The first penetration test for a small SaaS: what $5,000 buys, what $25,000 adds, and what buyers read in the report

Say a customer's security team asks for a penetration test, and you ask around. One firm quotes $2,400. Another quotes $24,000. Both will send you a PDF with "Penetration Test Report" on the front, and from the outside you can't tell which one the customer will accept.

The difference is mostly tester days, and whether anyone logged in. On one firm's book of 55 tests, 70% of the web application tests turned up at least one High or Critical sign-in or permissions finding. That is the kind of bug where customer A opens customer B's invoice by changing a number in a URL. A scanner has no idea that invoice 4417 isn't yours to see.

This piece turns published 2026 prices into days, shows what those days buy, works through one small SaaS, and covers the part most price guides skip: what the buyer reads, and how to show them your findings without losing the deal. Prices were checked on 4 November 2026. Nearly all of them come from firms that sell testing, so read them as asking prices and get two quotes on your own scope.

What vendors publish for one web app in 2026

Most firms still say "contact us". These ones put a number on a page you can read:

Sources: Bugcrowd on AWS Marketplace (12-month contract, retesting for 12 months with one report update on web, network and API tests), Blaze, Astra, Intruder, Cobalt, Secure Ideas. Astra's page contradicts itself on the Auto re-scan count: the table says 1, its FAQ says 2.

Turn the price into days

A quote means little until you divide it by a day rate. Here are the published rates we could find, applied to the two budgets. Blaze's indicative US rate is $1,600 to $2,800 a day. Stingrai's index reads 30 UK government rate cards (median £1,000, about $1,364) and US federal ceiling rates from GSA (median $157.03 an hour). The federal figure is a contract ceiling for labour, so it isn't a commercial quote, but it's a useful floor.

So $5,000 is two to four tester days and $25,000 is nine to twenty. Writing the report comes out of those days. Allow about one for it, and a $5,000 test can leave under one full day of actual testing at the top rates.

What $5,000 buys and what $25,000 adds

No standard defines either tier, and firms cut scope differently. This table is our reading of the published tiers above, so treat it as what to expect and check it against your statement of work.

You can build the top tier from Bugcrowd's list prices. A Large web test ($15,000) plus a cloud configuration test ($5,000) comes to $20,000. A Medium web test ($8,000), a cloud test ($5,000) and mobile on both platforms ($13,000) comes to $26,000. On that list, the extra money goes on more targets as much as on a longer look at the same one.

Strike's summary of cheap quotes names what falls off first: multi-role permissions testing, chained findings and business logic, which it calls most of the price gap. Those are exactly the things a small multi-tenant SaaS is most likely to get wrong. A cheap quote with no logged-in multi-role testing leaves out the part you were buying.

Black box, grey box, white box: buy grey

The PCI Security Standards Council's guidance puts it plainly: grey-box and white-box tests "yield more accurate results" than a pure black-box test, and black box "may require more time, money, and resources". It was written for card data, but the logic carries over.

The OWASP testing guide says the best way to test for insecure object references is "having at least two (often more) users". So give the tester two accounts in each of two separate tenants, with data in them. Spending your two days watching a tester try to break in from outside isn't good value when your customers log in every day, and paying someone to guess your API routes is expensive when you can hand them the docs.

Scan with a cover page: how to spot one

PCI's guidance gives the cleanest line. A scan is mostly automated and takes "several seconds to several minutes per scanned host". A test is "a manual process", and engagements "may last days or weeks". Its report says how a finding can be exploited and how far, whereas a scan lists known weaknesses by score. Scanners are a normal part of a real test; the problem is a scan that is the whole deliverable.

The list draws on Blaze's warning signs, plus our own additions on samples and fix advice. As a rule of thumb, SecurityMetrics says a test under $4,000 is "probably not a real penetration test" (as quoted on Strike's comparison page). That line now has an awkward exception, below.

The new $3,500 option

AI-driven tests are the real change in 2026 pricing. Intruder and Cobalt both publish $3,500, and Intruder offers a refund if an auditor rejects the report. They are sold as tests, not scans, and Intruder's reads your repository.

Whether they satisfy your buyer is a separate question. We found no published data on how buyers or auditors treat them, and a questionnaire asking for an independent manual test may not count one. The sentiment among security people is mixed: in Cobalt's 2026 survey of 455 professionals, 9% back fully automated pentesting, down from 29% a year earlier, and 47% prefer a hybrid. Cobalt sells human testing as well as the autonomous kind, so read that with care. Our advice: run one as preparation if it fits your budget, then ask the buyer or the auditor in writing before you rely on it as your only evidence. One email can save you $3,500 or a lost month.

A worked budget for one small SaaS

Take a made-up but typical product: one web app, three roles (owner, member, support admin), 60 API endpoints, card billing through a payment provider, on AWS, no mobile app. The day plan below is our own estimate, so use it to argue with a quote and not as a rate card.

So the honest number is roughly $9,000 to $15,000, a bit above the $8,000 we used in the SOC 2 budget. Then there is your own time. One firm's median is 8 findings per test, with 54% of web findings rated High or Critical. Assuming four hours a finding, at the $100 an hour used in that same budget:

All in, about $13,800 to $20,400 for the first year's test. If one $20,000-a-year customer is waiting on it, that's easy. If nobody has asked, send the self-assessment and a plan instead, as described in the security questionnaire article, and keep the money until someone does.

What to put in the statement of work

Stingrai's template makes a good point: "Counts, not adjectives, are what price and schedule are built on." Send every firm the same table, so you can compare the quotes:

Then get these lines in writing:

Tester days and who. The number, and the tester's name and certifications.

Retest. Stingrai calls this "the clause most often quietly billed as an extra", and suggests 90 days from the final report as the floor. Standalone retests run $2,000 to $5,000 by one published range. Blaze includes one round within 90 days on its Essentials and Assurance packages, and it's an add-on on Lite.

A letter of attestation. Packetlabs notes that not every test includes one, so ask before you start. Ask for a clean-retest letter too.

Fast notice. The template uses 4 hours for a confirmed Critical and 24 hours for a High. You don't want to read about a live hole in the final PDF.

The environment on the letter. If you test staging, make sure it runs the same build as production and say so.

Your cloud's rules. AWS lets customers test listed services such as EC2, RDS, CloudFront, Lambda and API Gateway without prior approval, but bans denial-of-service testing, including request flooding on login and API. Pass that on to the tester, and keep the providers you don't own out of scope.

What the buyer actually reads

Almost nobody at the buyer reads your whole report, and you usually shouldn't send it. A letter of attestation is a short signed document on the firm's letterhead: who was tested, by whom, the dates, scope and method, a high-level result, and whether issues were addressed. It exists because the full report holds exploit paths, payloads and addresses that shouldn't travel around a procurement team. It is not a compliance attestation or a SOC 2 report; that has to come from a qualified assessor.

Buyers vary and nobody publishes a checklist, but from the standards and templates above, we'd expect a reviewer to check these in about this order:

That last row deserves a note. A report with no findings isn't automatically good news when the median at one firm is 8 (one firm's book of work, not an industry benchmark). A reviewer who sees zero may wonder how hard anyone looked, and a report with six findings, all closed and retested, tells a better story about how your company behaves.

If a buyer does insist on the full report, send it under NDA, after the retest, with the finding status filled in. PCI's outline gives the usual sections: executive summary, scope, methodology, a testing narrative, findings with severity and affected targets, and the clean-up left to do.

Fix and present the findings

Time is the catch. Median time to fix at that same firm was 10.5 days for Criticals (only 18 were tracked), 38 days for Highs and 26 days overall, but the slowest tenth of Highs took 125 days or more. So a 90-day retest window is comfortable for most of your list and tight for the worst of it. Assign an owner and a date to each finding the day the report arrives, and work through the Highs first, since those are the ones that overrun.

Keep a one-page status sheet. This is the document you'll send most often:

Three habits make this sheet work. Use generic titles, with no URLs or parameters. Mark anything you won't fix as accepted, with an owner, a reason and a review date, because a dated decision reads as management and a missing row reads as hiding. And never change a severity yourself: if you believe a High should be a Medium because of something the tester didn't know, ask the firm to re-rate it in writing.

A reply to the buyer can be this short:

If you have AI features, say whether they were in scope. In the same Cobalt survey, 77% of organizations regularly test their AI-powered products, only 38% of LLM vulnerabilities had been fixed, and the mean time to resolve them was 36 days. Our prompt injection tests are a cheap place to start before a tester does it.

How long it takes, if a deal is waiting

That's why a dated booking is worth having early: you can answer the questionnaire with "booked for 6 April" this week, and it's a real answer. Astra, for one, issues an engagement letter saying a manual test is under way. Then test annually and after significant changes, which is what PCI's guidance asks for and what your next questionnaire or enterprise contract is likely to assume.

If you do one thing from all this: before you compare prices, ask each firm how many tester days you get, and whether they'll test as two users in two separate tenants. Those two answers explain most of the difference between the quotes.

Sources

Prices: Blaze Information Security, How much does penetration testing cost (updated 29 October 2026); Bugcrowd on AWS Marketplace; Astra pricing; Intruder pentest pricing; Cobalt pricing; Secure Ideas (published July 2024, modified August 2026). Rates and benchmarks: Stingrai price index 2026 (UK G-Cloud 14 rate cards, GSA CALC+); Stingrai State of Penetration Testing 2026 (55 tests, 1,206 findings, one firm's own data); Strike, What penetration testing actually costs (vendor pages read 29 July 2026; quotes SecurityMetrics and DeepStrike). Method and reporting: PCI SSC Penetration Testing Guidance v1.1 (September 2017); OWASP Web Security Testing Guide v4.2, insecure direct object references; Stingrai statement of work template 2026; Packetlabs, What is a penetration testing letter of attestation (12 May 2026); AWS penetration testing policy; Cobalt press release, 25 June 2026 (survey of 455 professionals). All pages read on 4 November 2026. Most price sources sell testing, and this article is general information rather than security or legal advice.