Pentest pricing
How much does a penetration test cost?
A web app pentest from a testing firm usually costs $5,000 to $30,000. AI pentests built for SOC 2 and ISO 27001 evidence now sell for about $1,500 to $3,500 a test. Every price below links the page it came from, as published in November 2026.
Manual pentests from a testing firm
- Web application pentests: $5,000 to $30,000. (Synack, as of 2026-11)
- A boutique firm's ranges: simple app $4,999 to $8,999, medium $8,999 to $20,000, complex $20,000 to $30,000 and up. (Blaze Information Security, as of 2026-11)
- Web and API pentest, manual, from $10,800, with 3 retest rounds over 12 months. (Software Secured pricing, as of 2026-11)
- Pentest packages are quoted; one credit is 8 testing hours. (Cobalt pricing, as of 2026-11)
AI and hybrid pentests
- Intruder AI pentest: $3,500 a test, or $12,000 for 4. (Intruder pentest pricing, as of 2026-11)
- Astra: Pentest Auto $2,999 a year; Pentest Expert, with manual testing, $5,999 a year, each for one target. (Astra pricing, as of 2026-11)
- jeerc Audit Pentest: $1,490 at launch, rising to $1,990 after our first 20 customers; $990 on Team. Bought by card in the app. An automated AI pentest (no human review) is $99.
What changes the price
- Scope: how many apps, roles and API endpoints are tested.
- Manual hours: a firm prices by tester days; an AI pentest prices per test.
- Retests: some prices include them, some charge per round.
- The report: whether a credentialed person reviews and signs it.
Which one you need
If your auditor or customer requires a human-led or CREST test, buy one from a firm; an AI pentest will not meet that requirement. For a first SOC 2 Type 1 or ISO 27001 audit, an AI pentest with a signed report can be enough. Send us your auditor's requirements; we confirm fit before you pay. jeerc and Intruder compared.