Penetration Testing Services: Types, Process, Costs & How to Choose the Right Provider
Imagine a business customer’s security team sends a questionnaire the week before your SaaS contract is due to be signed. One question asks for recent independent penetration test results. You hold a scanner report, some internal code reviews and a launch date, but you are not sure those answer what the buyer is really asking. Choosing what to test, how deeply and with whom is a business decision before it is a technical one, and a poorly scoped test can spend budget while leaving the riskiest paths unexamined. This guide explains the service types, the process, published 2026 price evidence and a practical way to compare providers.
TL;DR
A penetration test is an authorized, scoped attempt to find and validate weaknesses. It shows risk at one point in time and cannot prove a system is secure.
Scope drives everything: assets, user roles, test depth and retesting decide both usefulness and price.
Published 2026 prices are not a market average. Public UK day rates cluster between roughly £800 and £1,500, while some online vendors publish per-test or annual prices from about US$3,000.
Ask providers to name the testers, share a sample report and agree written authorization before work starts. Accreditation matters where your buyer or regulator requires it.
Pentesting complements scanning, secure development and monitoring. It does not replace them or certify compliance.
What Are Penetration Testing Services?
Penetration testing services are authorized security assessments in which qualified testers try to find and safely validate weaknesses in an agreed target, such as a web application, API, network or cloud environment. They end with a prioritized report and remediation guidance. The results describe risk at one point in time and do not guarantee security.
Table of Contents
What Are Penetration Testing Services?
Penetration testing services are authorized, time-boxed security assessments in which testers use manual and automated techniques to find weaknesses in an agreed target, confirm which ones can actually be exploited and explain how to fix them. The UK National Cyber Security Centre frames the method as gaining assurance in a system by attempting to breach it the way an adversary might, and stresses that it is not a magic bullet.
What can be in scope
Almost any technology you operate can be tested if its owner authorizes it: web applications, APIs, multi-tenant SaaS platforms, networks, cloud accounts, mobile apps, wireless networks and, only with explicit written permission, staff through simulated social engineering. Write the scope down before work starts, including exclusions. For wider background, see Articsledge’s guides to cybersecurity, network security and cloud security.
Finding a weakness versus proving risk
A vulnerability scanner reports that a component looks outdated or a setting looks unsafe. A penetration tester goes further: can the issue be chained with others, does it expose another customer’s records, and what would an attacker gain? CREST’s guide describes a penetration test as an ethical attack simulation that shows the effect of exploitable weaknesses, while vulnerability assessment relies on automated tools and does not exploit what it finds.
What a test cannot promise
A test covers only the selected target, at one moment, within the time and access agreed. CREST lists these limits plainly: it may not uncover every weakness and plays only a small part in reviewing the people element. Treat a clean report as evidence about the tested scope, not proof that the business is secure, and plan controls against data leakage, monitoring and secure development alongside it.
Who Needs Penetration Testing—and When?
Organisations that expose applications or customer data to the internet usually gain from penetration testing, but timing should follow risk rather than a universal rule. No single law or standard says every business must test every year.
Common triggers
SaaS and API vendors: products used by many customers, especially SaaS platforms with an exposed API, carry cross-tenant and authorization risk worth testing before launch.
Major releases and architecture changes: CREST advises testing immediately after a major change to the system or the business environment it supports.
Customer security reviews: enterprise buyers often ask for recent independent test evidence before approving a supplier.
Cloud moves and new integrations: a cloud migration or new third-party connection changes the attack surface.
Incident follow-up: testing can check whether the weakness behind an incident was really closed.
Mandatory, recommended or optional?
Separate three cases. Some obligations are explicit: PCI DSS v4.0.1 Requirement 11.4 calls for internal and external penetration testing at least every 12 months and after significant change for entities in scope. Some are recommendations: the CIS Controls include a penetration-testing control, but CIS guidance is not law. Others are contractual or audit expectations, such as a customer questionnaire or a SOC 2 or ISO 27001 audit, where the evidence expected depends on your risk assessment and your auditor. Regimes such as the EU’s NIS2 directive centre on effective risk management rather than one prescribed test schedule, so confirm obligations with qualified counsel.
Types of Penetration Testing Services
Penetration testing is not one product. Providers group work by target and by how much information the tester receives. The categories below are general market categories. Articsledge’s published service page centres on scoped web application, API and SaaS application security assessments, plus vulnerability assessment and separately scoped remediation verification; cloud security assessments are also listed, with suitability confirmed in scoping. Everything else here is buyer education, not an offer.
Web application testing (Articsledge focus area)
Examines login, sessions, access control, input handling and business logic in web applications. Typical findings include broken access control and injection. Best for portals, storefronts and SaaS front ends. Limit: results depend on the roles and test data supplied.
API testing (Articsledge focus area)
Targets APIs that carry sensitive data. The OWASP API Security Top 10 (2023) opens with broken object level authorization and broken authentication. Best for API-first products and partner integrations. Limit: undocumented endpoints are easy to miss, which OWASP lists as improper inventory management.
SaaS application security assessment (Articsledge focus area)
Combines web and API testing with tenant isolation, roles, admin functions and integrations, which matters most for B2B SaaS. Limit: it needs several test tenants and roles, and cost rises with complexity.
External network testing
Probes internet-facing hosts, VPNs and firewalls; CREST calls it the most common type of test. Best for organisations with exposed infrastructure. Limit: it says little about application logic.
Internal network testing
Assumes an attacker already has a foothold and tests segmentation, credentials and privilege escalation across endpoints and servers. Best for office and hybrid networks. Limit: it needs network access and preparation, and suits purely cloud-hosted SaaS less often.
Cloud testing
Reviews identity, permissions, exposed storage and configuration in an agreed cloud account; see cloud-native security and infrastructure as code for context. Providers publish testing rules, covered in the process section. Limit: configuration review and exploitation testing are different activities.
Mobile application testing
Examines the app package, local storage and its API calls. iOS and Android are separate surfaces, so each may be priced separately. This is a general market category, not a stated Articsledge offer.
Wireless testing
Checks Wi-Fi configuration, encryption and rogue access points, usually on site. Best for offices and venues. Limit: it is irrelevant to a purely web-delivered product.
Authorized social engineering
Uses phishing or phone pretexts against staff, only with written permission and legal and HR agreement. Limit: CREST notes that tests play a small part in reviewing the people element.
Red-team and specialist assessments
Goal-based, often covert exercises that test detection and response as well as prevention; CREST describes red teaming as similar to, but not identical with, penetration testing. Best for mature teams with working threat detection and response. Limit: cost and coordination are higher.
Test type | Best for | Articsledge stated focus? |
Web application | Portals, SaaS front ends | Yes |
API | API-first products | Yes |
SaaS assessment | Multi-tenant B2B products | Yes |
External network | Exposed infrastructure | Confirm in scoping |
Internal network | Office or hybrid networks | Confirm in scoping |
Cloud accounts and configuration | Listed; confirm in scoping | |
Mobile, wireless, social engineering, red team | Specific risk scenarios | Not stated; confirm in scoping |
Black-Box, Gray-Box, and White-Box Testing
Black-box testing gives the tester no inside information, gray-box gives limited access such as user credentials, and white-box gives full information such as architecture and source code. Choose by the question you need answered, not by which label sounds strongest.
Approach | Information supplied | Best for | Trade-off |
Black-box | None beyond the target address | Simulating an uninformed outsider | Most realistic, but time may run out before deeper flaws are found |
Gray-box | Credentials, roles, some documentation | Authenticated application and API testing | Good coverage per day; common default for SaaS |
White-box | Full documentation, possibly code and architecture | Maximum coverage of a critical system | Efficient use of tester time, less like a real attack |
CREST reports that most clients specify white- or gray-box testing, and the NCSC notes that black-box work can leave vulnerabilities undiscovered in the time allocated. Most serious SaaS flaws sit behind the login screen, so authenticated testing usually improves coverage and often lowers cost for the same depth. No approach is universally superior.
The Penetration Testing Process: Step by Step
A well-run engagement moves from agreed objectives and written authorization, through testing and validation, to a report, remediation and a retest. The sequence below follows NCSC and CREST guidance and stays at planning level; it is not an intrusion playbook.
Objectives and risk ownership. Decide which decision the test supports, such as a customer review or a release, and name who owns the risk and accepts the findings.
Asset inventory and scope. List domains, applications, APIs, environments and user roles, and record what is out of scope. A requirements checklist helps keep the inventory honest.
Authorization and rules of engagement. Sign written permission that states test windows, permitted techniques, stop conditions and emergency contacts. CREST expects scope statements signed off by all relevant parties.
Environment and accounts. Prefer a production-like environment where disruptive checks are safe, create one test account per role, and share credentials only through an approved secure channel after engagement.
Reconnaissance and mapping. The tester maps pages, endpoints, technologies and trust boundaries to understand the attack surface.
Vulnerability discovery. Manual and automated techniques are applied against references such as the OWASP Web Security Testing Guide and the OWASP API Security Top 10.
Controlled exploitation and validation. Findings are confirmed with the least intrusive proof available. Testers avoid data theft or disruption and escalate critical issues immediately.
Evidence and business impact. Each finding gets reproducible evidence and a severity rating. The NCSC notes your own context can justify rating an issue higher or lower.
Report and debrief. A written report is followed by a walkthrough where engineers can ask questions.
Remediation prioritization. Your owners choose the fixes. The NCSC stresses that risk assessment and fix decisions remain your responsibility and may include alternatives to patching.
Retest and closure. Specific findings are re-verified after fixes and the report is updated.
Safety, third parties and cloud rules
The NCSC warns that no tester can guarantee a system will not react unexpectedly, so keep a technical contact available, take backups and agree stop conditions. If third parties host any part of the system, such as payment pages, identity providers or cloud platforms, obtain their permission. The AWS testing policy allows customer tests of its listed services without prior approval but prohibits denial-of-service and flooding, and requires a request for simulated events such as red-team or phishing exercises. Microsoft’s rules of engagement likewise prohibit denial-of-service testing and testing resources you do not own. Store evidence securely and agree how test data is deleted or returned. Release teams working in DevOps pipelines should schedule test windows around deployments.
What Does a Professional Penetration Test Deliver?
A professional test delivers a written report that states scope and method, ranks findings, shows evidence, explains business impact and recommends fixes, with options for a debrief and retesting. It does not deliver remediation or a compliance certificate.
Typical report contents
Scope, exclusions, assumptions and limitations
Methodology and the references used
Executive summary in business terms
Prioritized findings with severity ratings
Evidence and reproduction steps for authorized readers
Business impact of each issue
Remediation recommendations
Tester names, roles, qualifications and report date, which CREST lists as signs of a good report
Retest options
Remediation is separate from assessment
Fixing issues is engineering work that your team or another supplier performs. Retesting checks specific findings after fixes and is narrower than a new assessment. Articsledge’s service page describes remediation verification and retesting as separately scoped work.
An illustrative finding (fictional)
The example below is invented to show format. It is not client work.
Field | Entry |
Title | Cross-tenant invoice access |
Severity | High (illustrative rating) |
Affected area | Invoice retrieval endpoint of a fictional billing API |
Evidence | A standard user in tenant A requested an invoice identifier belonging to tenant B and received the record. Sample data is redacted in the report. |
Impact | Customers could read other customers’ billing details. |
Recommended fix | Enforce object-level authorization on the server for every request instead of relying on hard-to-guess identifiers. |
Retest status | Not yet retested |
How Much Do Penetration Testing Services Cost?
There is no single worldwide price. Published 2026 evidence shows UK public-sector day rates mostly between about £800 and £1,500 per consultant per day, and online vendors publishing per-test or annual prices for web applications from about US$3,000. A day rate is not a project price, and none of these figures is an Articsledge quotation.
Published price examples
The table lists figures read from public listings on 10 November 2026. Currencies are not converted or averaged. Tax treatment is as stated on each listing, so confirm it before budgeting.
Source and market | Scope or product | Published figure | Unit and nature |
UK Digital Marketplace: PRISM Infosec, G-Cloud 14 | Infrastructure penetration testing | £875–£1,200 | Per unit per day (day rate) |
UK Digital Marketplace: Zenzero Solutions | Cloud, network, web, mobile, wireless and red team | £800–£1,250 | Per unit per day |
UK Digital Marketplace: CyberCX UK | Penetration testing consultancy | £950–£1,500 | Per unit per day |
UK Digital Marketplace: Trustmarque | Penetration and security testing | £895 | Per unit per day |
UK Digital Marketplace: PureCyber | Web application testing roles | £950 UK rate; £2,000 offshore rate | Day rate per role |
Intruder (online vendor, US$) | White-box web application test; retesting listed as unlimited | US$3,500 per test; US$12,000 for a four-test pack | Per-test and pack prices |
Astra Security (online vendor, US$) | One web or SaaS app target including consumed APIs | US$2,999 per year (autonomous tier); US$5,999 per year (manual tier); from US$9,999 per year (enterprise) | Annual subscription; tiers list one and two re-scans |
Read these carefully. The UK entries are rate cards: a project multiplies the day rate by testing, reporting and retest days. The online products are packages whose tester seniority, automation and depth differ. Astra’s own FAQ says its manual test typically takes 10–15 working days and distinguishes it from automated scanning, and Intruder describes a white-box, AI-powered web application test built by CREST-certified experts. Compare days and deliverables, not headline numbers.
What the evidence does not show
Public evidence is thin for API-only, mobile, cloud, internal network and red-team work. Day rates exist, but dependable public project prices do not; Astra says mobile apps are quoted separately from US$2,200 per app. Aggregated guides give wider figures, such as US$5,000 to US$50,000 or more per engagement (Helix, 31 August 2026) and a median UK day rate of £1,000 across 30 G-Cloud 14 rate cards (Stingrai price index, 1 September 2026). Both are secondary sources, and Stingrai sells testing, so use them for context rather than as quotes.
Articsledge’s service page publishes no universal fixed price. It proposes scope-based engagements after reviewing requirements and specialist availability. Budget testing beside build and run costs; see web app development cost and software maintenance cost.
What Determines Penetration Testing Prices?
Price follows tester days, and days follow scope. The main drivers are asset count, complexity, user roles, authenticated depth, reporting and retest needs, deadline and safety constraints.
Assets: applications, APIs, tenants, networks and cloud accounts each add effort.
Complexity: features, integrations and business workflows increase the paths to test.
Roles and tenant isolation: every role multiplies the authorization checks.
Depth: authenticated gray-box or white-box work needs more days than a surface check.
Reporting and procurement: customer-specific formats, accreditation or cleared staff raise rates.
Retesting, urgency and geography: out-of-hours windows, tight deadlines and location change the quote.
Two illustrative budget models
Formula: (testing days + reporting days) × day rate, plus retest days × day rate. The rates below sit inside the published UK range, are assumptions rather than quotations and exclude tax.
Model | Assumptions | Calculation | Illustrative total |
A: focused web app, gray-box, two roles | 6 testing and 1.5 reporting days at £950; 1.5 retest days | (6 + 1.5) × £950 = £7,125; 1.5 × £950 = £1,425 | £8,550 |
B: multi-tenant SaaS with API, three roles | 12 testing and 2 reporting days at £1,100; 3 retest days | (12 + 2) × £1,100 = £15,400; 3 × £1,100 = £3,300 | £18,700 |
Savings come from sharper scope, not thinner testing. Test the highest-risk assets first, supply documentation and working test accounts so no days are lost, fix obvious issues beforehand, and book retest days up front. CREST warns that a cheap tick-box test may deliver little and can create false confidence, so ask what each quote buys. For contract structure, see fixed-price versus time-and-materials arrangements.
Penetration Testing vs. Vulnerability Scanning and Other Assessments
A penetration test is an expert-led attempt to validate and chain weaknesses, while a vulnerability scan is an automated search for known issues. They answer different questions, and neither replaces continuous vulnerability management.
Assessment | Purpose | Strength | Limitation | Use when |
Manual penetration test | Validate exploitable risk | Finds logic and chained flaws | Point in time; higher cost | Before a release, buyer review or major change |
Vulnerability scan | Find known issues automatically | Fast and repeatable | False positives; little logic depth | Continuous hygiene |
Vulnerability assessment | Identify and prioritize weaknesses | Broad coverage | Does not exploit findings | Planning fixes |
Security audit | Check controls against policy or a standard | Governance evidence | Not an attack simulation | Compliance programs |
Configuration review | Compare settings with benchmarks | Precise on hardening | Misses application logic | Cloud accounts and servers |
Code review | Inspect source for flaws | Finds root causes early | Misses runtime and configuration issues | During development |
Bug bounty | Invite researchers to report issues | Continuous, diverse skills | Uneven coverage and triage load | Mature products |
Red-team exercise | Test detection and response | Realistic objectives | Heavy; needs mature defenders | Mature security teams |
The NCSC treats penetration testing as assurance that your vulnerability management works, not as the main way to find vulnerabilities, and compares it to an external financial audit. Run scanning and monitoring continuously, using tools such as SIEM, and use tests to challenge that process. Articsledge’s service page likewise states that an automated scan is not a substitute for an expert-led test.
Penetration Testing Standards, Frameworks, and Compliance
Standards describe how to test or when to test; none turns a penetration test into a compliance certificate. Treat each source for what it is, and check versions before citing them.
Source | What it is | Status and limits |
US technical guide to security testing, published September 2008 | Guidance; dated but still widely referenced | |
UK guidance published 2017, reviewed 2022 | Guidance; recommends CHECK testers and companies for UK government bodies | |
Web testing catalogue; stable edition is v4.2, with a development edition heading toward 5.0 | Voluntary reference; cite the version | |
2023 list of API risk categories | Awareness list, not a test method | |
Buyer guide to running a testing programme, December 2022 | Guidance; CREST also accredits companies and certifies individuals | |
Control on testing the effectiveness of enterprise assets, in CIS Controls v8.1 | Voluntary framework, not law | |
PCI DSS v4.0.1, Requirement 11.4 | Payment card security standard, published June 2024 | Where it applies: internal and external tests at least every 12 months and after significant change, then retest corrections |
On 10 November 2026, the sources reviewed still described PCI DSS v4.0.1 as current; confirm this in the PCI Security Standards Council library before relying on it. The council also notes that whether an entity must validate compliance is set by the organisations that run compliance programs, such as payment brands and acquirers.
SOC 2, ISO 27001 and customer contracts
SOC 2 reports and ISO/IEC 27001 certification rest on your risk assessment and the auditor’s expectations. The 2022 edition of ISO/IEC 27001 includes Annex A controls on technical vulnerability management and security testing in development, but leaves method and frequency to you. Customer contracts can be stricter. A report is evidence; the assessor, card scheme or customer decides compliance. See Articsledge’s guide to cloud compliance for related obligations.
Company accreditation versus tester certification
CREST explains that an accredited company may employ unqualified testers, and a qualified tester may work for an unaccredited firm. It sees the combination of qualified individuals and an accredited organisation as the strongest assurance, partly because an independent body can handle complaints. Ask for both where a requirement exists. Where none does, ask who will test and how their skills are evidenced.
How to Choose the Right Penetration Testing Provider
Choose the provider whose named testers, method and report fit your actual environment and requirements, and compare candidates with a weighted scorecard instead of price alone.
What to verify
Skills that match your stack and test type, with evidence rather than assertion
Who performs the work, including roles, qualifications and any subcontracting
Scope, exclusions and assumptions in writing
Methodology and the share of manual testing, including authenticated and business-logic work
A sample report, not a marketing brochure
Accreditation and certification where your buyer or regulator specifies them
Liability, insurance, confidentiality and a signed authorization
Production safety, escalation contacts and evidence handling
References you can substantiate
Retest terms, deadlines and commercial conditions
A 100-point provider scorecard
This is Articsledge’s editorial evaluation framework, not an industry-certified standard. Score each criterion from 0 to 5 against your own rubric, multiply by the weight, divide by 5, and add the results. Apply the deal-breakers first.
Criterion | Weight | What a 5 looks like |
Relevant skills and named testers | 20 | Named testers with evidence for your stack |
Methodology and manual depth | 15 | Documented approach with authenticated and logic testing |
Scope clarity | 10 | Written inclusions, exclusions and assumptions |
Report quality | 15 | Sample shows evidence, severity and fixes |
Accreditation and assurance | 10 | Meets the requirements your buyer or regulator states |
Safety, authorization and data handling | 10 | Signed authorization, stop conditions, evidence handling |
Retest and remediation terms | 8 | Retest scope, window and price stated |
Commercial transparency | 7 | Days, rate, terms and insurance itemized |
Communication and availability | 5 | Contacts, escalation path and schedule confirmed |
Total | 100 |
Deal-breakers and red flags
No written authorization or scope document
Refusal to name the testers or their qualifications
Scanner output presented as a manual test
No sample report
A promise to find every vulnerability or to make you “100% secure”
A request to email passwords, keys or production credentials
Pricing that cannot be explained in days and deliverables
A realistic comparison (illustrative)
The scores below are hypothetical and name no real provider.
Provider | Score | Notes |
A | 82 / 100 | Named senior testers, clear sample report, retest priced separately |
B | 71 / 100 | Strong methodology, vague sample report; accreditation not required here |
C | 58 / 100 | Lowest price, scanner-style output, no tester names: disqualified by a deal-breaker whatever its score |
The same discipline applies when you evaluate a software proposal or vet any technical supplier.
Questions to Ask Before Requesting a Penetration Testing Quote
A quote is only as accurate as the brief behind it. Prepare the non-sensitive facts below, and share any secrets only after engagement, through an approved secure channel.
Copy-ready brief
Business objective: customer review, release, compliance driver or fix verification
Systems in scope: domains, applications, API specifications and whether testing targets staging or production
Size and stack: number of applications, user roles, endpoints and tenants, plus the technology stack
Integrations: third parties or cloud providers whose permission may be needed
Approach: black-, gray- or white-box, and which roles need authenticated testing
Constraints: exclusions, sensitive-data restrictions, test windows and deadline
Requirements: accreditation, report format or customer-specific conditions
Follow-up: reporting expectations and retest needs
Questions to put to each provider
How many testing days are proposed, and how are they split between testing and reporting?
Who will test, and what are their qualifications?
What are the testing boundaries and stop conditions?
What will I receive, and can I see a sample report?
Is a retest included, for how long, and at what price?
Which assumptions could change the price?
Never email passwords, private keys or production credentials in an initial enquiry. Articsledge’s own service page gives the same instruction, and test accounts are shared only after engagement. A secure client portal is one way teams exchange sensitive documents.
Common Penetration Testing Buying Mistakes
Buying a scan as a pentest. CREST stresses that scanners give generic output and false positives where a manual test adds depth.
Leaving scope vague. Unclear boundaries lead to missed assets or testing systems you do not own.
Skipping third-party consent. Cloud and hosting providers set their own testing rules.
Not checking credentials. Ask who tests and how their skills are evidenced.
Accepting vague reports. Findings need evidence, impact and fixes.
Leaving findings unowned. Assign an owner and a date to every issue.
Forgetting retest budget. Without it, fixes stay unverified.
Choosing the lowest quote. Compare days, depth and deliverables, not totals.
Testing too late. CREST notes late decisions leave little time, budget or room to fix issues.
Treating a clean report as proof of security. The NCSC says a test validates known issues only on the day it is run.
Which Penetration Testing Service Is Right for Your Business?
Match the first assessment to the decision you must make. When a scan, configuration review or code review fits better than a penetration test, choose that instead.
Scenario | Suitable first assessment | Note |
New customer-facing SaaS product | Gray-box web application and API test, including tenant isolation | Cross-tenant authorization is the highest-risk area |
API-heavy B2B platform | API test against the OWASP API Security Top 10 categories | Keep an up-to-date endpoint inventory |
Upcoming enterprise security review | Scoped test with a report in the format the buyer expects | Confirm accreditation needs before quoting |
Major application release | Targeted test of changed features and authentication | CREST advises testing after major change |
Existing unresolved findings | Remediation verification and retest | Narrower and cheaper than a new test |
Internal network risk | Internal network test or configuration review | Confirm scope and capability during scoping |
Cloud migration | Configuration review, then targeted testing once the landing zone is stable | Follow the provider’s testing rules |
Limited budget, no security baseline | Vulnerability assessment and secure development basics first | CREST advises establishing basic hygiene before significant testing |
Early-stage teams can plan testing inside the MVP budget and the web app timeline so results arrive before launch. Articsledge’s page states an initial focus on web application, API and SaaS assessments with remediation verification; for anything else, suitability is confirmed in scoping.
FAQ
What is included in penetration testing services?
A typical engagement includes scoping and written authorization, reconnaissance, vulnerability discovery, controlled validation of exploitable issues, a written report with severity ratings and fix guidance, and a debrief. Retesting and remediation help are often separate items, so confirm them in the proposal.
How much does a penetration test cost?
It depends on scope and tester days. Published 2026 UK day rates cluster between about £800 and £1,500, and some online vendors publish web application prices from about US$3,000. Multiply days by rate for a project estimate, then add retesting. Articsledge provides scoped quotations, not a fixed price.
How long does a penetration test take?
Duration depends on scope, access and availability. One vendor states that its manual test typically takes 10–15 working days, but complex systems can take longer and reporting adds time. Ask each provider for a schedule covering testing, reporting and retest.
Is penetration testing worth it for small businesses?
It can be, if you hold customer data, process payments or sell to buyers who ask for evidence. Start with the highest-risk application, fix basic hygiene first and keep scope narrow. If risk is low, a vulnerability assessment or configuration review may be a better first step.
How often should a company perform penetration testing?
Base it on risk and obligations. PCI DSS requires tests at least every 12 months and after significant change for in-scope entities, and CREST advises testing critical systems at least yearly and after major change. Otherwise, test after significant releases, architecture changes or incidents rather than by calendar alone.
Can penetration testing disrupt production systems?
It can. The NCSC notes that testers try to avoid undue impact but cannot guarantee there will be no unexpected reactions. Reduce risk with a staging environment, backups, agreed test windows, stop conditions and an on-call technical contact. Disruptive techniques such as denial of service are normally excluded.
Is automated scanning the same as pentesting?
No. Scanners find known issues quickly, while penetration testers use judgment to validate, chain and explain real risk. Some vendors now sell AI-assisted testing, covered in Articsledge’s guide to AI penetration testing; ask how humans validate the results and what depth you are buying.
What qualifications should a tester have?
Ask for evidence that fits your technology and any requirement you face. CREST recommends qualified individuals working for accredited organisations, and the NCSC recommends CHECK-scheme testers and companies for UK government bodies. For commercial work, named testers, relevant experience and sample reports matter as much as logos.
Does penetration testing help with compliance?
It can provide evidence. PCI DSS explicitly requires it for in-scope systems, and customers or auditors often ask for reports. A test does not certify compliance, though; the assessor, card scheme or customer decides. Identify any required standard before scoping so the report fits.
Can a penetration test guarantee security?
No. A test covers an agreed scope at one point in time, with limited time and access. CREST notes it may not find every weakness, and the NCSC says it validates known issues on the day of the test. Use it alongside patching, monitoring and secure development.
What is the difference between internal and external testing?
External testing targets what an outsider can reach on the internet, such as websites, VPNs and firewalls. Internal testing starts inside the network and checks what an attacker or malicious user could reach next. Many SaaS companies need external and application testing first, with internal work only where relevant.
What is the difference between a pentest and a red-team exercise?
A penetration test aims for broad, documented coverage of an agreed scope. A red-team exercise pursues specific objectives, often covertly, to test detection and response. CREST describes them as similar but not identical. Red teaming suits mature defenders; most buyers should start with scoped penetration testing.
What should a penetration testing report include?
It should include scope and exclusions, methodology, an executive summary, prioritized findings with evidence, business impact, fix recommendations, limitations, tester details and retest options. Ask for a sample before you buy to check clarity, reproducibility and whether engineers can act on it.
Is retesting normally included?
Not always. Some vendors list re-scans in their plans, such as Astra and Intruder on the pages reviewed on 10 November 2026, while many consultancies price retests separately. Articsledge describes retesting as separately scoped. Agree the retest scope, window and cost in writing before testing starts.
How should a SaaS company scope testing?
List every application, API, environment and user role, then rank them by data sensitivity and exposure. Include tenant-isolation checks and admin functions. Provide documentation and test accounts per role, note exclusions and third parties, and decide whether production or staging will be tested.
How can buyers get an accurate quote?
Share a clear brief covering objective, systems, size, roles, stack, constraints, deadline and reporting needs. Ask for days, rate, deliverables and assumptions itemized, and compare at least three suppliers on the same scope. Never send credentials in an enquiry.
Key Takeaways
Scope decides value and price, so write objectives, assets, roles and exclusions before asking for quotes.
A penetration test validates risk at one point in time and cannot guarantee security.
Published prices are data points, not averages: UK day rates sit near £800–£1,500, so compare days and deliverables.
Gray-box authenticated testing usually gives the best coverage for SaaS and API products.
Insist on written authorization, named testers and a sample report, and walk away from promises of total security.
Match accreditation to real requirements such as PCI DSS cadence, buyer clauses and CHECK or CREST where specified.
Scans, assessments, code reviews and penetration tests answer different questions; use each where it fits.
Budget for remediation and retesting, because the value arrives when fixes are verified.
Actionable Next Steps
Inventory your applications, APIs, environments and user roles.
Write down the business objective and any buyer, auditor or regulator requirements.
Choose the testing approach and decide which roles need authenticated coverage.
Prepare the non-sensitive brief from this guide and keep credentials out of enquiries.
Shortlist at least three providers and request itemized quotes for the same scope.
Score proposals with the 100-point scorecard and apply the deal-breakers.
Sign authorization, rules of engagement and confidentiality terms, then arrange test accounts securely.
Run the test, review the report with engineering and assign owners and dates.
Fix, retest and feed lessons back into development and monitoring.
To discuss a scoped assessment of a web application, API or SaaS product, visit Articsledge’s penetration testing services page. Suitability and availability are confirmed during scoping.
Glossary
Attack surface: Every point where an attacker could try to enter or extract data from a system.
API: Application programming interface: rules that let software systems exchange data and trigger actions.
Authenticated testing: Testing performed while logged in as one or more user roles.
Black-box testing: Testing with no inside information about the target.
CVSS: Common Vulnerability Scoring System, a numeric way to rate vulnerability severity.
Exploit: A technique that takes advantage of a weakness.
False positive: A reported issue that is not a real vulnerability.
Gray-box testing: Testing with limited information, such as user credentials.
Penetration test (pentest): An authorized, scoped attempt to find and validate security weaknesses.
Proof of concept: Minimal evidence showing that a weakness can be exploited.
Red team: A group that simulates an adversary to test prevention, detection and response.
Remediation: Fixing or mitigating a weakness.
Retest: Checking specific findings again after fixes.
Rules of engagement: Written limits on what testers may do, when and how.
Scope: The systems, activities and exclusions covered by a test.
Tenant isolation: Controls keeping one customer’s data separate from another’s in shared software.
Vulnerability assessment: Identifying, classifying and prioritizing weaknesses, usually without exploiting them.
White-box testing: Testing with full information, such as documentation or source code.
Sources & References
Technical Guide to Information Security Testing and Assessment (NIST SP 800-115). National Institute of Standards and Technology, September 2008. https://csrc.nist.gov/pubs/sp/800/115/final
Penetration testing. UK National Cyber Security Centre, published 8 August 2017, reviewed 10 January 2022. https://www.ncsc.gov.uk/guidance/penetration-testing
OWASP Web Security Testing Guide. OWASP Foundation, stable edition v4.2 with a development edition toward 5.0, n.d., accessed 10 November 2026. https://wstg.owasp.org/
OWASP Top 10 API Security Risks – 2023. OWASP Foundation, 2023 edition, accessed 10 November 2026. https://owasp.org/API-Security/editions/2023/en/0x11-t10/
A Guide to Penetration Testing. CREST, December 2022. https://www.crest-approved.org/wp-content/uploads/2023/04/A-Guide-to-Penetration-Testing-2022.pdf
CIS Critical Security Control 18: Penetration Testing. Center for Internet Security, n.d., accessed 10 November 2026. https://www.cisecurity.org/controls/penetration-testing
PCI Data Security Standard (PCI DSS). PCI Security Standards Council, page modified 8 April 2026, accessed 10 November 2026; v4.0.1 (June 2024) described as current by the sources reviewed. https://www.pcisecuritystandards.org/standards/pci-dss/
ISO/IEC 27001:2022 Information security management systems. International Organization for Standardization, 2022. https://www.iso.org/standard/27001
ISO 27001 security testing framework (secondary summary of Annex A controls 8.8 and 8.29). Invicti, n.d., accessed 10 November 2026. https://www.invicti.com/blog/web-security/iso-27001-security-testing-framework
Customer Support Policy for Penetration Testing. Amazon Web Services, page metadata updated 5 November 2026, accessed 10 November 2026. https://aws.amazon.com/security/penetration-testing/
Microsoft Security Testing Rules of Engagement. Microsoft Security Response Center, n.d., accessed 10 November 2026. https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement
PRISM Infosec, Penetration Testing / Infrastructure Testing (G-Cloud 14). UK Government Digital Marketplace, accessed 10 November 2026. https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/services/177956623951777
Zenzero Solutions, Penetration Testing. UK Government Digital Marketplace, accessed 10 November 2026. https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/360920760274162
CyberCX UK, Penetration Testing. UK Government Digital Marketplace, accessed 10 November 2026. https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/848278293500549
Trustmarque, Penetration & Security Testing Services. UK Government Digital Marketplace, accessed 10 November 2026. https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/718304368857778
PureCyber, Penetration Testing (Web Application). UK Government Digital Marketplace, accessed 10 November 2026. https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/802014789759783
Pentesting, on-demand: pricing. Intruder Systems Ltd, accessed 10 November 2026. https://www.intruder.io/pentest-pricing
Plans & Pricing. Astra IT, Inc., accessed 10 November 2026. https://www.getastra.com/pricing
Penetration Testing Price Index 2026 (secondary, vendor-published). Stingrai, 1 September 2026. https://www.stingrai.io/blog/penetration-testing-price-index-2026
How Much Does a Penetration Test Cost in 2026? (secondary). Helix, 31 August 2026. https://helix.ml/blog/penetration-testing-cost
Penetration Testing Services for Businesses. Articsledge, accessed 10 November 2026. https://www.articsledge.com/penetration-testing-services
