Penetration testing pricing: what changes the quote
Penetration testing cost at Excession Labs: ten scope factors that change the quote, what every quote includes, and how to request a written proposal.
Short answer
We quote each test after a short scoping call, because the price depends on how much there is to test: applications, user roles, API endpoints, tenants and environments, plus your deadline and retest needs. Every quote lists what it includes. We do not publish fixed prices yet. Small teams can apply for a free, scoped pilot.
What changes the quote#
Each factor below changes how much testing time your scope needs. We ask about all of them on the scoping call.
| Factor | Why it matters | What to have ready |
|---|---|---|
| Applications and hosts | Each web app, API and admin panel is a separate attack surface | The list of domains and which are in scope |
| User roles | Access control is tested between every pair of roles | Role names and one test account per role |
| API size | Each endpoint and object type needs authorization checks | OpenAPI file, Postman collection or GraphQL schema |
| Tenants | Multi-tenant products need cross-tenant tests for every object type | Two test tenants with sample data |
| Integrations | Payments, email, uploads and SSO add flows and abuse cases | Which integrations are live in the test environment |
| Testing depth | Black box takes longer to reach the same coverage than grey box | Docs, accounts and, if possible, source access |
| Environment | Production needs tighter limits and more coordination | A staging environment with realistic data, if you have one |
| Deadline | A fixed report date can change how we plan the work | The date and who will read the report |
| Report needs | Some reviewers ask for specific sections or a summary they can share | The request or questionnaire you received |
| Retest | Fix verification takes time after your changes ship | When you expect to deploy fixes |
What every quote includes#
- A written scope: hosts, roles, test windows, off-limits actions and contacts.
- Testing under agreed rules, with bounded tests and test-owned data.
- A report with evidence, reproduction steps and a fix for every finding, plus controls that held, a remediation plan and limitations. See the sample report.
- Retest terms, stated in the quote.
How to get a quote#
- Send a request with the application, the reason and your deadline.
- We reply by email to arrange a short call.
- We send a written scope and quote.
- Testing starts after the system owner signs the authorization.
Ways to buy#
| Option | Fits when | Next step |
|---|---|---|
| Free pilot | You want to judge our work on a small, real scope | Apply |
| One-off test | A customer, auditor or launch needs a report | Request a quote |
| Recurring testing | You ship often and want each significant release tested | How it works |
Questions
Why don't you publish a price?
Two applications with the same number of pages can need very different effort. One may have three roles and a public API, the other a single role. A fixed price would overcharge the simple case or skip work in the complex one, so we write a quote for your actual scope.
What do other providers charge?
Published prices vary a lot, and the units differ: per test, per day, per year or credits. PentestCompare, which Excession Labs also publishes, lists published prices with their units and sources.
Is the retest included?
We agree retest terms in each quote, so you know before you sign which findings are retested and when.
Can we start with something small?
Yes. A free pilot covers a small written scope, such as one critical user flow or a set of API endpoints. You keep every finding in that scope.
Try us on a small, scoped test
A free pilot covers a small written scope. You get every finding in scope with evidence and fix guidance.