Penetration testing statistics: how often companies test, fix times and spend

Penetration testing statistics come from a small set of vendor surveys. This page lists the figures we checked on 9 November 2026. Each one shows who ran the survey, how many people answered, the date and the page. Last updated: 9 November 2026.

Key figures at a glance#

The table holds the figures people quote most often. Each row names the source and whether the source is a vendor.

Cobalt's 2025 edition shows no publication date inside the PDF. Press coverage dates it to 14 April 2025. Cobalt's own blog post on the 2026 edition is dated 5 May 2026.

Who ran the surveys: sample sizes and bias#

Three reports supply most of the numbers. All three come from companies that sell security testing, so read them as vendor data.

Large enterprises dominate the Pentera sample. A 30-person SaaS company is not the typical respondent. Keep this in mind before you compare your own spend to the $187,000 average.

How often companies pentest#

Quarterly testing is the most common answer in Cobalt's 2025 survey (30%), and 43% of Fortra's 2024 respondents test a couple of times a year. The two surveys offer different answer options, so the columns do not add up across surveys. Cobalt's report states: "more than half of organizations conduct pentests more than twice a year."

Sources: Cobalt State of Pentesting Report 2025, Figure 5; Fortra 2024 Penetration Testing Report, Figure 8. Both checked 9 November 2026.

What are the samples behind the frequency figures?#

Cobalt's frequency question asked how often the respondent's organization conducts pentests. Its 450 validated responses come from a double-blind survey run by Emerald Research. About 1,600 people answered the invitation and over 70% were disqualified. Half the respondents are security leaders and half are practitioners. They work at firms with 500 to 9,999 employees, so small software companies are not the core of this sample. Cobalt does not say how many respondents are its customers.

Fortra's report describes "a diverse cross-section" of respondents and gives no total, so its percentages carry no stated margin of error. Fortra's Core Security business ran the survey. We found no public URL for the PDF and read a local copy. Its own advice in the same section is that there is "no magic number" for frequency: size, infrastructure complexity, data type and regulation all matter.

Cobalt has published a 2026 edition. We did not open the 2026 PDF, and its frequency figures are not in this table.

Which compliance rules sit behind the frequency figures?#

PCI DSS sets an interval in its own text. Requirement 11.4 asks for internal and external penetration tests at least once every 12 months and after any significant change (see PCI DSS penetration testing requirements for the wording we checked). SOC 2 and ISO 27001 set no fixed interval, so a company under only those frameworks has no calendar rule. Does SOC 2 require penetration testing? covers that case.

An "annual" figure may therefore mix companies that test once because a standard says so and companies that test once by choice. Neither survey separates the two. The compliance and insurance table further down lists the demand figures from each report.

What can you conclude from frequency surveys?#

Frequency figures are weak evidence, for three reasons.

1. Both surveys come from vendors that sell testing, so people who already buy or run testing may be over-represented. Neither report rules this out. Cobalt's respondents are also more likely to test than the average company.
2. The answer scales differ. A 27% "annual" and a 43% "1 to 2 times a year" are different groups.
3. Neither survey links frequency to outcomes. A company that tests quarterly is not shown to have fewer breaches.

Use the figures to see that annual testing is common and not universal, and that a visible share of respondents never test (17% in Fortra's 2024 survey). Do not treat them as a benchmark your interval must match. For an interval based on your release pace and rules, use how often should you pentest. Also see recurring penetration testing.

Findings and vulnerability types#

Cobalt 2025 lists the most common web and API findings from 2024, counting all severities. Server security misconfiguration leads.

Source: Cobalt 2025, Figure 8, p.9. The shares count findings of every severity. Business logic flaws sit further down the list, at 2.3% by position in the figure.

The table does not tell you how often a given app has each flaw. It tells you what share of Cobalt's reported findings fall in each category. Many pentests use OWASP lists for web, API, mobile, AI/LLM and cloud work (Cobalt 2025, research methodology, p.31). For the categories themselves, see our guides on the OWASP API Security Top 10 and IDOR testing.

On AI and LLM findings, Cobalt 2025 reports that 32% of LLM pentest findings were rated high risk, against 13% overall. The 2026 post gives 32% against 12%. We cover those in the pentest remediation statistics.

Remediation and time to fix#

Cobalt 2025 puts the median time to resolve (MTTR) at 67 days for all findings, and three-quarters of organizations set SLAs of two weeks or less (p.4). Fewer than half of all findings ever get resolved (48%), rising to 69% for the riskiest.

The 2026 post uses a different measure. It reports 39 days to resolve high-risk findings, and a remediation half-life that ranges from 10 days for the best organizations to 249 days for the worst tier. The two editions use different definitions and datasets, so do not subtract one from the other. The full breakdown, with SLA gaps between executives and practitioners, is on the remediation statistics page. For a process that gets findings closed, read after the pentest: remediation and retest.

Spend and budgets#

Pentera's 2025 survey gives the only spend figure we could source. US enterprises spend an average of $187,000 a year on pentesting, about 10.5% of their total IT security budgets. The average security budget in the sample is $1.77 million. More than 50% of CISOs said they would raise pentesting budgets in 2025 (Pentera 2025, p.4 and p.21).

The sample is 500 executives at organizations with 3,000 or more employees, and the spend figure is for US enterprises. It says little about what a startup pays for one scoped test. Cobalt's 2026 post says 8 in 10 organizations saw offensive security budgets increase over the past year.

Pentera also reports that US enterprises manage an average of 75 security tools, and that 67% experienced a breach in the past 24 months (p.4). Both figures come from a survey run by a company that sells security software. For test prices by scope, see our pricing page.

Compliance and insurance drivers#

Buyers often pay for a pentest because a customer, regulator or insurer asks for one. Three figures describe those pressures.

The insurance figure is survey data, not policy wording. Insurers set their own terms, and we found no insurer-wide pentest requirement. Check your own application and policy, and read our guide on cyber insurance and pentest requirements.

The Fortra text refers to "Requirement 11.3" for pentests. That is PCI DSS v3.2.1 numbering. In v4.0.x the pentest requirement is 11.4.

Fortra also reports that 72% of respondents felt pentesting had prevented a breach at their organization (p.8), that 74% found value in pentesting that supports vulnerability management, and that 92% use third-party teams in some capacity. The top reason for using third parties is an external, objective point of view, at 62% (p.16).

How to cite#

Cite the report, the edition, the sample and the page, not this page. A short pattern:

Cobalt, The State of Pentesting Report 2025 (with Cyentia Institute), p.4:
median time to resolve all findings 67 days; 450 survey responses and over 16,000 pentests.
Vendor survey. Checked 9 November 2026.

Three rules keep a citation honest.

1. Name the vendor and say it sells the service it surveys.
2. Give the sample. If the report states none, say so, as with Fortra 2024.
3. Give the edition year. Cobalt 2025 and 2026 disagree on resolution rates because they measure differently.

We recheck these figures against the sources when we update the page. If a figure is wrong or out of date, tell us at support@excessionlabs.ai. Excession Labs is a security lab that runs authorized security tests of web applications, APIs and AI applications. We did not run any of these surveys.