How much does a penetration test cost? What drives the price for a 100‑person company

The short answer

A penetration test costs what its scope costs. For a 100‑person company, a typical full picture is an external test of the internet-facing systems, an internal test that starts as a normal user on the network and tries to reach domain admin, and a test of the one or two web applications customers or staff log in to. Clayton Cybernetics publishes a fixed price for each in its shop, listed below, and confirms the price for your scope before work starts.

Our published prices

• External penetration test, up to 25 IPs: $2,400 per test, up to 25 IP addresses. Report within 8 business days of kickoff.
• External penetration test, up to 100 IPs: $4,800 per test, up to 100 IP addresses. Report within 12 business days of kickoff.
• External penetration test, up to 500 IPs: $8,900 per test, up to 500 IP addresses. Report within 20 business days of kickoff.
• Internal penetration test, Active Directory focus: $4,900 per environment. Report within 10 business days of kickoff.
• Web application penetration test: $3,500 per application. Report within 10 business days of kickoff.
• Retest package: $1,100 per retest, up to 25 findings. Updated report within 5 business days.

Each external, internal and web application test above includes one retest within 60 days. The Retest package is for confirming fixes to findings from an earlier test, ours or another firm's. Prices are for the listed scope and are confirmed before work starts.

A worked example for a 100‑person company

Take a firm with a small public footprint of up to 25 IP addresses, one Active Directory environment and one customer-facing web application. At the published prices that is External penetration test, up to 25 IPs ($2,400), Internal penetration test, Active Directory focus ($4,900) and Web application penetration test ($3,500), which add up to $10,800 for the three tests, each with its retest within 60 days. A firm with a larger footprint of up to 100 public IP addresses would use the $4,800 external test instead. Your own scope is confirmed before work starts.

What drives the price

• Number of external IP addresses and services. More addresses and more exposed services mean more manual testing, which is why the external test is priced in bands of up to 25, 100 and 500 IPs.
• Internal network size and Active Directory. An internal test starts from a normal user position and tries to reach domain admin. A larger directory, more sites and more segmentation to test take longer.
• Web applications and APIs. Each application or API is its own scope, with its own user roles, login flow and business logic. Manual testing of every role is the main cost.
• Authenticated testing. Testing with accounts for each role finds access-control flaws that an anonymous test cannot reach, and takes more time. The NCSC describes the same trade-off between opaque (closed box) and transparent (open box) tests.
• Retesting. Fixing and confirming is where the value lands. Check whether a retest is included, and for how long.
• Reporting depth. A report that ranks findings with plain-language impact, shows proof and the fix for each, and is walked through with an engineer takes longer than a raw tool export.
• Timing. Compressed schedules, out-of-hours windows and fixed compliance deadlines can change what a provider can offer.

Why quotes vary so much

Public cost guides give very different ranges because the word penetration test covers a scan with a cover page and a multi-week manual engagement alike. We do not quote market ranges here, because the ranges published by vendors are not a standard. Ask any provider what is in scope, whether testing is manual, whether a retest is included, and what the report contains. The UK NCSC guidance on penetration testing and NIST SP 800-115 describe what a well-scoped test is and what it can and cannot tell you.

What to prepare before you ask for a quote

• A list of the public IP addresses and domains you own, and what runs on them.
• The number of internal sites and the size of your Active Directory.
• The web applications and APIs in scope, with their user roles.
• Any deadline from a customer, insurer or standard such as PCI DSS.
• Written authorization from the owner of every system in scope.

Our article on choosing between a penetration test, a vulnerability scan and a red team explains which one answers which question, and our article on written authorization lists what the signed scope should contain.

Sources

• UK NCSC: Penetration testing guidance
• NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
• PCI Security Standards Council: Penetration Testing Guidance

This article is general information. Prices are for the listed scope and are confirmed before work starts. Penetration testing must always be authorized in writing by the owner of the systems tested. Last reviewed November 10, 2026.

Next article

Next · SoftwareWhat Your Company Can Move to Open Source in 2026, and What to KeepMost per-seat software now has an open-source answer, but not every tool should move. This guide goes category by category, from desktops and office suites to ERP, CAD, design, video, files and cameras, and says what moves easily and what needs care. It explains how to estimate the saving from your own invoices, the migration path with training before and after, and how AI agents keep the platform running.9 min read

Related reading

• SecurityProtecting Unreleased Content: Access Control, Watermarking and Freelancer Accounts for Media Production8 min
• SecurityEntra ID Protection Risk Policies: User Risk, Sign-In Risk, Licensing and Self-Remediation8 min