Your security posture depends on finding threats before attackers do. Penetration testing costs vary dramatically based on scope, but understanding internal versus external assessments helps you allocate budget wisely and get the right coverage. Let's break down what each approach costs and when to use it.
What You're Paying For
Penetration testing fees depend on five core variables: assessment scope (how many systems), complexity (legacy infrastructure costs more), duration (timeframe to complete testing), tester expertise (specialized skills command higher rates), and reporting depth (executive summaries versus detailed remediation guidance).
Internal assessments typically run $8,000–$25,000 for small organizations (under 500 users), while external testing ranges from $6,000–$20,000. Mid-market companies (500–5,000 users) pay $15,000–$50,000 for either type. Enterprise assessments exceed $50,000 and often involve both simultaneously.
Internal Penetration Testing Costs
Internal testing simulates threats from employees, contractors, or compromised internal systems. You're paying for a tester to operate inside your network perimeter, which requires physical or remote access to your infrastructure.
What drives internal testing costs up:
- Network segmentation complexity (heavily segmented networks take longer to map and exploit)
- Number of internal applications and databases
- Security controls like endpoint detection and response (EDR) tools
- Requirement for extended testing windows (nights/weekends to minimize business disruption)
- Need for physical office access or VPN credentials
Internal assessments typically take 5–10 business days for a focused scope (single department or application) and 15–30 days for full infrastructure testing. Expect reports 1–2 weeks after testing concludes.
External Penetration Testing Costs
External testing targets your internet-facing assets: websites, APIs, email servers, VPNs, and publicly exposed applications. This approach mirrors real-world attacker behavior and requires no internal network access.
Factors affecting external testing price:
- Number of internet-facing IP addresses (more targets = longer engagement)
- Web application complexity (custom-built apps cost more than off-the-shelf software)
- SSL/TLS certificate inventory and management
- Third-party integrations and APIs
- Geographic distribution (multi-region systems add complexity)
External assessments run 3–15 business days depending on asset count and vulnerability depth. A small organization with a single website might finish in 3–5 days; a company with 20+ subdomains, multiple APIs, and cloud services typically needs 10–15 days.
Comparing Cost-Per-Asset
One way to evaluate pricing: cost per target. If a provider quotes $12,000 for external testing and you have 15 IP addresses in scope, that's roughly $800 per target. If another quote is $15,000 for 25 targets, that's $600 per target—potentially better value, though scope quality matters more than raw cost.
Internal testing often costs slightly more per target because testers need direct access and must navigate complex lateral movement scenarios.
Hidden Costs to Anticipate
Follow-up retesting: Budget $3,000–$8,000 for a post-remediation retest to verify fixes actually work. Most reputable providers build this into their scope.
Compliance-specific assessments: If you need PCI DSS, HIPAA, or SOC 2 compliance testing, expect 15–25% higher fees because testers must follow strict methodologies.
Rush engagements: If you need results in under two weeks, add 20–30% to the quote.
Reporting customization: Standard reports are included, but executive summaries for your board or detailed remediation plans for your team may incur extra fees ($500–$2,000).
When to Choose Each Type
Choose external testing if your primary risk is internet-facing threats, you have limited budget, or you're new to penetration testing. Choose internal testing if you've already passed external assessments, you're highly concerned about insider threats, or you operate sensitive systems (healthcare, finance, critical infrastructure).
Mature security programs run both annually: external in Q1 and internal in Q3. This prevents testers from becoming too familiar with your defenses while maintaining consistent coverage.
How to Get Accurate Quotes
Provide vendors with a detailed scope document: IP ranges, application inventory, user count, and testing windows. Vague requests generate inflated estimates. When comparing proposals, ensure all quotes cover the same scope—what looks cheap might exclude reporting, retesting, or tool licensing.
Mercoly helps you compare and find trusted penetration testing and vulnerability assessment providers, letting you evaluate multiple firms side by side with transparent pricing.
Frequently Asked Questions
Q: Can I do one assessment per year or should I test more often? Annually is acceptable for most organizations, but quarterly or biannual testing provides better coverage if you deploy new systems or make significant infrastructure changes.
Q: Does external testing cover cloud applications like Salesforce or Azure? Yes—external testers assess anything accessible from the internet, including cloud apps and APIs, though your cloud provider's acceptable use policy may restrict certain testing techniques.
Q: What's the difference between penetration testing and vulnerability scanning? Scanning is automated and costs $1,000–$5,000 annually; penetration testing is manual, exploits vulnerabilities, and costs significantly more but reveals real-world risk.
Start by requesting quotes from three providers for your specific scope and compare deliverables, not just price.