Most penetration tests in the US cost between $10,000 and $30,000 per engagement, and a web application test typically costs $5,000 to $30,000, depending on scope. Rootshell Core starts from $5,000 a year, exclusive of tax, and includes an authenticated manual test, validated by our testers, followed by 12 months of automated continuous testing.
Based in the UK? See the UK penetration testing cost guide, with prices in pounds plus VAT.
See Rootshell pricing for the full levels and what is included.
Last reviewed 9 November 2026. Prices are in US dollars and are indicative, based on published 2026 market guides. They are not quotes.
Penetration testing cost in the US by test type (2026)
| Test type | Typical cost |
|---|---|
| Web application | $5,000 to $30,000 |
| API | $5,000 to $30,000 |
| External network | $4,000 to $15,000 |
| Internal network | $10,000 to $35,000 |
| Mobile application (per platform) | $7,000 to $35,000 |
| Cloud | $10,000 to $50,000 |
| Red team | $30,000 to $150,000 or more |
| Rootshell Core (one public-facing web application, authenticated manual test plus 12 months of continuous testing) | From $5,000 a year, exclusive of tax |
The ranges above come from published 2026 pricing guides and vary by provider. Treat them as a guide for budgeting, not a price list.
What drives the price
- The number of applications, hosts or environments in scope.
- How many user roles are tested and whether testing is authenticated.
- How complex the application and its APIs are.
- The experience and accreditations of the testers.
- Whether retests and reporting for audits are included or charged extra.
How is penetration testing priced now: day rate or fixed price?
Day rates are how traditional, one-off testing is usually priced: a number of days multiplied by a daily rate, with extras for retests and reporting. Traditional providers commonly charge roughly $1,500 to $3,000 a day. It is less suited to continuous testing and PTaaS, where the service is more than testers’ time.
Rootshell prices Core as one fixed annual price scoped to your application. It uses AI, includes an exposure management platform and passes those efficiencies on to you.
- Free remote retests. Retests of issues found in Rootshell testing are free and done remotely, so confirming a fix does not add to the bill.
- Exploit intelligence for the whole contract term. Over the contract term, typically 12 months, issues are checked against new and active exploits, the data is enriched and issues are reprioritised, so you fix what matters most first.
What a good quote should include, and what to watch for
- A written scope: what is in, what is out, and how many days are allocated.
- Who will do the work and what accreditations they hold.
- Whether testing is authenticated.
- What you receive at the end, and how: a PDF, a static portal or a live platform.
- Whether retests are included, and how many.
Watch for these gotchas
- A low day rate. A cheap day rate says little about quality. Ask what level of tester you are getting: their experience, accreditations and how much of the work they do themselves.
- The days creeping up. A low day rate can be offset by more days across the contract term. Ask for the total number of days and the total price, not just the rate.
- Charges for retesting. Confirming a fix is often charged by the day or limited to one round. Ask whether retests are free, how many are included, and whether they are remote.
- Scoping and reporting extras. Scoping calls, extra reporting for audits, out-of-hours work and changes to scope can all be added later. Ask what is not included.
Rootshell Core avoids this by being one fixed annual price for the application: the authenticated manual assessment, validated by our testers, 12 months of automated continuous testing, free remote retests, exploit intelligence for the whole contract term and the Rootshell Platform.
One-off test or continuous testing?
A one-off test shows your position on one day. Continuous testing adds automated testing through the year, run daily, weekly or monthly, so new exposure is picked up between tests. See continuous penetration testing, web application penetration testing and Rootshell pricing.
Frequently asked questions
How much does a penetration test cost in the US?
Most penetration tests in the US cost between $10,000 and $30,000 per engagement, and a web application test typically costs $5,000 to $30,000, depending on scope. Rootshell Core starts from $5,000 a year, exclusive of tax, and includes an authenticated manual test, validated by our testers, followed by 12 months of automated continuous testing.
How much does a web application penetration test cost?
A web application penetration test typically costs $5,000 to $30,000 in 2026, depending on the number of user roles, how complex the application and its APIs are, and whether testing is authenticated.
How much does continuous penetration testing cost?
Rootshell Core starts from $5,000 a year, exclusive of tax, for one public-facing web application. That covers an authenticated manual test, validated by our testers, followed by 12 months of automated continuous testing, with exploit intelligence throughout the contract term, typically 12 months, so issues are reprioritised as the threat changes, and free remote retests.
Is penetration testing priced by day rate or fixed price?
Day rates are how traditional, one-off testing is usually priced: a number of days multiplied by a daily rate, with extras for retests and reporting. Rootshell prices Core as one fixed annual price scoped to your application, so the price does not move with the days worked.
Why do penetration testing prices vary so much?
Scope, the number of user roles, application and API complexity, whether testing is authenticated, the experience of the testers, and whether retests and reporting are included all move the price.
