often. AI features have a two-day minimum, explained on how much an AI penetration test costs. Your own quote comes after a free scoping call of about 30 minutes, and it is a fixed number, so a test that turns up twenty findings costs the same as one that turns up two.
What is in the price
You are paying for tester time and the report. The days cover the testing itself, a report written for the customer or auditor who asked for the test and for the developers who will fix things, and a call to walk your team through it. The report arrives within five business days of the last testing day. Once you have fixed the findings, the retest and an updated report are free.
There is no account manager or sales team in the price because there isn’t one in the company. Scoping, testing, the write-up and the walkthrough are handled by the same person.
What moves the number
Three things decide how many days a test needs, and we work them out with you on the scoping call.
How much there is to test. Screens, API endpoints, user roles and integrations. A marketing site with one login is a day. A SaaS app with three roles and an API is three to five. Roles add more days than screens do, because every role is tested against every other.
What the test is for. A customer questionnaire needs a credible test and a report the customer can read. Investor due diligence, or a first test of a payments flow, usually needs more days.
How much access you give us. Test accounts for each role, API docs and a short walkthrough let us spend the days finding problems rather than mapping the product. Testing blind is possible, and it takes longer.
If the scope grows during the test, we stop and tell you before it costs anything, and you decide whether to add days or keep the original scope.
Why the price is published
Most people who ask us for a price have been asked for a pentest by a customer, partner or auditor, and need a budget line before they can say yes. A day rate and a table of typical sizes give them that number without a sales call. If you already have a quote from another firm, the table above is the comparison.
Penetration test or automated scan
An automated scan costs a few hundred dollars and produces a PDF of scanner findings with no human checking them. It is often sent back by the customer or auditor who asked for a pentest, because a scan is not what they asked for. A penetration test is a person working through your app by hand, with a report that explains each finding and how to fix it. Penetration test vs. vulnerability scan goes into the difference.
Getting a number for your app
For a ballpark with no call, describe what you’ve built and you’ll have a range by email within one business day. For a fixed quote, tell us what you’ve built and we’ll come back with one after a short call. The pricing page has the day rate, more examples and what every test includes.