How Much Does a Penetration Test Cost in 2026?

Intruder's AI-powered web application pentest starts at $3,500 per test, and Astra's autonomous plan for one web or SaaS app lists $2,999 a year. Cobalt's human-led tiers show only a quote button, so for that kind of engagement the scope, meaning the number of targets and the type of test, decides the bill.

Three products share the name penetration test, and they bill in different units. A scanner subscription charges a monthly fee by asset count, an autonomous test charges per target or per test, and a human-led engagement is quoted against a written scope. Compare two prices only when they use the same unit, or the spreadsheet will tell you the wrong story.

Toolradar data: Toolradar tracks 855 security tools as of 10 October 2026, and the 146 that publish a price have a median cheapest paid plan of $15 a month. Those are software subscriptions. Penetration testing services are priced differently, as the table below shows.

Published prices, read on 10 October 2026

Every rate below comes from the vendor's own pricing page, read on 10 October 2026. Intruder, Astra and Pentest-tools print a dollar sign without a currency code, so we read those figures as US dollars.

The Intruder figure is per test. Astra's cards are per target per year, with a monthly rate printed beside the Auto plan. The Pentest-tools rows are monthly software subscriptions. Cobalt's three tiers are quotes, and what it sells underneath is a credit.

Scope sets the bill, and the page prints one target

For Astra, one web or SaaS app is one target, including every API it calls. Each mobile platform counts on its own, so an Android app and an iOS app are two targets. Networks, cloud accounts, IP addresses and standalone APIs each count as one target. A company with one web app, an iOS app, an Android app and a cloud account is four targets under that rule.

Astra prints one price per plan with one target included. The page does not show what the other three targets cost, so ask for that figure before you set the $5,999 Expert plan beside a per-test quote.

The Auto card also shows two figures that do not line up. Twelve monthly payments of $199 come to $2,388, which is less than the annual figure printed beside it. The page does not say which term the annual figure covers, so confirm that before a budget is approved. The SIEM cost guide and the EDR cost guide price the other lines of a security budget with the same per-unit logic.

Subscriptions cost less, but they are software your team runs

Pentest-tools prices its plans from $95, $140 and $190 a month at five assets. The price moves with the asset count and the billing cycle, and its yearly toggle reads "Pay only 10 months". At the Pentest Suite starting rate, a year on that toggle is 10 times $190, or $1,900 for five assets.

NetSec and WebNetSec are scanner subscriptions for network, web and API checks. Pentest Suite is the full-cycle option, with automated exploitation that you run yourself. That is useful for a team that already has people to act on the findings. It is a different product from a tester's hours, and a scanner that finds an issue is not the same as a person who shows what an attacker could do with it. For the tools themselves, the penetration testing tools ranking covers the field and the AI penetration testing guide covers the automated side. For a no-cost starting point, see the free vulnerability scanners guide.

Cobalt sells credits, not a test price

Cobalt's Standard, Premium and Enterprise tiers each show a get-a-quote button and no figure. What sits underneath is the Cobalt Credit. Cobalt defines one credit as the equivalent of 8 traditional pentesting hours. The credit cost depends on the complexity of the engagement, and the credits are sold in annual packages.

Unused credits are a cost. The page says credits do not roll over into the next contract. Size the package to the scope you can actually test in the year, because a credit you do not spend by renewal is gone. The Cobalt listing on Toolradar has the product record.

Where the human-led price is only a quote

Cobalt's Standard, Premium and Enterprise tiers are quotes, and none of the other pages we read prints a price for a fixed-scope, human-led engagement with a named tester. Astra's Expert plan is the closest, a yearly plan priced per target, but the page prints it that way, not as a scoped engagement. We do not give a range for a full human-led test, because none of the pages we read supports one. Treat any range you see without a vendor link as an estimate, and get written quotes for the same scope from at least three firms before you sign. If what you need is someone watching alerts rather than a one-off test, the managed detection roundup is the adjacent purchase. If a test turns up a live incident, the incident response platforms ranking covers what comes next.

A worked comparison for one web application

Take one web application. Intruder's test starts at $3,500 per test, and Astra's Pentest Auto is priced per year for one web or SaaS app. Set the two figures side by side and the gap is $501 at face value, though one is a single test and the other a yearly plan. The Astra page does not say how many tests its annual plan allows, so that comparison means nothing until the test count is confirmed in writing. Intruder on Toolradar is the place to start if you want the product record next to the price.

Five questions before you compare quotes

1. How many targets does the price cover? Astra prints one, and a mobile app counts once per platform.
2. What is the unit? Intruder bills per test, Astra per target per year, Pentest-tools per month by asset count, and Cobalt per credit.
3. Which term applies? The Auto card shows a yearly and a monthly figure that do not match, so check at checkout.
4. Is retesting in the package? Ask each vendor to put it in writing, since the answer changes the bill.
5. What happens to an unused allowance? Cobalt's credits do not roll over, so an unused allowance is money gone at renewal.

FAQ

How much does a penetration test cost in 2026?

On vendor pages read on 10 October 2026, a web application test starts at $3,500 per test at Intruder, and Astra's autonomous plan for one web or SaaS app lists $2,999 a year. Cobalt's three human-led tiers show only a quote, and Astra's Expert plan, which pairs certified pentesters with autonomous agents, is $5,999 a year for one target. The number of targets and the test type set the final bill, so price the scope before you compare.

How much does a web application penetration test cost?

Two published options fit a single web application directly. Intruder's AI-powered web application test starts at its per-test rate, and Astra's Pentest Auto covers one web or SaaS app with its APIs included, billed yearly or monthly. Astra's Expert plan is priced per year for certified pentesters and autonomous agents, with one target. Confirm the number of tests or targets on each plan before you compare them.

Is there a cheap penetration test?

Astra's Pentest Auto is the lowest autonomous test price on the cards we read, at $199 a month. Its yearly figure does not match that monthly rate, so confirm the term at checkout. Pentest-tools sells scanner subscriptions from $95 a month at five assets, which is software and not a tester's time. A low entry price tells you the cheapest tier, not whether that tier covers your scope.

Why do penetration test quotes vary so much?

Each vendor counts something different. Intruder bills per test, Astra bills per target per year, Pentest-tools bills per month by asset count, and Cobalt bills credits sized to engagement complexity. Compare two quotes only after both state the target count and the type of test.

Is a vulnerability scanner the same as a penetration test?

No. Pentest-tools' NetSec and WebNetSec are scanner subscriptions, from $95 and $140 a month at five assets. A scanner reports known issues across assets, while a penetration test tries to exploit them and shows the impact. Pentest Suite adds automated exploitation, which is closer to a test, but it is still software. The vulnerability scanner ranking explains the scanner side in more detail, and the Tenable review is the next page to read for a paid scanner.

Does Cobalt publish its prices?

Not per tier. The Standard, Premium and Enterprise tiers say get a quote, with no figure on the pricing page. The published unit is the Cobalt Credit, which Cobalt equates to 8 traditional pentesting hours, sold in annual packages.

How we priced this

We read the pricing pages of Intruder, Astra, Pentest-tools and Cobalt on 10 October 2026. Where a page shows two figures for one plan, we print both and say which arithmetic we did. The tool count and median come from the security ranking on Toolradar, updated in October 2026. We did not test any of these products, and we did not estimate a price for a quote-only tier.

Cite this: Cyberpresso, "How Much Does a Penetration Test Cost in 2026?", October 2026.

Pentest prices and the vendor changes that move them show up in the Cyberpresso newsletter. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.