Why a pentest costs $20 now
Pentest firms quote $5,000 to $30,000 and weeks of waiting. Most of that is hours that software now does in minutes. Here’s where the money went and what’s left to pay for.
What a pentest costs today
Ask a firm for a SOC 2 penetration test and the quotes land in the same range everywhere. Vanta writes that tests “start at $5,000 and can go up to $15,000”1. Secureframe puts the average between $8,000 and $10,0002, and Synack lists $5,000 to $30,000 for a web application3. Then you wait: one to four weeks for the test itself1, after three to six weeks to get on the calendar4.
Where that money goes
A pentest is billed by the hour, and most of the hours aren’t the part you’d call hacking:
- Selling and scoping. Calls, a statement of work, a rules-of-engagement document.
- Reconnaissance. Listing your hosts, subdomains, ports, certificates and software versions. Every firm starts with the same public tools.
- Running the checks. TLS, headers, exposed files, known vulnerabilities, misconfigurations: checklists the industry wrote down years ago (the OWASP Web Security Testing Guide, PTES, NIST SP 800-115).
- Writing the report. Scoring each finding, finding the evidence, writing the fix, mapping it to SOC 2, formatting it into a PDF your auditor accepts.
Software already did most of the second and third. The fourth used to need a person. It doesn’t anymore.
What changed
Two results from 2025 show where this is going. XBOW, an autonomous AI pentester, reached the top of HackerOne’s US leaderboard: “For the first time in bug bounty history, an autonomous penetration tester has reached the top spot on the US leaderboard.”5 And in DARPA’s AI Cyber Challenge, the competing AI systems “discovered 54 unique synthetic vulnerabilities in the Final Competition’s 63 challenges. Of those, they patched 43.”6
The market noticed. By October 2026 a compliance platform was giving new customers a free AI pentest, describing it as “turning a pentest that traditionally takes weeks into a full, auditor-ready result in about a business day.”7
When a pentest report is something software makes, its price falls toward what the software costs to run. A test of one domain costs us cents in compute and a few cents for the AI that writes the summary. $20 covers that, the payment fees, and the work of keeping the checks current.
What’s left to compete on
If everyone can make a pentest report, the difference between a good one and a bad one is rigor:
- Evidence, not claims. Every finding in our report shows the request we sent and the answer we got. No “potential issue detected.”
- A standard score. CVSS v3.1 for every finding, with its vector, CWE and OWASP category, so nobody has to trust our adjectives.
- Honest scope. We say exactly what was tested and what wasn’t. An automated external test doesn’t see behind your login, and our report says so on the scope page.
- Permission first. We deep-test a domain only after its owner proves it’s theirs. That’s what makes the report valid evidence, and it’s the law.
- Fixes that work. The exact header, record or config line, and a retest to prove it’s closed.
What $20 buys
| Included | Details |
|---|---|
| The deep test | 50 ports, 80 sensitive paths, up to 30 subdomains, TLS and ciphers, headers, cookies, CORS, open redirects, DNS and email, zone transfer |
| The report (PDF) | Executive summary, scope and method, SOC 2 control map, every finding with CVSS, evidence and fix, attack-surface appendix |
| Letter of attestation | One page for security questionnaires, with a public link anyone can use to check it |
| Retests | Three within 30 days, so the report can show the fixes |
When you still need a firm
If an enterprise customer or your auditor asks for a manual test of your logged-in application, its business logic or your internal network, you need people for that. Our report is still useful there: it’s the reconnaissance and the external findings, done, so a firm can scope a smaller engagement.
See your own grade
Scan your domain and see what an attacker sees.
Sources
- Vanta, How to do penetration testing:
Typically these tests start at $5,000 and can go up to $15,000 depending on the scope and the testing company you choose.
- Secureframe, Pen testing 101:
the majority of pen tests cost between $5,000-$20,000, with the average being between $8,000-$10,000.
- Synack, Penetration testing cost:
Web application $5,000–$30,000
- Software Secured, SOC 2 penetration testing:
Scheduling within 3-6 weeks - sometimes sooner.
- XBOW, How XBOW reached #1:
For the first time in bug bounty history, an autonomous penetration tester has reached the top spot on the US leaderboard.
- DARPA, AI Cyber Challenge results:
In total, competitors’ systems discovered 54 unique synthetic vulnerabilities in the Final Competition’s 63 challenges. Of those, they patched 43.
- Drata, Partner POV: Aikido Security:
turning a pentest that traditionally takes weeks into a full, auditor-ready result in about a business day.