You searched for pen test pricing, got a handful of quotes, and one came in at $5,000. Maybe a couple came in lower. A few were significantly higher and you wondered what on earth justified the difference. You probably went with the number that felt reasonable and signed off. 

Here is the uncomfortable truth: a $5,000 pen test is almost always a vulnerability scan with a different label on it. Not a penetration test. This post explains what the difference is, what each one actually costs, and how to make sure you are getting what you are paying for. 

Watch: What Real Pen Testing Actually Looks Like 

So What Does a Real Pen Test Cost? 

A real penetration test runs between $18,000 and $33,000, depending on company size and what is being tested. That range reflects the actual market rate for skilled, manual, human-led offensive security work and is consistent across reputable firms in this space. 

That price range will surprise some people. It should not. Here is why the number is what it is, and here is what you are not getting at $5,000. 

What a $5,000 Pen Test Actually Gets You 

Vulnerability scanners are real tools. They crawl your network, check your systems against a database of known issues, and produce a report of potential problems. Some are genuinely useful. You can buy a decent one for a few hundred dollars and run it yourself. 

What vendors in this space have figured out is that buyers expect a low number, and some of them have gotten very good at meeting that expectation while delivering something much weaker than what was asked for. They run the scan, generate a PDF, put a cover page on it, and call it a penetration test. The report looks thorough. It has findings, severity ratings, and recommendations. And it tells you almost nothing about whether a real attacker could actually get into your environment. 

A vulnerability scan produces a list of things that might be exploitable. A penetration test confirms which ones actually are, traces how far an attacker could go using them, and shows what the real-world damage would look like. Those are fundamentally different questions with fundamentally different answers. 

To Be Fair: What Automated Tools Are Actually Good At 

Automated scanning has a legitimate place in a security program. It is fast, it scales across large environments, and it is genuinely useful for ongoing monitoring between pen tests. If you need to know whether a known CVE has appeared in your systems since last month, a scanner will tell you quickly and cheaply. 

For compliance checkboxes that require evidence of regular scanning, automated tools do the job. For catching low-hanging fruit across a large attack surface, they are reasonable. If your security budget is very limited and you have to choose between a scanner and nothing, choose the scanner. 

The problem is not automated tools. The problem is when a scan gets sold as the whole picture, or when a vendor uses the word penetration test to describe work that a $500 tool is doing on their behalf. The question you need to ask any vendor is simple: will a person be actively trying to get into our environment, or will a tool be running signatures and generating a report? The answer to that question determines what you are actually buying. 

What Happens in a Real Penetration Test 

A real pen test takes about four weeks from start to finish. The work breaks into four distinct phases and understanding them makes it a lot easier to evaluate what any vendor is actually offering you. 

The first week is OSINT, which stands for open-source intelligence gathering. Before anyone tries to get into your environment, the team looks at everything publicly available about your organization: what systems are exposed, what information has been leaked, what the attack surface looks like from the outside. The goal is to approach your environment the same way an attacker would, without any inside knowledge. A good pen test firm does not want you to tell them where the doors are. They want to find the doors themselves. 

The second week is active attacking. The team tries to get in through the front door, through a window, or down the chimney. Once something is exploited, they follow it as far as it will go to understand what a real attacker could actually reach. This is the work a scanner cannot do, because it requires judgment, creativity, and the ability to chain multiple small weaknesses together into a path that goes somewhere. 

After that comes the report. This should be a documented account of exactly what the team did, with screenshots showing how they got in, what they accessed, what the real-world impact would have been, and how to fix each issue so it cannot happen again. After the report is delivered, you get a remediation window to make fixes, and then a retest to confirm the vulnerabilities are actually closed. 

That full cycle, done properly, is why the price is what it is. 

The Four Types of Pen Tests (and Where Most Companies Should Start) 

There are four main categories of pen test: external, internal, web application, and mobile. External testing focuses on what is reachable from outside your network. Internal testing simulates what happens after an attacker gets in, typically through a phishing attempt, and starts moving through your environment. Web app testing focuses on a specific application, like a customer portal or a SaaS product. Mobile testing covers apps on phones. 

If you have never done a pen test before, start with external and internal. External to find out how hard it is for someone to break in from the outside. Internal to find out what someone could do if they got in through a phishing attack, because phishing is how the overwhelming majority of real breaches begin. Starting with both gives you the clearest picture of your actual exposure. 

On frequency, two a year is the right answer for most organizations, and one a year is the acceptable minimum. Zero is not a security program. Your environment changes constantly through software updates, new integrations, new staff, and new credentials, which means a pen test that is twelve months old may not reflect what you are actually running today. Organizations that want pen testing built into an ongoing security program rather than treated as a one-off project can also explore it as part of a Cybersecurity as a Service engagement. 

How to Tell Whether You Got a Real Pen Test 

The fastest way to evaluate a pen test report is to look for three things.  

First: are there screenshots showing how the tester actually got in? A scan report will list potential vulnerabilities, where a real pen test report shows you the steps taken, with evidence.  

Second: does the report describe the full attack path, not just a list of findings? Getting in is one thing. What the tester could reach from there is what matters.  

Third: is there a retest included after remediation? Any firm doing serious work will want to verify that the issues they found are actually fixed, not just marked as resolved. 

If your last report did not have those things, you did not get a real pen test. You got a scan with a fancier label. 

Why the Price Reflects the Work 

The people doing this work well are hard to find and expensive to employ. They need to think like attackers, which means staying current on how attackers actually operate. They need to be methodical enough to document every step for a client report. And they need to be good enough communicators to explain what they found to an IT director and a CEO in the same conversation. 

The people doing this work carry credentials that are genuinely hard to earn. CREST is an international accreditation body that certifies cybersecurity firms who meet rigorous standards for penetration testing quality, recognized by governments and regulators globally. CISM from ISACA validates expertise in security management and requires a minimum of five years of hands-on experience to qualify for. CISSP from ISC2 is widely regarded as the most globally recognized certification in information security. Point Solutions Security holds CREST accreditation, and fifty percent of the team carries CISM while forty percent hold CISSP. The work a scanner does in an afternoon is not the same as what an entire accredited team does over four weeks, and the price reflects that. 

“You can’t see the storm you’re in as well as somebody from the outside can see it. You’re so entrenched in the environment that getting a third party who doesn’t give a sh*t what anyone believes and is just working on what they can find — that’s probably the biggest piece of value we can provide. This unabashed, confident delivery of: here’s what this looks like. We’re here to help.” Chris Brown, Vice President of Commercial Services, Point Solutions  

The right frame for evaluating pen test pricing is not finding the cheapest option that still looks like a pen test. It is asking what it would cost to find out the hard way that your environment was wide open.  

The enterprise numbers get all the headlines, but small and mid-sized businesses bear this risk just as acutely. According to the Verizon 2025 Data Breach Investigations Report, SMBs are now targeted nearly four times more often than large organizations, and ransomware was present in 88% of SMB breaches, compared to 39% at larger companies, with a median ransom payment of $115,000. That ransom figure alone does not account for downtime, lost customers, or regulatory exposure.  

For manufacturing organizations, where an unplanned production halt can run $125,000 per hour according to the IBM Cost of a Data Breach Report, and for SaaS companies and government agencies operating under strict compliance frameworks, the financial and operational consequences of a breach extend well beyond the initial incident. Compared to a pen test investment in the $18,000 to $33,000 range, the math is not complicated. 

The Bottom Line 

Vulnerability scans have a place. Use them for ongoing monitoring or use them to stay aware of your surface between engagements. But do not confuse them with finding out whether a motivated attacker could get into your environment, what they could do once they got there, and how to stop them. 

If you got a quote at $5,000, you now know what that number buys. If you are ready to find out what your environment actually looks like to someone who is trying to get in, that conversation starts with a proper pen test assessment. 

Request your pen test here:  Contact Us | Point Solutions Security 

Better us finding it than them.