Effort sets the price
A penetration test is priced on effort: how many working days skilled testers need. The biggest driver is the scope, meaning what exactly gets tested:
- the number of external IP addresses and hosts;
- web applications and their user roles;
- APIs and mobile apps;
- the internal network and Active Directory;
- cloud accounts and wireless networks.
The type of test
- External network test: what an attacker sees from the internet.
- Internal test: what someone already inside the network could do, for example through an infected laptop.
- Web applications and APIs: tests with logins and several user roles take longer.
- Cloud: a review of configuration and access rights.
- Social engineering and phishing: tests people and processes, not only systems.
- Red teaming: a goal-driven attack that runs longer and tests detection and response as well.
How much the testers are told
Black box (no information) mimics an outside attacker but spends time on discovery. Grey box (a user account and some documentation) usually finds more in the same number of days. White box (source code and architecture) is the most thorough.
Timing and constraints
Testing outside working hours, change-freeze periods, testing only against production and stricter rules of engagement all add coordination.
A retest after fixes is usually a separate, shorter step, so check whether a quote includes it. Ours includes a retest of the fixed findings, on the terms set out in our proposal.
What a good quote spells out
- The exact scope: which hosts, applications and user roles.
- The methodology, for example the OWASP Web Security Testing Guide for web applications.
- The number of working days and who does the work.
- What the report contains: a management summary, technical findings rated with CVSS, evidence and remediation advice.
- Whether a retest is included.
- Timing, rules of engagement and written authorization for the test.
- How your data is kept and deleted after the test.
A scan is not a penetration test
Automated vulnerability scanning is useful and cheap, but it reports possible problems without proving or connecting them. In a penetration test, people confirm the findings, chain weaknesses the way an attacker would and remove false alarms. If a very low quote arrives very quickly, ask how much of the work is manual.
Testing and the cybersecurity law
Among its ten risk-management measures, North Macedonia’s Law on Security of Network and Information Systems requires entities in scope to assess whether their measures work. A penetration test is one common way to show that.
How we help
Penetration testing & red teaming: Manual testing of networks, applications, cloud and people, with CVSS-rated findings, clear reports and a retest of fixes.