Guide
What a Penetration Test Costs in 2026.
Honest ranges, what actually drives them, and what to budget for the retest that should not cost extra.
2026 manual pentest · US rangeSAMPLING
FLOOR$12K
CEILING$150K+
> resolved$25K to $60K
File · Answer first
Answer first
Across the engagements we scope, a manual, operator-led US penetration test in 2026 runs from about $12K for a small focused web app to $150K and up for a multi-environment, multi-vector engagement. Mid-market web app work lands in the $25K to $60K band. Red team engagements start near $75K and move with objective complexity, not headcount. What follows is what actually moves a number inside those ranges, so you can read a proposal instead of guessing at it.
File · What drives
What drives cost
- [01] Operator hours. The single largest cost. Senior operator time is not interchangeable with junior bench time.
- [02] Scope size and complexity. Endpoints, roles, environments, integrations.
- [03] Compliance overhead. PCI, HIPAA, FedRAMP, ISO 27001 add documentation and evidence work.
- [04] Environment access friction. NDAs, special clearances, and clean-room setups add days.
File · What does
What does not drive cost (but should not be free either)
Retesting should be included. Unlimited remediation validation is standard at Alacrinet. If a vendor itemizes retest, that is a pricing model decision, not a security one. See /unlimited-remediation-validation for the policy.
File · Bailey's take
Bailey's take on commodity pricing
Operator Note OPR · STANDARD-OF-WORK
“When a vendor quotes you a price that does not support real offensive testing, the work is being routed somewhere the price does support. That is the trade you are making, even if it is not in the proposal.”
File · FAQ
Frequently Asked Questions
Q1 Why is your pricing higher than the cheap quotes?
Because we do not route delivery to overseas labor and we do not staff junior bench to senior names. The operator on the proposal is the operator on the engagement.
Q2 Do you offer fixed-price engagements?
Yes. Every Alacrinet pentest is fixed-fee post-scoping. No hourly surprise billing.
Q3 Is the retest extra?
No. Unlimited and untimed, included on every engagement.
Talk to an Operator
Ready to See Your Environment the Way Attackers Do?
Real operators. Real attack paths. Real business impact. Talk to us about your security goals.