A penetration test is a controlled, authorized attack on your app, API or network that finds the flaws a real attacker could exploit, proves their impact and tells you how to fix them. The cost is driven by scope, not by a flat rate: as a reference point, our pentest of a mobile app plus its API starts at USD 2,500 and takes 1 to 3 weeks, while multi-platform products with several user roles take longer and cost more.
Pentest vs vulnerability scan vs security audit
A penetration test is a manual, tool-assisted assessment in which a specialist exploits vulnerabilities to demonstrate real impact. The most expensive mistake in this market is paying for a pentest and receiving something else. Here is how the three commonly confused services differ:
| Service | What it does | What you get | When to use it |
|---|---|---|---|
| Vulnerability scan | An automated tool looks for known vulnerable versions and misconfigurations. | A long list of findings, many false positives, nothing exploited. | Continuously or monthly, as hygiene. |
| Penetration test | A specialist combines tooling with manual work to exploit flaws, including business logic. | Confirmed findings with severity, evidence, reproduction steps and remediation. | Before launch, after major changes and at least annually. |
| Security audit | Reviews controls, policies, configurations or code against a standard (SOC 2, ISO 27001, HIPAA). | Compliance gaps and recommendations. | For certification, attestation or customer due diligence. |
Auditors and enterprise customers increasingly ask for the pentest report itself, not just a scan export, so the distinction matters commercially as well as technically.
Types of penetration testing
Pick the test type based on where your risk lives. For most SaaS companies and app-driven startups, that is the application and the API behind it.
- Web application: authentication, sessions, access control, injection, file upload and business logic, following the OWASP Web Security Testing Guide.
- Mobile app (iOS and Android): local storage, network traffic, certificate pinning, secrets embedded in the binary and backend communication, based on OWASP MASVS and MASTG.
- API: today the target with the most critical findings, because it enforces data authorization. Our guide to API security and the OWASP API Top 10 covers it in depth.
- Cloud: IAM permissions, exposed storage, networking and misconfigured services on AWS, Google Cloud or Azure. See our AWS hardening checklist.
- Internal and external network: what an attacker sees from the internet, and how far they get after compromising a laptop.
- Social engineering: simulated phishing or vishing campaigns that measure how many people hand over credentials.
Black box, grey box or white box
In black box testing the tester gets no information, like an outside attacker. In grey box they receive test accounts for each role and API documentation. In white box they also get source code and architecture. For apps and APIs we recommend grey box: the same budget covers far more ground, and cross-role authorization flaws only surface when the tester holds accounts with different privileges.
How scope drives penetration testing cost
A pentest is priced on effort: the specialist days needed to cover the scope in depth. These are the variables that move the number most:
- Applications and platforms: Android only is not the same as iOS, Android and a web admin console.
- User roles: every role (customer, operator, admin, partner, tenant) multiplies the authorization combinations to test.
- API endpoints: 30 endpoints take days; 300 require prioritization or more time.
- Environments: staging is faster and safer; production needs testing windows and extra care.
- Critical flows: payments, transfers or PHI deserve dedicated business-logic testing.
- Formal deliverables: re-test, attestation letter or a report formatted for your SOC 2 auditor.
Indicative penetration testing pricing
The figures below are indicative ranges, not a quote; the real price comes from your specific scope. Use them to sanity-check whether proposals are in a reasonable order of magnitude.
| Typical scope | Indicative range | Duration |
|---|---|---|
| Standalone API, few roles | USD 2,000 to 4,000 | 1 to 2 weeks |
| Mobile app + its API | From USD 2,500 | 1 to 3 weeks |
| iOS + Android + API + web console | USD 5,000 to 10,000 | 3 to 5 weeks |
| Cloud configuration review (one account) | USD 2,500 to 6,000 | 1 to 2 weeks |
| External and internal network, one office | USD 3,000 to 8,000 | 1 to 3 weeks |
Be wary of two extremes: a "full pentest" for a few hundred dollars is almost always an automated scan, and a proposal without a written scope cannot be compared with anything. A nearshore team in Quito works in UTC-5 year-round, aligned with US Eastern time in winter and Central time in summer, so critical findings reach your engineers the same day. Our cybersecurity services page explains how we scope fixed-price engagements.
The pentest process, step by step
- Scope and rules of engagement: in-scope and out-of-scope assets, environments, testing windows, forbidden tests (for example denial of service), emergency contacts and stop conditions.
- Written authorization: signed by someone with authority over the systems, plus an NDA. If you run on AWS, Azure or Google Cloud, the provider policy on security testing is checked too. No authorization, no pentest.
- Execution: reconnaissance, attack surface mapping, manual testing and controlled exploitation. Critical findings are reported immediately, not at the end.
- Reporting: technical and executive, prioritized by risk.
- Remediation and re-test: your team fixes and the tester verifies each finding is closed. Without a re-test you do not know whether the fix worked.
What a good pentest report contains
The report is the product you are buying. Ask for an anonymized sample before signing and check that it includes:
- Executive summary in business language: overall risk, the three or four issues that matter and the decisions needed.
- Standardized severity using CVSS (version 4.0 has been current since 2023), adjusted to your business context rather than the raw tool score.
- Evidence: requests and responses, screenshots and test data that prove impact.
- Reproduction steps your engineers can follow.
- Specific remediation for your stack, not a generic link.
- Scope and limitations: what was tested, what was not and with which accounts.
How to choose a provider, and red flags
Ask which methodology they follow (OWASP WSTG, MASTG, NIST SP 800-115), who performs the testing, how many manual testing days the proposal includes and whether the re-test is included. Common red flags:
- A several-hundred-page report exported from a scanner, with no reproduction steps or confirmed exploitation.
- A flat price quoted without asking about roles, endpoints or platforms.
- No authorization or business-logic findings at all: those are exactly what scanners miss.
- No written authorization or rules of engagement.
- Promises of "zero vulnerabilities" or a "security certificate" after the test.
How often to run a penetration test
Standard practice is at least annually and after every significant change: a new app, a payments module, a cloud migration or an authentication redesign. If you handle cardholder data, PCI DSS v4.0.1 requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant changes, with exploitable findings corrected and re-tested. SOC 2 and ISO 27001 programs do not mandate a pentest by name, but auditors and enterprise buyers routinely expect one; see our guide on ISO 27001 for startups. Between tests, wire automated checks into your pipeline as described in DevSecOps for CI/CD.
Frequently asked questions
How much does a penetration test cost?
It depends on scope: number of applications, platforms, user roles, API endpoints and environments. As a reference, our pentest of a mobile app plus its API starts at USD 2,500 and takes 1 to 3 weeks. Products with iOS, Android, a web console and several integrations need more specialist days. Always ask for a written scope, the number of manual testing days and whether the re-test is included.
What is the difference between a vulnerability scan and a pentest?
A vulnerability scan is automated: it flags known vulnerable versions and misconfigurations, produces many false positives and exploits nothing. A penetration test is performed by a specialist who confirms each flaw, demonstrates its impact and tests business logic and cross-user authorization, which is where the most serious findings live. Scanning is continuous hygiene; pentesting is a periodic deep assessment.
Is a nearshore pentest accepted for SOC 2 or by enterprise customers?
Auditors and customers care about methodology, independence and report quality, not the tester location. A report that documents scope, methodology (OWASP, NIST SP 800-115), CVSS severity, evidence and re-test results is what they review. Make sure the contract covers confidentiality, data handling and the right to share the report or an attestation letter with customers.
Can a pentest break my production environment?
With well-defined rules of engagement the risk is low. Testing windows are agreed, destructive tests such as denial of service are excluded, and a staging environment equivalent to production is preferred. Any test with potential impact is agreed in writing beforehand, and critical findings are reported immediately so your team can act.
What is grey box penetration testing?
Grey box testing gives the tester partial knowledge: test accounts for each role and API documentation, but not the source code. It is the most efficient approach for apps and APIs because it lets the tester check whether one user can read or change another user's data, the most common and damaging flaw, without spending days on blind reconnaissance.
Conclusion
A good pentest is not measured by the number of findings but by their usefulness: confirmed flaws, prioritized by real risk, with a clear path to fix them. Define scope carefully, insist on grey box for apps and APIs, review a sample report and never accept a scan under another name. To find out how exposed your product is today, explore our cybersecurity services or book a free consultation and we will propose a fixed-price scope.