How to justify a penetration test: a business case you can fill in

To justify a penetration test, tie it to something your company already needs: a customer contract, an audit, a launch date, an incident or a deal. Then show a cost range, what the company receives, and what waiting risks.

When is a penetration test justified?#

A test is justified when someone outside the security team asks for proof, or when a change adds risk that nobody has checked. Five situations fit.

If none of these applies, the case is weaker. You can still argue for a test when the app holds customer data and nobody has tested it.

What does a penetration test cost?#

Excession Labs does not publish prices. We quote after a short call and a written scope. For a budget line, use published market prices as a floor and plan for a higher quote.

PentestCompare checked 66 providers on 9 November 2026. Of these, 21 publish 68 price rows. For prices in US dollars sold per test, 21 rows from 9 providers give a median of $5,000, with a lowest of $1,000 and a highest of $27,120. Fourteen of those rows are starting prices, and 45 providers publish no price. The pentest pricing index 2026 lists every row with its source and date. PentestCompare is owned by Excession Labs.

These are list and starting prices, not what buyers paid. Scope drives the quote: number of roles, API size, environment and report needs. Our pricing page explains the factors, and the penetration testing cost guide on PentestCompare compares units.

What does the company get?#

The company gets a written report with evidence for each finding, fix guidance and a way to check the fixes. The sample report shows the format, with every finding labeled as a sample.

• Each finding has a description, impact, the requests and responses that prove it, and remediation steps.
• Severity uses a four-level scale (Critical, High, Medium, Low), each with a written definition.
• A controls-that-held section lists protections that were tested and worked, so fixes do not break them.
• A remediation plan and a section for limits and open questions.
• The report comes as HTML, PDF and Markdown, plus proof-of-concept scripts.

Excession Labs checks the evidence for each finding and writes the report. We can retest fixed findings. Ask in scoping how retest is quoted. See retesting and what to do after the pentest. A report does not make a system secure, and no auditor or customer is bound to accept it.

What are the risks of not testing?#

Untested flaws stay in place until an attacker, a customer or an auditor finds them. Two current reports give figures for the cost and the cause. Both are written by organizations that sell or study security, and neither measures your company.

• IBM's Cost of a Data Breach Report 2026, produced with Ponemon Institute, puts the global average cost of a data breach at USD 4.99 million, a 12% rise on last year and a record high. IBM attributes the rise to higher detection, escalation and lost business costs.
• Verizon's 2026 Data Breach Investigations Report says 31% of breaches now start with software vulnerabilities, ahead of stolen passwords as the top way in. The incidents took place between 1 November 2024 and 31 October 2025.

An average is not a forecast for one company. Use these figures to size the downside, and say that they are averages. We left out figures we could not check against the publisher's own page today. For survey data on how often companies test, see penetration testing statistics.

Business case template#

Copy this into a document and replace each line in brackets. Keep it to one page.

1. Problem
   What triggers the test? [customer name or audit, date, what they asked for]
   What is untested today? [app, API, tenants, last test date or "never"]

2. Scope
   Systems: [URLs, API base, environments]
   Roles to test: [anonymous, user, admin, tenant A and B]
   Out of scope: [list]
   System owner who authorizes testing: [name]

3. Options
   A. Do nothing. [consequence: lost deal, failed audit item, open risk]
   B. One-off test before [date].
   C. Recurring tests after releases.
   D. Free pilot on a small scope first. [only if the scope fits]

4. Cost range
   Published market floor: [from the pricing index, with date]
   Written quotes: [provider 1], [provider 2], [provider 3]
   Budget requested: [low] to [high]
   Staff time for fixes and retest: [days]

5. Benefits
   Contract or renewal that needs the report: [name, value if known]
   Audit or insurance item closed: [control reference]
   Findings fixed before release: [list after the test]

6. Risks
   Cost of waiting: [use the IBM and Verizon figures as context, label them as averages]
   Risks of testing: [production impact, mitigated by rules of engagement]

7. Decision
   Approver: [name]    Needed by: [date]
   Approve option: [B / C / D]    Budget: [amount]

Fill in section 4 with real quotes before you send it, and show the full range.

Email to your manager#

Subject: Request: approve a penetration test of [app] before [date]

Hi [name],

[Customer or audit] has asked for a third-party penetration test of
[app] by [date]. We have no current report, and the last test was
[date or "never"].

I would like to request approval for a one-off test with a written scope of [short
scope]. Published prices start around [figure from the pricing index].
I have asked [two or three] providers for quotes and will send the
range by [date]. We would also need [number] days of engineering time
to fix findings and check the fixes.

The cost of not testing is [lost deal or audit item]. For context, IBM's
2026 report puts the average data breach at USD 4.99 million. That is a
global average, not a forecast for us.

Can you approve a budget of [low] to [high] by [date]? The one-page
business case is attached.

[Your name]

How do you start?#

Send the scope questions to two or three providers and compare the quotes line by line. If you want to try us, request a quote or apply for the free pilot. Tell us the deadline and who will read the report.