Pentest Pricing in 2026
What does a pentest cost? That depends on scope, complexity, test depth and the reporting you need. At Monkeys ICT you get a clear estimate and well-defined scope upfront.
Indicative price ranges
- Small web app pentest: from €1,250
- Average web app/API pentest: €2,500 – €5,000
- Extensive external pentest: from €3,500
What determines the price?
- Number of pages/endpoints and features
- Complexity of authentication and roles
- Availability of a test environment and documentation
- Deadline and reporting requirements
- Whether a retest after fixes is included
FAQ
Can you give a fixed price?
Yes, after intake and scoping we provide a fixed quote.
What’s included in the report?
Findings, impact, reproducibility and concrete remediation advice.
Detailed price indications per test type
The ranges below are indicative. You’ll always receive a final price after a brief intake and scoping conversation — free and without obligation.
| Type of pentest | Duration | Indicative price |
|---|---|---|
| Small web application pentest | 1–2 days | from €1,250 |
| Average web app / login environment | 2–3 days | €2,500 – €4,000 |
| Extensive web application pentest | 3–5 days | €4,000 – €7,000 |
| API pentest (REST/GraphQL) | 1–3 days | €1,500 – €4,500 |
| External pentest (infrastructure) | 2–4 days | €2,500 – €5,500 |
| SaaS platform pentest | 3–5 days | €4,000 – €8,000 |
| DigiD IT security assessment | 2–4 days | €2,500 – €5,000 |
| Security assessment for SMEs | 3–5 days | €3,000 – €6,000 |
All prices exclude VAT and are indicative. A retest after remediation is optional and priced separately.
What’s always included?
- Intake and scoping (free and without obligation)
- Manual testing by an experienced pentester
- A report with findings, CVSS scores and concrete remediation advice
- A management summary for leadership or the board
- A debrief of the report
Also see: what is a penetration test? | request a quote directly